最近接触项目，发现项目用到了很多新鲜东西，也不能说是新鲜，只能说自己没有接触过，于是闲的无聊一项一项学习学习，别人问到也说上个七七八八。
今天可算是把spring-security搭建了出来并且运行了起来，主要是自己太菜，其实最后看来也就那么回事。
1.数据库的设计和搭建
用户 、角色、权限、资源以及关联表 用户--角色、角色--权限、权限--资源 总共七张表。
用户表
create table SYS_USERS
(
USER_ID VARCHAR2(32) not null,
USER_ACCOUNT VARCHAR2(30),
USER_NAME VARCHAR2(40),
USER_PASSWORD VARCHAR2(100),
USER_DESC VARCHAR2(100),
ENABLED NUMBER(1),
ISSYS NUMBER(1),
USER_DEPT VARCHAR2(20),
USER_DUTY VARCHAR2(10),
SUB_SYSTEM VARCHAR2(30)
);
alter table SYS_USERS add constraint PK_PUB_USERS primary key (USER_ID);
角色表
create table SYS_ROLES
(
ROLE_ID VARCHAR2(32) not null,
ROLE_NAME VARCHAR2(40),
ROLE_DESC VARCHAR2(100),
ENABLED NUMBER(1),
ISSYS NUMBER(1),
MODULE VARCHAR2(4)
);
alter table SYS_ROLES add constraint PK_PUB_ROLES primary key (ROLE_ID);
权限表
create table SYS_AUTHORITIES
(
AUTHORITY_ID VARCHAR2(32) not null,
AUTHORITY_NAME VARCHAR2(40),
AUTHORITY_DESC VARCHAR2(100),
ENABLED NUMBER(1),
ISSYS NUMBER(1),
MODULE VARCHAR2(4)
);
alter table SYS_AUTHORITIES add constraint PK_PUB_AUTHORITIES primary key (AUTHORITY_ID);资源表
create table SYS_RESOURCES
(
RESOURCE_ID VARCHAR2(32) not null,
RESOURCE_NAME VARCHAR2(100),
RESOURCE_DESC VARCHAR2(100),
RESOURCE_TYPE VARCHAR2(40),
RESOURCE_STRING VARCHAR2(200),
PRIORITY NUMBER(1),
ENABLED NUMBER(1),
ISSYS NUMBER(1),
MODULE VARCHAR2(4)
);
alter table SYS_RESOURCES add constraint PK_PUB_RESOURCES primary key (RESOURCE_ID);
用户角色表
create table SYS_USERS_ROLES
(
ID NUMBER(13) not null,
USER_ID VARCHAR2(32),
ROLE_ID VARCHAR2(32),
ENABLED NUMBER(1)
);
-- Create/Recreate primary, unique and foreign key constraints
alter table SYS_USERS_ROLES add constraint PK_PUB_USERS_ROLES primary key (ID);
alter table SYS_USERS_ROLES add constraint FK_USERS_ROLES_ROLES foreign key (ROLE_ID) references SYS_ROLES (ROLE_ID);
alter table SYS_USERS_ROLES add constraint FK_USERS_ROLES_USERS foreign key (USER_ID) references SYS_USERS (USER_ID);
角色权限表
create table SYS_ROLES_AUTHORITIES
(
ID NUMBER(13) not null,
ROLE_ID VARCHAR2(32),
AUTHORITY_ID VARCHAR2(32),
ENABLED NUMBER(1)
);
-- Create/Recreate primary, unique and foreign key constraints
alter table SYS_ROLES_AUTHORITIES add constraint PK_PUB_ROLES_AUTHORITY primary key (ID);
alter table SYS_ROLES_AUTHORITIES add constraint FK_PUB_ROLES_AUTHORITIES_AU foreign key (AUTHORITY_ID) references SYS_AUTHORITIES (AUTHORITY_ID);
alter table SYS_ROLES_AUTHORITIES add constraint FK_PUB_ROLES_AUTHORITIES_ROLES foreign key (ROLE_ID) references SYS_ROLES (ROLE_ID);
权限资源表
create table SYS_AUTHORITIES_RESOURCES
(
ID NUMBER(13) not null,
AUTHORITY_ID VARCHAR2(32),
RESOURCE_ID VARCHAR2(32),
ENABLED NUMBER(1)
);
-- Create/Recreate primary, unique and foreign key constraints
alter table SYS_AUTHORITIES_RESOURCES add constraint PK_PUB_AUTHORITIES_RE primary key (ID);
alter table SYS_AUTHORITIES_RESOURCES add constraint FK_PUB_AUTHORITIES_RE_AU foreign key (AUTHORITY_ID) references SYS_AUTHORITIES (AUTHORITY_ID);
alter table SYS_AUTHORITIES_RESOURCES add constraint FK_PUB_AUTHORITIES_RE_RE foreign key (RESOURCE_ID) references SYS_RESOURCES (RESOURCE_ID);
加入关联的数据就可以了
2.web数据库整合
2.1jar包的导入 我所用到的几个jar包
antlr-2.7.6.jar
aopalliance.jar
aspectjrt.jar
aspectjweaver.jar
backport-util-concurrent-3.1.jar
c3p0-0.9.1.2.jar
cglib-2.2.jar
cglib-nodep-2.1_3.jar
classes12.jar
common-annotations.jar
commons-collections-3.1.jar
commons-dbcp-1.3.jar
commons-fileupload-1.2.1.jar
commons-io-1.3.2.jar
commons-logging-1.0.4.jar
commons-pool.jar
dom4j-1.6.1.jar
ehcache-1.5.0.jar
freemarker-2.3.15.jar
hibernate-commons-annotations-3.2.0.Final.jar
hibernate-core-3.6.0.Final.jar
hibernate-jpa-2.0-api-1.0.0.Final.jar
hibernate3.jar
