SpringSecurity 3.0.2开发指南：入门与配置详解

需积分: 10 187 浏览量更新于2024-07-29 收藏 828KB PDF 举报

SpringSecurity开发手册是一本由Ben Alex和Luke Taylor编写的指南，专为Spring Security 3.0.2.RELEASE版本提供深入的参考文档。Spring Security是一款强大的开源安全框架，用于保护Web应用程序免受未经授权的访问、身份验证、授权和会话管理。该手册分为两大部分：入门指南和安全命名空间配置。在入门部分（Chapter 1），作者首先介绍了Spring Security的基本概念： 1.1 Spring Security定义：它是一个用于实现企业级Web应用安全的轻量级框架，支持多种身份验证和授权机制，如基于表单的身份验证、基于角色的访问控制（RBAC）等。 1.2 历史回顾：Spring Security自早期版本以来不断发展，随着Spring框架的发展同步更新，旨在简化安全集成。 1.3 版本编号策略：手册覆盖了3.0.2.RELEASE版本，说明文档是针对这个特定版本提供的。接下来讨论了如何获取和使用Spring Security项目模块： - Core-spring-security-core.jar：提供核心的安全功能，如认证和授权服务。 - Web-spring-security-web.jar：主要关注Web应用程序的整合，包括过滤器和拦截器。 - Config-spring-security-config.jar：用于配置模块，允许开发者自定义安全策略。 - LDAP-spring-security-ldap.jar：支持LDAP（Lightweight Directory Access Protocol）身份验证。 - CAS-spring-security-cas-client.jar：集成了CAS（Central Authentication Service）客户端功能。 - OpenID-spring-security-openid.jar：实现了OpenID支持。手册还介绍了如何检查源代码以便于开发者深入理解框架的工作原理。在安全命名空间配置章节（Chapter 2）： 2.1 引言：讲解如何使用Spring Security的XML配置方式，特别是`<http>`元素，它是Web应用的主要配置入口。 2.2 使用`<http>`元素：作者指导读者如何编写一个最小化的配置，包括基本的登录选项和表单身份验证设置。此外，还提到`auto-config`的用法，它简化了配置过程。 2.3 高级功能：这里涵盖了更复杂的功能，如记住我（Remember Me）功能，以及如何增强HTTP/HTTPS通道安全性。这本Spring Security开发手册为开发人员提供了全面的指导，从基础安装到高级配置，确保他们在构建安全的Web应用时能够得心应手。无论是初次接触Spring Security还是需要深入了解的开发者，都可以从中受益匪浅。

Spring Security

3.0.2.RELEASE Spring Security 5

“Versions are denoted using a standard triplet of integers: MAJOR.MINOR.PATCH. The basic intent is

that MAJOR versions are incompatible, large-scale upgrades of the API. MINOR versions retain source

and binary compatibility with older minor versions, and changes in the PATCH level are perfectly

compatible, forwards and backwards.”

1.4 Getting Spring Security

You can get hold of Spring Security in several ways. You can download a packaged distribution from

the main Spring download page [http://www.springsource.com/download/community?project=Spring

%20Security], download individual jars (and sample WAR files) from the Maven Central repository (or

a SpringSource Maven repository for snapshot and milestone releases) or, alternatively, you can build

the project from source yourself. See the project web site for more details.

Project Modules

In Spring Security 3.0, the codebase has been sub-divided into separate jars which more clearly separate

different functionaltiy areas and third-party dependencies. If you are using Maven to build your project,

then these are the modules you will add to your pom.xml. Even if you're not using Maven, we'd

recommend that you consult the pom.xml files to get an idea of third-party dependencies and versions.

Alternatively, a good idea is to examine the libraries that are included in the sample applications.

Core - spring-security-core.jar

Contains core authentication and access-contol classes and interfaces, remoting support and basic

provisioning APIs. Required by any application which uses Spring Security. Supports standalone

applications, remote clients, method (service layer) security and JDBC user provisioning. Contains the

top-level packages:

• org.springframework.security.core

• org.springframework.security.access

• org.springframework.security.authentication

• org.springframework.security.provisioning

• org.springframework.security.remoting

Web - spring-security-web.jar

Contains filters and related web-security infrastructure code. Anything with a servlet API dependency.

You'll need it if you require Spring Security web authentication services and URL-based access-control.

The main package is org.springframework.security.web.

Config - spring-security-config.jar

Contains the security namespace parsing code (and hence nothing that you are likely yo use directly in

your application). You need it if you are using the Spring Security XML namespace for configuration.

The main package is org.springframework.security.config.

Spring Security

3.0.2.RELEASE Spring Security 7

2. Security Namespace Configuration

2.1 Introduction

Namespace configuration has been available since version 2.0 of the Spring framework. It allows you

to supplement the traditional Spring beans application context syntax with elements from additional

XML schema. You can find more information in the Spring Reference Documentation [http://

static.springsource.org/spring/docs/3.0.x/spring-framework-reference/html/apc.html]. A namespace

element can be used simply to allow a more concise way of configuring an individual bean or, more

powerfully, to define an alternative configuration syntax which more closely matches the problem

domain and hides the underlying complexity from the user. A simple element may conceal the fact that

multiple beans and processing steps are being added to the application context. For example, adding

the following element from the security namespace to an application context will start up an embedded

LDAP server for testing use within the application:

<security:ldap-server />

This is much simpler than wiring up the equivalent Apache Directory Server beans. The most common

alternative configuration requirements are supported by attributes on the ldap-server element and

the user is isolated from worrying about which beans they need to create and what the bean property

names are.

