read AppFuse 3-权限认证续

★     容器启动时，调用监听器StartupListener，初始化Spring上下文环境，设置DAO type，

通过LookupDAOHibernate.getRoles取得角色信息，存于application scope中。

★     接着时调用UserCounterListener监听器，记录用户的登陆改变。

★     然后通过容器form认证，将请求转给login.jsp

★     Login.jsp静态引用loginForm.jsp，由其进行主要的权限认证工作。

★     loginForm.jsp表单提交后，将请求转向/authorize

★     /authorize的请求被login servlet处理

   <servlet-mapping>

      <servlet-name>login</servlet-name>

      <url-pattern>/authorize/*</url-pattern>

 </servlet-mapping>

★     而login servlet的真正处理者是LoginServlet。它取得username和password并且加密password。初始化该servlet时取得初始参数，决定是否采用SSL、密码是否加密和加密规则等，并最后生成请求URL,交由容器认证，此时认证工作并不通过Spring和hibernate,而是直接通过JDBCRealm。采取这样的方式使得SSL加密只是应用于用户登陆，而其他资源认证则使用已有的权限认证系统（毕竟SSL认证是很耗费资源的）。

 

 

 

★StartupListener监听器分析：

public class StartupListener extends ContextLoaderListener

    implements ServletContextListener {

    private static final Log log = LogFactory.getLog(StartupListener.class);

    public void contextInitialized(ServletContextEvent event) {

        if (log.isDebugEnabled()) {

            log.debug("initializing context...");

        }

        // call Spring's context ContextLoaderListener to initialize

        // all the context files specified in web.xml

        super.contextInitialized(event);

        ServletContext context = event.getServletContext();

        String daoType = context.getInitParameter(Constants.DAO_TYPE);

        // if daoType is not specified, use DAO as default

        if (daoType == null) {

            log.warn("No 'daoType' context carameter, using hibernate");

            daoType = Constants.DAO_TYPE_HIBERNATE;

        }

        // Orion starts Servlets before Listeners, so check if the config

        // object already exists

        Map config = (HashMap) context.getAttribute(Constants.CONFIG);

        if (config == null) {

            config = new HashMap();

        }

        // Create a config object to hold all the app config values

        config.put(Constants.DAO_TYPE, daoType);

        context.setAttribute(Constants.CONFIG, config);

        // output the retrieved values for the Init and Context Parameters

        if (log.isDebugEnabled()) {

            log.debug("daoType: " + daoType);

            log.debug("populating drop-downs...");

        }

        setupContext(context);

    }

    public static void setupContext(ServletContext context) {

        ApplicationContext ctx =

            WebApplicationContextUtils.getRequiredWebApplicationContext(context);

        LookupManager mgr = (LookupManager) ctx.getBean("lookupManager");

        // get list of possible roles

        context.setAttribute(Constants.AVAILABLE_ROLES, mgr.getAllRoles());

        if (log.isDebugEnabled()) {

            log.debug("drop-down initialization complete [OK]");

        }

    }

}

 

 

 

★ LoginServlet分析

public final class LoginServlet extends HttpServlet {

    private static String authURL = "j_security_check";

    private static String httpsPort = null;

    private static String httpPort = null;

    private static Boolean secure = Boolean.FALSE;

    private static String algorithm = "SHA";

    private static Boolean encrypt = Boolean.FALSE;

    private transient final Log log = LogFactory.getLog(LoginServlet.class);

    /**

     * 通过web.xml初始化端口参数

     */

         private static void initializeSchemePorts(ServletContext servletContext) {

        if (httpPort == null) {

            String portNumber =

                servletContext.getInitParameter(SslUtil.HTTP_PORT_PARAM);

            httpPort = ((portNumber == null) ? SslUtil.STD_HTTP_PORT : portNumber);

        }

        if (httpsPort == null) {

            String portNumber =

                servletContext.getInitParameter(SslUtil.HTTPS_PORT_PARAM);

            httpsPort = ((portNumber == null) ? SslUtil.STD_HTTPS_PORT

                                              : portNumber);

