spring-security实现权限管理

首先需要配置好spring-security：[spring-security简单配置](http://blog.csdn.net/qq_28890731/article/details/51013366)

整体思路是将权限管理分为两部分：资源控制和页面展示控制，首先确保没有权限的资源不可访问，其次是将没权限操作的页面标签隐藏。

数据库涉及到6张表，分别是：
1，用户表；2，角色表；3，资源（权限）表；
4，用户－角色关联表；5，角色－资源关联表；6，用户－资源关联表
目标：可以直接给用户关联资源；也可以将资源封装给角色，然后将角色关联给用户。

spring-security配置文件（下面有配置文件中相关的bean）：

<beans:beans xmlns="http://www.springframework.org/schema/security"             xmlns:beans="http://www.springframework.org/schema/beans"             xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"             xsi:schemaLocation="http://www.springframework.org/schema/beans        http://www.springframework.org/schema/beans/spring-beans-3.0.xsd        http://www.springframework.org/schema/security        http://www.springframework.org/schema/security/spring-security.xsd">    <!--配置不需要进行安全校验的资源-->    <http pattern="/static/**" security="none"/>    <http pattern="/login" security="none"/>    <!--详细的安全校验规则,主要以登陆为主-->    <http use-expressions="true" auto-config="true" entry-point-ref="authenticationProcessingFilterEntryPoint">        <!--登陆相关,主要设置登陆页面的用户名和密码的属性名称,以及提交登陆的action名称-->        <form-login login-page="/login" password-parameter="password" username-parameter="userName"                    login-processing-url="/j_spring_security_check"                    default-target-url="/index" always-use-default-target="true"                    authentication-failure-handler-ref="aleiyeAuthenticationFailureHandler"                    authentication-success-handler-ref="aleiyeAuthenticationSuccessHandler"/>        <custom-filter ref="authenticationProcessingFilter" before="FILTER_SECURITY_INTERCEPTOR"/>        <custom-filter ref="loginFilter" after="FORM_LOGIN_FILTER"/>        <logout invalidate-session="true" logout-success-url="/login" logout-url="/j_spring_security_logout"/>        <session-management invalid-session-url="/login" session-authentication-error-url="/login"/>        <csrf disabled="true"/>    </http>    <beans:bean id="authenticationProcessingFilterEntryPoint"                class="com.aleiye.web.system.security.filter.AleiyeAuthenticationEntryPoint">        <beans:constructor-arg name="loginFormUrl" value="/login"/>    </beans:bean>    <!--登陆失败的处理类,可以添加错误信息-->    <beans:bean id="aleiyeAuthenticationFailureHandler"                class="com.aleiye.web.system.security.handler.AleiyeAuthenticationFailureHandler">        <beans:constructor-arg name="defaultFailureUrl" value="/login"/>    </beans:bean>    <!--登陆成功的处理类,可以进行session的封装等-->    <beans:bean id="aleiyeAuthenticationSuccessHandler"                class="com.aleiye.web.system.security.handler.AleiyeAuthenticationSuccessHandler">        <beans:constructor-arg name="defaultTargetUrl" value="/index"/>    </beans:bean>    <!-- 用户权限配置 -->    <beans:bean id="authenticationProcessingFilter"                class="com.aleiye.web.system.security.filter.AuthenticationProcessingFilter">        <!-- 用户拥有的权限 -->        <beans:property name="authenticationManager" ref="aleiyeAuthenticationManager"/>        <!-- 用户是否拥有所请求资源的权限 -->        <beans:property name="accessDecisionManager" ref="aleiyeAccessDecisionManager"/>        <!-- 资源与权限对应关系 -->        <beans:property name="securityMetadataSource" ref="aleiyeSecurityMetadataSource"/>    </beans:bean>    <!-- 校验是否登陆 -->    <beans:bean id="loginFilter" class="com.aleiye.web.system.security.filter.AleiyeLoginFilter">        <beans:constructor-arg name="loginUrl" value="/login"/>        <beans:constructor-arg name="indexUrl" value="/index"/>    </beans:bean>    <!--校验用户权限-->    <beans:bean id="aleiyeAccessDecisionManager"                class="com.aleiye.web.system.security.filter.AleiyeAccessDecisionManager"/>    <beans:bean id="aleiyeSecurityMetadataSource"                class="com.aleiye.web.system.security.filter.AleiyeSecurityMetadataSource"/>    <!--登陆用户信息查询-->    <beans:bean id="daoUserProvider" class="com.aleiye.web.system.security.Provider.AleiyeAuthenticationProvider">        <beans:property name="userDetailsService" ref="userDetailService" />        <beans:property name="passwordEncoder" ref="md5PasswordEncoder" />    </beans:bean>    <!--权限校验管理类-->    <authentication-manager alias="aleiyeAuthenticationManager">        <authentication-provider ref="daoUserProvider" />    </authentication-manager>    <beans:bean id="md5PasswordEncoder"                class="org.springframework.security.authentication.encoding.Md5PasswordEncoder"/>    <beans:bean id="userDetailService" class="com.aleiye.web.system.security.service.UserDetailService"/></beans:beans>