. Use of a good XML editor while editing the application context file should provide

information on the attributes and elements that are available. We would recommend that you try out

the SpringSource Tool Suite [http://www.springsource.com/products/sts] as it has special features for

working with standard Spring namespaces.

To start using the security namespace in your application context, all you need to do is add the schema

declaration to your application context file:

<beans xmlns="http://www.springframework.org/schema/beans"

xmlns:security="http://www.springframework.org/schema/security"

xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"

xsi:schemaLocation="http://www.springframework.org/schema/beans

http://www.springframework.org/schema/beans/spring-beans-3.0.xsd

http://www.springframework.org/schema/security

http://www.springframework.org/schema/security/spring-security-3.0.xsd">

...

</beans>

In many of the examples you will see (and in the sample) applications, we will often use "security"

as the default namespace rather than "beans", which means we can omit the prefix on all the security

namespace elements, making the content easier to read. You may also want to do this if you have your

application context divided up into separate files and have most of your security configuration in one

of them. Your security application context file would then start like this

You can find out more about the use of the ldap-server element in the chapter on LDAP.

Spring Security

3.0.2.RELEASE Spring Security 8

<beans:beans xmlns="http://www.springframework.org/schema/security"

xmlns:beans="http://www.springframework.org/schema/beans"

xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"

xsi:schemaLocation="http://www.springframework.org/schema/beans

http://www.springframework.org/schema/beans/spring-beans-3.0.xsd

http://www.springframework.org/schema/security

http://www.springframework.org/schema/security/spring-security-3.0.xsd">

...

</beans:beans>

We'll assume this syntax is being used from now on in this chapter.

Design of the Namespace

The namespace is designed to capture the most common uses of the framework and provide a simplified

and concise syntax for enabling them within an application. The design is based around the large-scale

dependencies within the framework, and can be divided up into the following areas:

• Web/HTTP Security - the most complex part. Sets up the filters and related service beans used to

apply the framework authentication mechanisms, to secure URLs, render login and error pages and

much more.

• Business Object (Method) Security - options for securing the service layer.

• AuthenticationManager - handles authentication requests from other parts of the framework.

• AccessDecisionManager - provides access decisions for web and method security. A default one will

be registered, but you can also choose to use a custom one, declared using normal Spring bean syntax.

• AuthenticationProviders - mechanisms against which the authentication manager authenticates users.

The namespace provides supports for several standard options and also a means of adding custom

beans declared using a traditional syntax.

• UserDetailsService - closely related to authentication providers, but often also required by other

beans.

We'll see how to configure these in the following sections.

2.2 Getting Started with Security Namespace

Configuration

In this section, we'll look at how you can build up a namespace configuration to use some of the main

features of the framework. Let's assume you initially want to get up and running as quickly as possible

and add authentication support and access control to an existing web application, with a few test logins.

Then we'll look at how to change over to authenticating against a database or other security repository.

In later sections we'll introduce more advanced namespace configuration options.

web.xml Configuration

The first thing you need to do is add the following filter declaration to your web.xml file:

Spring Security

3.0.2.RELEASE Spring Security 9

<filter-name>springSecurityFilterChain</filter-name>

<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>

</filter>

<filter-mapping>

<filter-name>springSecurityFilterChain</filter-name>

<url-pattern>/*</url-pattern>

</filter-mapping>

This provides a hook into the Spring Security web infrastructure. DelegatingFilterProxy is a

Spring Framework class which delegates to a filter implementation which is defined as a Spring bean

in your application context. In this case, the bean is named “springSecurityFilterChain”, which is an

internal infrastructure bean created by the namespace to handle web security. Note that you should not

use this bean name yourself. Once you've added this to your web.xml, you're ready to start editing

your application context file. Web security services are configured using the <http> element.

A Minimal <http> Configuration

All you need to enable web security to begin with is

<intercept-url pattern="/**" access="ROLE_USER" />

</http>

Which says that we want all URLs within our application to be secured, requiring the role ROLE_USER

to access them. The <http> element is the parent for all web-related namespace functionality. The

<intercept-url> element defines a pattern which is matched against the URLs of incoming

requests using an ant path style syntax. The access attribute defines the access requirements for

requests matching the given pattern. With the default configuration, this is typically a comma-separated

list of roles, one of which a user must have to be allowed to make the request. The prefix “ROLE_” is

a marker which indicates that a simple comparison with the user's authorities should be made. In other

words, a normal role-based check should be used. Access-control in Spring Security is not limited to

the use of simple roles (hence the use of the prefix to differentiate between different types of security

attributes). We'll see later how the interpretation can vary

Note

You can use multiple <intercept-url> elements to define different access

requirements for different sets of URLs, but they will be evaluated in the order listed and

the first match will be used. So you must put the most specific matches at the top. You

can also add a method attribute to limit the match to a particular HTTP method (GET,

POST, PUT etc.). If a request matches multiple patterns, the method-specific match will

take precedence regardless of ordering.

To add some users, you can define a set of test data directly in the namespace:

The interpretation of the comma-separated values in the access attribute depends on the implementation of the

AccessDecisionManager which is used. In Spring Security 3.0, the attribute can also be populated with an EL expression.

剩余133页未读，继续阅读

Happy2Prince

粉丝: 0
资源: 7

SpringSecurity 3.0.2开发指南：入门与配置详解

Spring Security 参考手册_Spring Security中文版

spring security3 开发手册

Spring Security权限管理开发手册

family168SpringSecurity管理手册.rar

Spring Security权限管理开发手册.pdf

HAP框架-SpringSecurity入门手册.docx

springsecurity参考手册中文word版最新版本

HAP框架-SpringSecurity入门手册.zip

spring security权限管理开发手册及实例.rar

springsecurity3离线手册

最新资源