        }

    }

    public void init() throws ServletException {

        //web.xml中的auth_url是“j_security_check”

        authURL = getInitParameter(Constants.AUTH_URL);

 

 

 

        //获得password存储于数据库的加密规则，//web.xml中的algorithm是“SHA”

        algorithm = getInitParameter(Constants.ENC_ALGORITHM);

        //决定用户是否使用SSL

        secure = Boolean.valueOf(getInitParameter("isSecure"));

        //password是否被加密

        encrypt = Boolean.valueOf(getInitParameter("encrypt-password"));

        //默认设置

        //Use SSL for login? False

        //Programmatic encryption of password ? true

        //Use SSL for login? False

        //HTTP Port: 8080

        //HTTPS Port: 8443

        ServletContext ctx = getServletContext();

        initializeSchemePorts(ctx);

        // Orion starts Servlets before Listeners, so check if the config

        // object already exists

        Map config = (HashMap) ctx.getAttribute(Constants.CONFIG);

        if (config == null) {

            config = new HashMap();

        }

        // update the config object with the init-params from this servlet

        config.put(Constants.HTTP_PORT, httpPort);

        config.put(Constants.HTTPS_PORT, httpsPort);

        config.put(Constants.SECURE_LOGIN, secure);

        config.put(Constants.ENC_ALGORITHM, algorithm);

        config.put(Constants.ENCRYPT_PASSWORD, encrypt);

        ctx.setAttribute(Constants.CONFIG, config);

    }

    public void doGet(HttpServletRequest request, HttpServletResponse response)

    throws IOException, ServletException {

        execute(request, response);

    }

    public void doPost(HttpServletRequest request, HttpServletResponse response)

    throws IOException, ServletException {

        execute(request, response);

    }

    public void execute(HttpServletRequest request, HttpServletResponse response)

    throws IOException, ServletException {

        // 如果用户已经登陆，直接转向mainMenu.html

        if (request.getRemoteUser() != null) {

            if (log.isDebugEnabled()) {

                log.debug("User '" + request.getRemoteUser() +

                          "' already logged in, routing to mainMenu");

            }

            response.sendRedirect(request.getContextPath() + "/mainMenu.html");

            return;

        }

        String redirectString =

            SslUtil.getRedirectString(request, getServletContext(),

                                      secure.booleanValue());

        if (redirectString != null) {

            // Redirect the page to the desired URL

            response.sendRedirect(response.encodeRedirectURL(redirectString));

            if (log.isDebugEnabled()) {

                log.debug("switching protocols, redirecting user");

            }

        }

        //appfuse默认不使用SSL,会执行下面的程序。

        String username = request.getParameter("j_username");

        String password = request.getParameter("j_password");

        //记录用户信息在Cookies中。

        if (request.getParameter("rememberMe") != null) {

            request.getSession().setAttribute(Constants.LOGIN_COOKIE, "true");

        }

        String encryptedPassword = "";

        if (encrypt.booleanValue() &&

                (request.getAttribute("encrypt") == null)) {

            if (log.isDebugEnabled()) {

                log.debug("Encrypting password for user '" + username + "'");

            }

            //加密password

            encryptedPassword = StringUtil.encodePassword(password, algorithm);

        } else {

            encryptedPassword = password;

        }

        if (redirectString == null) {

            // signifies already correct protocol

            if (log.isDebugEnabled()) {

                log.debug("Authenticating user '" + username + "'");

            }

            String req =

                request.getContextPath() + "/" + authURL + "?j_username=" +

                username + "&j_password=" + encryptedPassword + "&j_uri=" +

                request.getParameter("j_uri");

// URL : //'/dudu/j_security_check?j_username=mraible&j_password=536c0b339345616c1b33caf4544//54d8b8a19 0d6c&j_uri=’

            if (log.isDebugEnabled()) {

                log.debug("URL : '" + req + "'");

            }

            response.sendRedirect(response.encodeRedirectURL(req));

        }

    }

}