javassist-3.9.0.GA.jar
jta-1.1.jar
mysql-connector-java-5.0.0-beta-bin.jar
ognl-2.7.3.jar
slf4j-api-1.6.1.jar
slf4j-nop-1.6.1.jar
spring-aop-3.0.4.RELEASE.jar
spring-asm-3.0.4.RELEASE.jar
spring-beans-3.0.4.RELEASE.jar
spring-context-3.0.4.RELEASE.jar
spring-context-support-3.0.4.RELEASE.jar
spring-core-3.0.4.RELEASE.jar
spring-expression-3.0.4.RELEASE.jar
spring-jdbc-3.0.4.RELEASE.jar
spring-orm-3.0.4.RELEASE.jar
spring-security-acl-3.0.3.RELEASE.jar
spring-security-config-3.0.3.RELEASE.jar
spring-security-core-3.0.3.RELEASE.jar
spring-security-taglibs-3.0.3.RELEASE.jar
spring-security-web-3.0.3.RELEASE.jar
spring-test-3.0.4.RELEASE.jar
spring-tx-3.0.4.RELEASE.jar
spring-web-3.0.4.RELEASE.jar
spring-webmvc-3.0.4.RELEASE.jar
spring-webmvc-struts.jar
struts2-core-2.1.8.1.jar
struts2-spring-plugin-2.1.8.1.jar
xwork-core-2.1.6.jar
2.2创建实体类entity和映射文件xxx.hbm.xml(使用hibernate注解可以省略,下一阶段研究)
SysAuthorities.java
package org.joshua.ss.entity;
import java.io.Serializable;
import java.util.Set;
/**
*
* @author Joshua
*
*/
public class SysAuthorities implements Serializable {
/**
*
*/
private static final long serialVersionUID = 6148281916911401715L;
private String authorityId;
private String authorityName;
private String authorityDesc;
private Boolean enabled;
private Boolean issys;
private String module;
private Set<SysRolesAuthorities> sysRolesAuthoritieses;
private Set<SysAuthoritiesResources> sysAuthoritiesResourceses;
public SysAuthorities() {
}
public SysAuthorities(String authorityId) {
this.authorityId = authorityId;
}
public SysAuthorities(String authorityId, String authorityName,
String authorityDesc, Boolean enabled, Boolean issys, String module,
Set<SysRolesAuthorities> sysRolesAuthoritieses, Set<SysAuthoritiesResources> sysAuthoritiesResourceses) {
this.authorityId = authorityId;
this.authorityName = authorityName;
this.authorityDesc = authorityDesc;
this.enabled = enabled;
this.issys = issys;
this.module = module;
this.sysRolesAuthoritieses = sysRolesAuthoritieses;
this.sysAuthoritiesResourceses = sysAuthoritiesResourceses;
}
public String getAuthorityId() {
return this.authorityId;
}
public void setAuthorityId(String authorityId) {
this.authorityId = authorityId;
}
public String getAuthorityName() {
return this.authorityName;
}
public void setAuthorityName(String authorityName) {
this.authorityName = authorityName;
}
public String getAuthorityDesc() {
return this.authorityDesc;
}
public void setAuthorityDesc(String authorityDesc) {
this.authorityDesc = authorityDesc;
}
public Boolean getEnabled() {
return this.enabled;
}
public void setEnabled(Boolean enabled) {
this.enabled = enabled;
}
public Boolean getIssys() {
return this.issys;
}
public void setIssys(Boolean issys) {
this.issys = issys;
}
public String getModule() {
return this.module;
}
public void setModule(String module) {
this.module = module;
}
public Set<SysRolesAuthorities> getSysRolesAuthoritieses() {
return sysRolesAuthoritieses;
}
public void setSysRolesAuthoritieses(
Set<SysRolesAuthorities> sysRolesAuthoritieses) {
this.sysRolesAuthoritieses = sysRolesAuthoritieses;
}
public Set<SysAuthoritiesResources> getSysAuthoritiesResourceses() {
return sysAuthoritiesResourceses;
}
public void setSysAuthoritiesResourceses(
Set<SysAuthoritiesResources> sysAuthoritiesResourceses) {
this.sysAuthoritiesResourceses = sysAuthoritiesResourceses;
}
}
SysAuthoritiesResources.java
package org.joshua.ss.entity;
import java.io.Serializable;
/**
*
* @author Joshua
*
*/
public class SysAuthoritiesResources implements Serializable {
/**
*
*/
private static final long serialVersionUID = -2373269722400659636L;
private long id;
