Spring Security 3.0.5企业级安全解决方案详解

需积分: 9 73 浏览量更新于2024-07-30 收藏 750KB PDF 举报

Spring Security是针对基于J2EE的企业软件应用提供全面安全解决方案的重要框架。这款由Ben Alex和Luke Taylor合作开发的参考指南旨在为你提供一个强大且配置灵活的系统，帮助你在Spring框架中实现安全功能。它适用于Spring Security 3.0.5.RELEASE版本，包含核心模块（如spring-security-core.jar）、Web模块（spring-security-web.jar）以及支持其他身份验证协议和数据存储技术的扩展模块，如LDAP（spring-security-ldap.jar）、CAS（spring-security-cas-client.jar）和OpenID（spring-security-openid.jar）。指南的第一部分是入门教程，介绍了Spring Security的基本概念和历史。它阐述了什么是Spring Security，包括其在企业级应用程序中的作用和演变历程。此外，还提供了获取和使用Spring Security的步骤，以及项目模块的结构，如核心模块主要负责基本的安全功能，Web模块处理与Web应用的集成，而其他扩展模块则提供了对不同身份验证和授权机制的支持。在第二章中，主要关注安全命名空间配置。这部分设计了XML配置的方式，通过`<http>`元素来定义访问控制策略。初学者可以开始通过简单的`web.xml`配置了解如何启用基本的登录选项，比如表单和基本认证。此外，该章节还讲解了如何使用其他认证提供者、添加密码编码器以及高级特性，如Remember Me认证和HTTP/HTTPS通道安全设置。对于会话管理，这部分内容会涉及如何在Spring Security中处理和保护用户会话，确保安全性和防止会话劫持。通过深入学习，开发者可以掌握如何定制和扩展Spring Security来满足特定应用的安全需求。 Spring Security参考文档为开发人员提供了一个实用的工具，无论你是初次接触，还是希望深入理解并扩展其功能，都能在这个指南中找到所需的资料。无论是基础配置还是高级安全策略，都能在这里找到相应的指导和示例。

Spring Security

3.0.5.RELEASE 5

1.4 Getting Spring Security

You can get hold of Spring Security in several ways. You can download a packaged distribution from

the main Spring download page [http://www.springsource.com/download/community?project=Spring

%20Security], download individual jars (and sample WAR files) from the Maven Central repository (or

a SpringSource Maven repository for snapshot and milestone releases) or, alternatively, you can build

the project from source yourself. See the project web site for more details.

Project Modules

In Spring Security 3.0, the codebase has been sub-divided into separate jars which more clearly separate

different functionaltiy areas and third-party dependencies. If you are using Maven to build your project,

then these are the modules you will add to your pom.xml. Even if you're not using Maven, we'd

recommend that you consult the pom.xml files to get an idea of third-party dependencies and versions.

Alternatively, a good idea is to examine the libraries that are included in the sample applications.

Core - spring-security-core.jar

Contains core authentication and access-contol classes and interfaces, remoting support and basic

provisioning APIs. Required by any application which uses Spring Security. Supports standalone

applications, remote clients, method (service layer) security and JDBC user provisioning. Contains the

top-level packages:

• org.springframework.security.core

• org.springframework.security.access

• org.springframework.security.authentication

• org.springframework.security.provisioning

• org.springframework.security.remoting

Web - spring-security-web.jar

Contains filters and related web-security infrastructure code. Anything with a servlet API dependency.

You'll need it if you require Spring Security web authentication services and URL-based access-control.

The main package is org.springframework.security.web.

Config - spring-security-config.jar

Contains the security namespace parsing code (and hence nothing that you are likely yo use directly in

your application). You need it if you are using the Spring Security XML namespace for configuration.

The main package is org.springframework.security.config.

LDAP - spring-security-ldap.jar

LDAP authentication and provisioning code. Required if you need to use LDAP authentication or

manage LDAP user entries. The top-level package is org.springframework.security.ldap.

Spring Security

3.0.5.RELEASE 7

2.1 Introduction

Namespace configuration has been available since version 2.0 of the Spring framework.

It allows you to supplement the traditional Spring beans application context syntax

with elements from additional XML schema. You can find more information in the

Spring Reference Documentation [http://static.springsource.org/spring/docs/3.0.x/spring-framework-

reference/htmlsingle/spring-framework-reference.htm]. A namespace element can be used simply to

allow a more concise way of configuring an individual bean or, more powerfully, to define an alternative

configuration syntax which more closely matches the problem domain and hides the underlying

complexity from the user. A simple element may conceal the fact that multiple beans and processing

steps are being added to the application context. For example, adding the following element from the

security namespace to an application context will start up an embedded LDAP server for testing use

within the application:

<security:ldap-server />

This is much simpler than wiring up the equivalent Apache Directory Server beans. The most common

alternative configuration requirements are supported by attributes on the ldap-server element and

the user is isolated from worrying about which beans they need to create and what the bean property

names are.

. Use of a good XML editor while editing the application context file should provide

information on the attributes and elements that are available. We would recommend that you try out

the SpringSource Tool Suite [http://www.springsource.com/products/sts] as it has special features for

working with standard Spring namespaces.

To start using the security namespace in your application context, you first need to make sure that the

spring-security-config jar is on your classpath. Then all you need to do is add the schema

declaration to your application context file:

<beans xmlns="http://www.springframework.org/schema/beans"

xmlns:security="http://www.springframework.org/schema/security"

xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"

xsi:schemaLocation="http://www.springframework.org/schema/beans

http://www.springframework.org/schema/beans/spring-beans-3.0.xsd

http://www.springframework.org/schema/security

http://www.springframework.org/schema/security/spring-security-3.0.3.xsd">

...