第一部分：资源控制主要包括4个java类：
1：UserDetailService，AleiyeAuthenticationProvider封装用户拥有的权限
目的：将该用户能关联到的所有资源id集合赋值给用户实体

package com.aleiye.web.system.security.service;import com.aleiye.client.service.security.model.RUserStatusEnum;import com.aleiye.web.system.security.entity.AleiyeUserDetails;import com.aleiye.web.system.security.entity.SysFeatureSource;import com.aleiye.web.system.user.entity.SecUserInfo;import com.aleiye.web.system.user.service.IUserService;import org.springframework.beans.factory.annotation.Autowired;import org.springframework.security.core.authority.SimpleGrantedAuthority;import org.springframework.security.core.userdetails.UserDetails;import org.springframework.security.core.userdetails.UserDetailsService;import org.springframework.security.core.userdetails.UsernameNotFoundException;import java.util.ArrayList;import java.util.Collection;import java.util.List;/** * @project aleiye-web * @auth wentao.yu * @Date 16/1/9PM4:19 */public class UserDetailService implements UserDetailsService {    @Autowired    private IUserService userService;    @Autowired    private ISysFeatureSourceService sysFeatureSourceService;    @Override    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {        if (username != null && !username.isEmpty()) {            SecUserInfo secUserInfo = userService.getUser(username);            if (secUserInfo == null) {                throw new UsernameNotFoundException("用户[" + username + "]不存在!");            }            //加载用户权限            //此处特殊处理,对admin用户的权限为强制全部打开            Collection<SimpleGrantedAuthority> grantedAuthorityCollection = new ArrayList<>();            if (secUserInfo.getId() == 1) {                List<SysFeatureSource> sourceList = sysFeatureSourceService.findAllEnableRecords();                for (SysFeatureSource sysFeatureSource : sourceList) {                    SimpleGrantedAuthority simpleGrantedAuthority = new SimpleGrantedAuthority(sysFeatureSource.getId().toString());                    grantedAuthorityCollection.add(simpleGrantedAuthority);                }            } else {                //非admin用户加载相应权限                List<SysFeatureSource> sources = sysFeatureSourceService.findSourceByUserId(secUserInfo.getId());                for(SysFeatureSource source:sources){                    SimpleGrantedAuthority simpleGrantedAuthority = new SimpleGrantedAuthority(source.getId().toString());                    grantedAuthorityCollection.add(simpleGrantedAuthority);                }            }            AleiyeUserDetails ud = new AleiyeUserDetails(secUserInfo, secUserInfo.getStatus().intValue() == RUserStatusEnum.NORMAL.getValue(), grantedAuthorityCollection);            return ud;        }        return null;    }}