private SysAuthorities sysAuthorities;
private SysResources sysResources;
private Boolean enabled;
public SysAuthoritiesResources() {
}
public SysAuthoritiesResources(long id) {
this.id = id;
}
public SysAuthoritiesResources(long id, SysAuthorities sysAuthorities,
SysResources sysResources, Boolean enabled) {
this.id = id;
this.sysAuthorities = sysAuthorities;
this.sysResources = sysResources;
this.enabled = enabled;
}
public long getId() {
return this.id;
}
public void setId(long id) {
this.id = id;
}
public SysAuthorities getSysAuthorities() {
return this.sysAuthorities;
}
public void setSysAuthorities(SysAuthorities sysAuthorities) {
this.sysAuthorities = sysAuthorities;
}
public SysResources getSysResources() {
return this.sysResources;
}
public void setSysResources(SysResources sysResources) {
this.sysResources = sysResources;
}
public Boolean getEnabled() {
return this.enabled;
}
public void setEnabled(Boolean enabled) {
this.enabled = enabled;
}
}
SysResources.java
package org.joshua.ss.entity;
import java.io.Serializable;
import java.util.Set;
/**
*
* @author Joshua
*
*/
public class SysResources implements Serializable {
/**
*
*/
private static final long serialVersionUID = 6417157583753174159L;
private String resourceId;
private String resourceName;
private String resourceDesc;
private String resourceType;
private String resourceString;
private Boolean priority;
//是否可用，0为不可用，1为可用。
private Integer enabled;
//是否是超级。0为不超级，1为超级。
private Integer issys;
private String module;
private Set<SysAuthoritiesResources> sysAuthoritiesResourceses ;
public SysResources() {
}
public SysResources(String resourceId) {
this.resourceId = resourceId;
}
public SysResources(String resourceId, String resourceName,
String resourceDesc, String resourceType, String resourceString,
Boolean priority, Integer enabled, Integer issys, String module,
Set<SysAuthoritiesResources> sysAuthoritiesResourceses) {
this.resourceId = resourceId;
this.resourceName = resourceName;
this.resourceDesc = resourceDesc;
this.resourceType = resourceType;
this.resourceString = resourceString;
this.priority = priority;
this.enabled = enabled;
this.issys = issys;
this.module = module;
this.sysAuthoritiesResourceses = sysAuthoritiesResourceses;
}
public String getResourceId() {
return this.resourceId;
}
public void setResourceId(String resourceId) {
this.resourceId = resourceId;
}
public String getResourceName() {
return this.resourceName;
}
public void setResourceName(String resourceName) {
this.resourceName = resourceName;
}
public String getResourceDesc() {
return this.resourceDesc;
}
public void setResourceDesc(String resourceDesc) {
this.resourceDesc = resourceDesc;
}
public String getResourceType() {
return this.resourceType;
}
public void setResourceType(String resourceType) {
this.resourceType = resourceType;
}
public String getResourceString() {
return this.resourceString;
}
public void setResourceString(String resourceString) {
this.resourceString = resourceString;
}
public Boolean getPriority() {
return this.priority;
}
public void setPriority(Boolean priority) {
this.priority = priority;
}
public Integer getEnabled() {
return this.enabled;
}
public void setEnabled(Integer enabled) {
this.enabled = enabled;
}
public Integer getIssys() {
return this.issys;
}
public void setIssys(Integer issys) {
this.issys = issys;
}
public String getModule() {
return this.module;
}
public void setModule(String module) {
this.module = module;
}
public Set<SysAuthoritiesResources> getSysAuthoritiesResourceses() {
return sysAuthoritiesResourceses;
}
public void setSysAuthoritiesResourceses(