</beans>

In many of the examples you will see (and in the sample) applications, we will often use "security"

as the default namespace rather than "beans", which means we can omit the prefix on all the security

namespace elements, making the content easier to read. You may also want to do this if you have your

application context divided up into separate files and have most of your security configuration in one

of them. Your security application context file would then start like this

You can find out more about the use of the ldap-server element in the chapter on LDAP.

Spring Security

3.0.5.RELEASE 8

<beans:beans xmlns="http://www.springframework.org/schema/security"

xmlns:beans="http://www.springframework.org/schema/beans"

xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"

xsi:schemaLocation="http://www.springframework.org/schema/beans

http://www.springframework.org/schema/beans/spring-beans-3.0.xsd

http://www.springframework.org/schema/security

http://www.springframework.org/schema/security/spring-security-3.0.3.xsd">

...

</beans:beans>

We'll assume this syntax is being used from now on in this chapter.

Design of the Namespace

The namespace is designed to capture the most common uses of the framework and provide a simplified

and concise syntax for enabling them within an application. The design is based around the large-scale

dependencies within the framework, and can be divided up into the following areas:

• Web/HTTP Security - the most complex part. Sets up the filters and related service beans used to

apply the framework authentication mechanisms, to secure URLs, render login and error pages and

much more.

• Business Object (Method) Security - options for securing the service layer.

• AuthenticationManager - handles authentication requests from other parts of the framework.

• AccessDecisionManager - provides access decisions for web and method security. A default one will

be registered, but you can also choose to use a custom one, declared using normal Spring bean syntax.

• AuthenticationProviders - mechanisms against which the authentication manager authenticates users.

The namespace provides supports for several standard options and also a means of adding custom

beans declared using a traditional syntax.

• UserDetailsService - closely related to authentication providers, but often also required by other

beans.

We'll see how to configure these in the following sections.

2.2 Getting Started with Security Namespace

Configuration

In this section, we'll look at how you can build up a namespace configuration to use some of the main

features of the framework. Let's assume you initially want to get up and running as quickly as possible

and add authentication support and access control to an existing web application, with a few test logins.

Then we'll look at how to change over to authenticating against a database or other security repository.

In later sections we'll introduce more advanced namespace configuration options.

web.xml Configuration

The first thing you need to do is add the following filter declaration to your web.xml file:

Spring Security

3.0.5.RELEASE 9

<filter-name>springSecurityFilterChain</filter-name>

<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>

</filter>

<filter-mapping>

<filter-name>springSecurityFilterChain</filter-name>

<url-pattern>/*</url-pattern>

</filter-mapping>

This provides a hook into the Spring Security web infrastructure. DelegatingFilterProxy is a

Spring Framework class which delegates to a filter implementation which is defined as a Spring bean

in your application context. In this case, the bean is named “springSecurityFilterChain”, which is an

internal infrastructure bean created by the namespace to handle web security. Note that you should not

use this bean name yourself. Once you've added this to your web.xml, you're ready to start editing

your application context file. Web security services are configured using the <http> element.

A Minimal <http> Configuration

All you need to enable web security to begin with is

<intercept-url pattern="/**" access="ROLE_USER" />

</http>

Which says that we want all URLs within our application to be secured, requiring the role ROLE_USER

to access them. The <http> element is the parent for all web-related namespace functionality. The

<intercept-url> element defines a pattern which is matched against the URLs of incoming

requests using an ant path style syntax

. The access attribute defines the access requirements for

requests matching the given pattern. With the default configuration, this is typically a comma-separated

list of roles, one of which a user must have to be allowed to make the request. The prefix “ROLE_” is

a marker which indicates that a simple comparison with the user's authorities should be made. In other

words, a normal role-based check should be used. Access-control in Spring Security is not limited to

the use of simple roles (hence the use of the prefix to differentiate between different types of security

attributes). We'll see later how the interpretation can vary

Note

You can use multiple <intercept-url> elements to define different access

requirements for different sets of URLs, but they will be evaluated in the order listed and

the first match will be used. So you must put the most specific matches at the top. You

can also add a method attribute to limit the match to a particular HTTP method (GET,

POST, PUT etc.). If a request matches multiple patterns, the method-specific match will

take precedence regardless of ordering.

To add some users, you can define a set of test data directly in the namespace:

See the section on Request Matching in the Web Application Infrastructure chapter for more details on how matches are actually

performed.

The interpretation of the comma-separated values in the access attribute depends on the implementation of the

AccessDecisionManager which is used. In Spring Security 3.0, the attribute can also be populated with an EL expression.

剩余133页未读，继续阅读

danielzhoufu

粉丝: 0
资源: 7

Spring Security 3.0.5企业级安全解决方案详解

spring security详解

spring security 4.0.1

spring security 的一些资料----下载不扣分，回帖加1分，童叟无欺，欢迎下载

springsecurity

Spring Security

SpringSecurity

Spring security

基于springboot的酒店管理系统源码（java毕业设计完整源码+LW）.zip

蓄电池与超级电容混合储能并网matlab simulink仿真模型 （1）混合储能采用低通滤波器进行功率分配，可有效抑制功率波动，并对超级电容的soc进行能量管理，soc较高时多放电，较低时少放电

017 - 搞笑一句话台词.docx

最新资源

蓄电池与超级电容混合储能并网matlab simulink仿真模型（1）混合储能采用低通滤波器进行功率分配，可有效抑制功率波动，并对超级电容的soc进行能量管理，soc较高时多放电，较低时少放电