package com.aleiye.web.system.security.Provider;import org.springframework.security.authentication.BadCredentialsException;import org.springframework.security.authentication.InternalAuthenticationServiceException;import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;import org.springframework.security.authentication.dao.AbstractUserDetailsAuthenticationProvider;import org.springframework.security.authentication.dao.SaltSource;import org.springframework.security.authentication.encoding.PasswordEncoder;import org.springframework.security.authentication.encoding.PlaintextPasswordEncoder;import org.springframework.security.core.AuthenticationException;import org.springframework.security.core.userdetails.UserDetails;import org.springframework.security.core.userdetails.UserDetailsService;import org.springframework.security.core.userdetails.UsernameNotFoundException;import org.springframework.util.Assert;/** * @author weiwentao: * @version 创建时间：2015年10月21日 下午5:47:03 * 类说明 */public class AleiyeAuthenticationProvider extends AbstractUserDetailsAuthenticationProvider {    // ~ Static fields/initializers    // =====================================================================================    /**     * The plaintext password used to perform     * {@link PasswordEncoder#isPasswordValid(String, String, Object)} on when the user is     * not found to avoid SEC-2056.     */    private static final String USER_NOT_FOUND_PASSWORD = "userNotFoundPassword";    // ~ Instance fields    // ================================================================================================    private PasswordEncoder passwordEncoder;    /**     * The password used to perform     * {@link PasswordEncoder#isPasswordValid(String, String, Object)} on when the user is     * not found to avoid SEC-2056. This is necessary, because some     * {@link PasswordEncoder} implementations will short circuit if the password is not     * in a valid format.     */    private String userNotFoundEncodedPassword;    private SaltSource saltSource;    private UserDetailsService userDetailsService;    public AleiyeAuthenticationProvider() {        setPasswordEncoder(new PlaintextPasswordEncoder());    }    // ~ Methods    // ========================================================================================================    @SuppressWarnings("deprecation")    protected void additionalAuthenticationChecks(UserDetails userDetails,            UsernamePasswordAuthenticationToken authentication)            throws AuthenticationException {        Object salt = null;        if (this.saltSource != null) {            salt = this.saltSource.getSalt(userDetails);        }        if (authentication.getCredentials() == null) {            logger.debug("Authentication failed: no credentials provided");            throw new BadCredentialsException(messages.getMessage(                    "AbstractUserDetailsAuthenticationProvider.badCredentials",                    "Bad credentials"));        }        String presentedPassword = authentication.getCredentials().toString();        if (!passwordEncoder.isPasswordValid(userDetails.getPassword().toLowerCase(),                presentedPassword, salt)) {            logger.debug("Authentication failed: password does not match stored value");            throw new BadCredentialsException(messages.getMessage(                    "AbstractUserDetailsAuthenticationProvider.badCredentials",                    "Bad credentials"));        }        //成功之后，封装session        authentication.setDetails(userDetails);    }    protected void doAfterPropertiesSet() throws Exception {        Assert.notNull(this.userDetailsService, "A UserDetailsService must be set");    }    protected final UserDetails retrieveUser(String username,            UsernamePasswordAuthenticationToken authentication)            throws AuthenticationException {        UserDetails loadedUser;        try {            loadedUser = this.getUserDetailsService().loadUserByUsername(username);        }        catch (UsernameNotFoundException notFound) {            if (authentication.getCredentials() != null) {                String presentedPassword = authentication.getCredentials().toString();                passwordEncoder.isPasswordValid(userNotFoundEncodedPassword,                        presentedPassword, null);            }            throw notFound;        }        catch (Exception repositoryProblem) {            throw new InternalAuthenticationServiceException(                    repositoryProblem.getMessage(), repositoryProblem);        }        if (loadedUser == null) {            throw new InternalAuthenticationServiceException(                    "UserDetailsService returned null, which is an interface contract violation");        }        return loadedUser;    }    /**     * Sets the PasswordEncoder instance to be used to encode and validate passwords. If     * not set, the password will be compared as plain text.     * <p>     * For systems which are already using salted password which are encoded with a     * previous release, the encoder should be of type     * {@code org.springframework.security.authentication.encoding.PasswordEncoder}.     * Otherwise, the recommended approach is to use     * {@code org.springframework.security.crypto.password.PasswordEncoder}.     *     * @param passwordEncoder must be an instance of one of the {@code PasswordEncoder}     * types.     */    public void setPasswordEncoder(Object passwordEncoder) {        Assert.notNull(passwordEncoder, "passwordEncoder cannot be null");        if (passwordEncoder instanceof PasswordEncoder) {            setPasswordEncoder((PasswordEncoder) passwordEncoder);            return;        }        if (passwordEncoder instanceof org.springframework.security.crypto.password.PasswordEncoder) {            final org.springframework.security.crypto.password.PasswordEncoder delegate = (org.springframework.security.crypto.password.PasswordEncoder) passwordEncoder;            setPasswordEncoder(new PasswordEncoder() {                public String encodePassword(String rawPass, Object salt) {                    checkSalt(salt);                    return delegate.encode(rawPass);                }                public boolean isPasswordValid(String encPass, String rawPass, Object salt) {                    checkSalt(salt);                    return delegate.matches(rawPass, encPass);                }                private void checkSalt(Object salt) {                    Assert.isNull(salt,                            "Salt value must be null when used with crypto module PasswordEncoder");                }            });            return;        }        throw new IllegalArgumentException(                "passwordEncoder must be a PasswordEncoder instance");    }    private void setPasswordEncoder(PasswordEncoder passwordEncoder) {        Assert.notNull(passwordEncoder, "passwordEncoder cannot be null");        this.userNotFoundEncodedPassword = passwordEncoder.encodePassword(                USER_NOT_FOUND_PASSWORD, null);        this.passwordEncoder = passwordEncoder;    }    protected PasswordEncoder getPasswordEncoder() {        return passwordEncoder;    }    /**     * The source of salts to use when decoding passwords. <code>null</code> is a valid     * value, meaning the <code>DaoAuthenticationProvider</code> will present     * <code>null</code> to the relevant <code>PasswordEncoder</code>.     * <p>     * Instead, it is recommended that you use an encoder which uses a random salt and     * combines it with the password field. This is the default approach taken in the     * {@code org.springframework.security.crypto.password} package.     *     * @param saltSource to use when attempting to decode passwords via the     * <code>PasswordEncoder</code>     */    public void setSaltSource(SaltSource saltSource) {        this.saltSource = saltSource;    }    protected SaltSource getSaltSource() {        return saltSource;    }    public void setUserDetailsService(UserDetailsService userDetailsService) {        this.userDetailsService = userDetailsService;    }    protected UserDetailsService getUserDetailsService() {        return userDetailsService;    }}