Set<SysAuthoritiesResources> sysAuthoritiesResourceses) {
this.sysAuthoritiesResourceses = sysAuthoritiesResourceses;
}
@Override
public int hashCode() {
final int prime = 31;
int result = 1;
result = prime * result + ((enabled == null) ? 0 : enabled.hashCode());
result = prime * result + ((issys == null) ? 0 : issys.hashCode());
result = prime * result + ((module == null) ? 0 : module.hashCode());
result = prime * result
+ ((priority == null) ? 0 : priority.hashCode());
result = prime * result
+ ((resourceDesc == null) ? 0 : resourceDesc.hashCode());
result = prime * result
+ ((resourceId == null) ? 0 : resourceId.hashCode());
result = prime * result
+ ((resourceName == null) ? 0 : resourceName.hashCode());
result = prime * result
+ ((resourceString == null) ? 0 : resourceString.hashCode());
result = prime * result
+ ((resourceType == null) ? 0 : resourceType.hashCode());
result = prime
* result
+ ((sysAuthoritiesResourceses == null) ? 0
: sysAuthoritiesResourceses.hashCode());
return result;
}
@Override
public boolean equals(Object obj) {
if (this == obj)
return true;
if (obj == null)
return false;
if (getClass() != obj.getClass())
return false;
SysResources other = (SysResources) obj;
if (enabled == null) {
if (other.enabled != null)
return false;
} else if (!enabled.equals(other.enabled))
return false;
if (issys == null) {
if (other.issys != null)
return false;
} else if (!issys.equals(other.issys))
return false;
if (module == null) {
if (other.module != null)
return false;
} else if (!module.equals(other.module))
return false;
if (priority == null) {
if (other.priority != null)
return false;
} else if (!priority.equals(other.priority))
return false;
if (resourceDesc == null) {
if (other.resourceDesc != null)
return false;
} else if (!resourceDesc.equals(other.resourceDesc))
return false;
if (resourceId == null) {
if (other.resourceId != null)
return false;
} else if (!resourceId.equals(other.resourceId))
return false;
if (resourceName == null) {
if (other.resourceName != null)
return false;
} else if (!resourceName.equals(other.resourceName))
return false;
if (resourceString == null) {
if (other.resourceString != null)
return false;
} else if (!resourceString.equals(other.resourceString))
return false;
if (resourceType == null) {
if (other.resourceType != null)
return false;
} else if (!resourceType.equals(other.resourceType))
return false;
if (sysAuthoritiesResourceses == null) {
if (other.sysAuthoritiesResourceses != null)
return false;
} else if (!sysAuthoritiesResourceses
.equals(other.sysAuthoritiesResourceses))
return false;
return true;
}
}
SysRoles.java
package org.joshua.ss.entity;
import java.io.Serializable;
import java.util.Set;
import org.joshua.ss.dao.daoimpl.BaseDaoImpl;
public class SysRoles implements Serializable {
/**
*
*/
private static final long serialVersionUID = -243340671938105177L;
private String roleId;
private String roleName;
private String roleDesc;
private Boolean enabled;
private Boolean issys;
//平台中的子系统
private String module;
private Set<SysUsersRoles> sysUsersRoles;
private Set<SysRolesAuthorities> sysRolesAuthorities;
public SysRoles() {
}
public SysRoles(String roleId) {
this.roleId = roleId;
}
public SysRoles(String roleId, String roleName, String roleDesc) {
this.roleId = roleId;
this.roleName = roleName;
this.roleDesc = roleDesc;
}
public SysRoles(String roleId, String roleName, String roleDesc,
Boolean enabled, Boolean issys, String module) {
this.roleId = roleId;
this.roleName = roleName;
this.roleDesc = roleDesc;
this.enabled = enabled;
this.issys = issys;
this.module = module;
}
public SysRoles(String roleId, String roleName, String roleDesc,
Boolean enabled, Boolean issys, String module, Set<SysUsersRoles> sysUsersRoles,
Set<SysRolesAuthorities> sysRolesAuthorities) {
this.roleId = roleId;
this.roleName = roleName;
this.roleDesc = roleDesc;
this.enabled = enabled;
this.issys = issys;
this.module = module;
this.sysUsersRoles = sysUsersRoles;
this.sysRolesAuthorities = sysRolesAuthorities;
}
public String getRoleId() {
return this.roleId;
}
public void setRoleId(String roleId) {
this.roleId = roleId;
}
public String getRoleName() {
return this.roleName;
}
public void setRoleName(String roleName) {
this.roleName = roleName;
}
public String getRoleDesc() {
return this.roleDesc;
}
public void setRoleDesc(String roleDesc) {
this.roleDesc = roleDesc;
}
public Boolean getEnabled() {
return this.enabled;
}
public void setEnabled(Boolean enabled) {
this.enabled = enabled;
}
public Boolean getIssys() {
return this.issys;
}
public void setIssys(Boolean issys) {
this.issys = issys;
}
public String getModule() {
return this.module;
}
public void setModule(String module) {
this.module = module;
}
public Set<SysUsersRoles> getSysUsersRoles() {
return this.sysUsersRoles;
}
public void setSysUsersRoles(Set<SysUsersRoles> sysUsersRoles) {
this.sysUsersRoles = sysUsersRoles;
}
public Set<SysRolesAuthorities> getSysRolesAuthorities() {
return this.sysRolesAuthorities;
}
public void setSysRolesAuthorities(Set<SysRolesAuthorities> sysRolesAuthorities) {
this.sysRolesAuthorities = sysRolesAuthorities;
}
@Override
public int hashCode() {
final int prime = 31;
int result = 1;
result = prime * result + ((enabled == null) ? 0 : enabled.hashCode());
result = prime * result + ((issys == null) ? 0 : issys.hashCode());
result = prime * result + ((module == null) ? 0 : module.hashCode());
result = prime * result
+ ((roleDesc == null) ? 0 : roleDesc.hashCode());
result = prime * result + ((roleId == null) ? 0 : roleId.hashCode());
result = prime * result
+ ((roleName == null) ? 0 : roleName.hashCode());
result = prime
* result
+ ((sysRolesAuthorities == null) ? 0 : sysRolesAuthorities
.hashCode());
result = prime * result
+ ((sysUsersRoles == null) ? 0 : sysUsersRoles.hashCode());
return result;
}
@Override
public boolean equals(Object obj) {
if (this == obj)
return true;
if (obj == null)
return false;
if (getClass() != obj.getClass())
return false;
SysRoles other = (SysRoles) obj;
if (enabled == null) {
if (other.enabled != null)
return false;
} else if (!enabled.equals(other.enabled))
return false;
if (issys == null) {
if (other.issys != null)
return false;
} else if (!issys.equals(other.issys))
return false;
if (module == null) {
if (other.module != null)
return false;
} else if (!module.equals(other.module))
return false;
if (roleDesc == null) {
if (other.roleDesc != null)
return false;
} else if (!roleDesc.equals(other.roleDesc))
return false;
if (roleId == null) {
if (other.roleId != null)
return false;
} else if (!roleId.equals(other.roleId))
return false;
if (roleName == null) {
if (other.roleName != null)
return false;
} else if (!roleName.equals(other.roleName))
return false;
if (sysRolesAuthorities == null) {
if (other.sysRolesAuthorities != null)
return false;
} else if (!sysRolesAuthorities.equals(other.sysRolesAuthorities))
return false;
if (sysUsersRoles == null) {
if (other.sysUsersRoles != null)
return false;
} else if (!sysUsersRoles.equals(other.sysUsersRoles))
return false;
return true;
}
}
SysRolesAuthorities.java
package org.joshua.ss.entity;
import java.io.Serializable;
public class SysRolesAuthorities implements Serializable {
/**
*
*/
private static final long serialVersionUID = -4270137978962070889L;
private long id;