2：AleiyeSecurityMetadataSource
1）系统启动时封装所有资源对应的权限；2）访问资源时获取该资源需要的权限
目的：用户访问某资源时 spring－security 会将url注入getAttributes方法，可通过正则关联到所有该url相对应的资源id集合，该方法返回资源id集合

package com.aleiye.web.system.security.filter;import com.aleiye.web.system.security.entity.SysFeatureSource;import com.aleiye.web.system.security.service.ISysFeatureSourceService;import org.slf4j.Logger;import org.slf4j.LoggerFactory;import org.springframework.beans.factory.annotation.Autowired;import org.springframework.security.access.ConfigAttribute;import org.springframework.security.access.SecurityConfig;import org.springframework.security.web.FilterInvocation;import org.springframework.security.web.access.intercept.FilterInvocationSecurityMetadataSource;import java.util.*;import java.util.regex.Pattern;/** * @author weiwentao: * @version 创建时间：2015年10月21日 下午12:26:29 *          类说明 */public class AleiyeSecurityMetadataSource implements FilterInvocationSecurityMetadataSource {    private static final Logger _LOG = LoggerFactory.getLogger(AleiyeSecurityMetadataSource.class);    @Autowired    private ISysFeatureSourceService sysFeatureSourceService;    private Map<Integer, Collection<ConfigAttribute>> resourceMap = new HashMap<>();    private Map<Integer, Pattern> urlPatternMap = new HashMap<>();    public AleiyeSecurityMetadataSource() {    }    @Override    public Collection<ConfigAttribute> getAllConfigAttributes() {        List<SysFeatureSource> sourceList = sysFeatureSourceService.findAllEnableRecords();        Collection<ConfigAttribute> collection = new ArrayList<>();        for (SysFeatureSource sysFeatureSource : sourceList) {            ConfigAttribute configAttribute = new SecurityConfig(sysFeatureSource.getId().toString());            collection.add(configAttribute);            //缓存访问路径与权限的映射关系            Collection<ConfigAttribute> sourceConfig = new ArrayList<>();            sourceConfig.add(configAttribute);            resourceMap.put(sysFeatureSource.getId(), sourceConfig);            //由于资源的路径不需要动态的变更,此处对正则进行缓存,以提高性能            //只有当为非只读功能时,才需要进行正则过滤            if (!sysFeatureSource.getReadOnly() && !sysFeatureSource.getUrlPattern().isEmpty()) {                Pattern p = Pattern.compile(sysFeatureSource.getUrlPattern());                urlPatternMap.put(sysFeatureSource.getId(), p);            }else{                _LOG.warn("the config of featureSource [id=" + sysFeatureSource.getId() + "] incorrect");            }        }        return collection;    }    @Override    public Collection<ConfigAttribute> getAttributes(Object arg0) throws IllegalArgumentException {        //返回请求的资源需要的权限        Collection<ConfigAttribute> configAttributes = new ArrayList<ConfigAttribute>();        FilterInvocation fi = (FilterInvocation) arg0;        for (Map.Entry<Integer, Pattern> entry : urlPatternMap.entrySet()) {            if (entry.getValue().matcher(fi.getRequestUrl()).matches()) {                configAttributes.addAll(resourceMap.get(entry.getKey()));            }        }        return configAttributes;    }    @Override    public boolean supports(Class<?> arg0) {        // TODO Auto-generated method stub        return true;    }}

3：AleiyeAccessDecisionManager 判断用户是否拥有所访问资源需要的权限
目的：将用户拥有的权限id集合与访问的资源所需权限id集合做对比，如果用户权限不满足所访问资源所需权限则抛出AccessDeniedException异常

package com.aleiye.web.system.security.filter;import org.springframework.security.access.AccessDecisionManager;import org.springframework.security.access.AccessDeniedException;import org.springframework.security.access.ConfigAttribute;import org.springframework.security.access.SecurityConfig;import org.springframework.security.authentication.InsufficientAuthenticationException;import org.springframework.security.core.Authentication;import org.springframework.security.core.GrantedAuthority;import java.util.Collection;/** * @author weiwentao: * @version 创建时间：2015年10月21日 下午12:24:57 * 类说明 */public class AleiyeAccessDecisionManager implements AccessDecisionManager {    @Override    public void decide(Authentication authentication, Object object,            Collection<ConfigAttribute> configAttributes) throws AccessDeniedException,            InsufficientAuthenticationException {        //如果本系统没有需要授权的资源,则直接通过校验        if(configAttributes == null){            return;        }        for(ConfigAttribute conAtt:configAttributes){            boolean flag = true;            String needAuthKey=((SecurityConfig)conAtt).getAttribute();            for(GrantedAuthority ga : authentication.getAuthorities()){                if(needAuthKey.equals(ga.getAuthority())){                    flag = false;                    break ;                }            }            if(flag)                throw new AccessDeniedException("没有进行该操作的权限!");        }    }    @Override    public boolean supports(ConfigAttribute arg0) {        return true;    }    @Override    public boolean supports(Class<?> arg0) {        return true;    }}

以上代码可实现资源访问控制。
但仅仅这样的话，页面还是会展示没有权限的资源链接，所以还需要将页面上没有权限访问的资源链接隐藏。

第二部分：页面展示控制
实现思路：页面标签上加一个class名，该名称与资源表中的资源相对应。这样用户所拥有的权限的补集就是所有不需要展示的页面标签class名。然后将不需要展示的class名放到session中，页面加载后将这些标签remove掉。
（更好的方式应该是拿到用户拥有的权限所对应的页面标签class，然后页面上只展示这些标签。但是此项目在加权限管理的时候第一版已经开发完成，用删除没权限标签的方式更方便实现。）