private SysAuthorities sysAuthorities;
private SysRoles sysRoles;
private Boolean enabled;
public SysRolesAuthorities() {
}
public SysRolesAuthorities(long id) {
this.id = id;
}
public SysRolesAuthorities(long id, SysAuthorities sysAuthorities,
SysRoles sysRoles, Boolean enabled) {
this.id = id;
this.sysAuthorities = sysAuthorities;
this.sysRoles = sysRoles;
this.enabled = enabled;
}
public long getId() {
return this.id;
}
public void setId(long id) {
this.id = id;
}
public SysAuthorities getSysAuthorities() {
return this.sysAuthorities;
}
public void setSysAuthorities(SysAuthorities sysAuthorities) {
this.sysAuthorities = sysAuthorities;
}
public SysRoles getSysRoles() {
return this.sysRoles;
}
public void setSysRoles(SysRoles sysRoles) {
this.sysRoles = sysRoles;
}
public Boolean getEnabled() {
return this.enabled;
}
public void setEnabled(Boolean enabled) {
this.enabled = enabled;
}
}
SysUsers.java
package org.joshua.ss.entity;
import java.io.Serializable;
import java.util.Collection;
import java.util.Collections;
import java.util.Comparator;
import java.util.HashSet;
import java.util.Set;
import java.util.SortedSet;
import java.util.TreeSet;
import org.joshua.ss.MyUserDetails;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.util.Assert;
/**
*
* @author Joshua
*
*/
public class SysUsers implements MyUserDetails,Serializable {
/**
*
*/
private static final long serialVersionUID = -8680337263599302062L;
//用户id
private String userId;
//用户账号 与 用户id相同，具有唯一性。
private String userAccount;
//中文用户名。
private String userName;
//密码原文 ＋ 用户名作为盐值 的字串经过Md5加密后形成的密文。
private String userPassword;
//用户备注
private String userDesc;
//是否能用。
private Boolean enabled;
//是否是超级用户。
private Boolean issys;
//用户所在的单位。
private String userDept;
//用户的职位：比如主任、经理等。
private String userDuty;
//该用户所负责的子系统
private String subSystem;
//一个用户具有多个角色。
private Set<SysUsersRoles> sysUsersRoleses =new HashSet(0);
//实现了UserDetails之后的相关变量
private String password;
private String username;
private Set<GrantedAuthority> authorities;
private boolean accountNonExpired;
private boolean accountNonLocked;
private boolean credentialsNonExpired;
public SysUsers(){
}
public SysUsers(String userId, String userAccount, String userName,
String userPassword, String userDesc, Boolean enabled,
Boolean issys, String userDept, String userDuty, String subSystem,
Set<SysUsersRoles> sysUsersRoleses,boolean accountNonExpired, boolean accountNonLocked,
boolean credentialsNonExpired,Collection<GrantedAuthority> authorities) {
if (((userAccount == null) || "".equals(userAccount)) || (userPassword == null)) {
throw new IllegalArgumentException("Cannot pass null or empty values to constructor");
}
this.userId = userId;
this.userAccount = userAccount;
this.userName = userName;
this.userPassword = userPassword;
this.userDesc = userDesc;
this.enabled = enabled;
this.issys = issys;
this.userDept = userDept;
this.userDuty = userDuty;
this.subSystem = subSystem;
this.sysUsersRoleses = sysUsersRoleses;
this.password = userPassword;
this.username = userAccount;
this.authorities = Collections.unmodifiableSet(sortAuthorities(authorities));
this.accountNonExpired = accountNonExpired;
this.accountNonLocked = accountNonLocked;
this.credentialsNonExpired = credentialsNonExpired;
}
//~ Methods ========================================================================================================
public boolean equals(Object rhs) {
if (!(rhs instanceof SysUsers) || (rhs == null)) {
return false;
}
SysUsers user = (SysUsers) rhs;
//具有的权限。
if (!authorities.equals(user.authorities)) {
return false;
}
// 通过Spring Security构建一个用户时，用户名和密码不能为空。
return (this.getPassword().equals(user.getPassword()) && this.getUsername().equals(user.getUsername())
&& (this.isAccountNonExpired() == user.isAccountNonExpired())
&& (this.isAccountNonLocked() == user.isAccountNonLocked())
&& (this.isCredentialsNonExpired() == user.isCredentialsNonExpired())
&& (this.isEnabled() == user.isEnabled()));
}
public String getUserId() {
return this.userId;
}
public void setUserId(String userId) {
this.userId = userId;
}
public String getUserAccount() {
return this.userAccount;
}
public void setUserAccount(String userAccount) {
this.userAccount = userAccount;
}
public String getUserName() {
return this.userName;
}
public void setUserName(String userName) {
this.userName = userName;
}
public String getUserPassword() {
return this.userPassword;
}
public void setUserPassword(String userPassword) {
this.userPassword = userPassword;
}
public String getUserDesc() {
return this.userDesc;
}
public void setUserDesc(String userDesc) {
this.userDesc = userDesc;
}
public boolean getEnabled() {
return this.enabled;
}
public void setEnabled(Boolean enabled) {
this.enabled = enabled;
}
public Boolean getIssys() {
return this.issys;
}
public void setIssys(Boolean issys) {
this.issys = issys;
}
public String getUserDept() {
return this.userDept;
}
public void setUserDept(String userDept) {
this.userDept = userDept;
}
public String getUserDuty() {
return this.userDuty;
}
public void setUserDuty(String userDuty) {
this.userDuty = userDuty;
}
public String getSubSystem() {
return this.subSystem;
}
public void setSubSystem(String subSystem) {
this.subSystem = subSystem;
}
public Set<SysUsersRoles> getSysUsersRoleses() {
return this.sysUsersRoleses;
}
public void setSysUsersRoleses(Set<SysUsersRoles> sysUsersRoleses) {
this.sysUsersRoleses = sysUsersRoleses;
}
public String getPassword() {
return password;
}
public String getUsername() {
return username;
}
public Set<GrantedAuthority> getAuthorities() {
return authorities;
}
public void setAuthorities(Set<GrantedAuthority> authorities) {
this.authorities = authorities;
}
public boolean isAccountNonExpired() {
return accountNonExpired;
}
public boolean isAccountNonLocked() {
return accountNonLocked;
}
public boolean isCredentialsNonExpired() {
return credentialsNonExpired;
}
public boolean isEnabled() {
return enabled;
}
public int hashCode() {
int code = 9792;
//若该用户不是登录人员，则可以允许没有authorities。
if (null != getUsername() && null != getAuthorities()) {
for (GrantedAuthority authority : getAuthorities()) {
code = code * (authority.hashCode() % 7);
}
}
if (this.getPassword() != null) {
code = code * (this.getPassword().hashCode() % 7);
}
if (this.getUsername() != null) {
code = code * (this.getUsername().hashCode() % 7);
}
if (this.isAccountNonExpired()) {
code = code * -2;
}
if (this.isAccountNonLocked()) {
code = code * -3;
}
if (this.isCredentialsNonExpired()) {
code = code * -5;
}
if (this.isEnabled()) {
code = code * -7;
}
return code;
}
private static SortedSet<GrantedAuthority> sortAuthorities(Collection<GrantedAuthority> authorities) {
Assert.notNull(authorities, "Cannot pass a null GrantedAuthority collection");
// Ensure array iteration order is predictable (as per UserDetails.getAuthorities() contract and SEC-717)
SortedSet<GrantedAuthority> sortedAuthorities =
new TreeSet<GrantedAuthority>(new AuthorityComparator());
for (GrantedAuthority grantedAuthority : authorities) {
Assert.notNull(grantedAuthority, "GrantedAuthority list cannot contain any null elements");
sortedAuthorities.add(grantedAuthority);
}
return sortedAuthorities;
}
private static class AuthorityComparator implements Comparator<GrantedAuthority>, Serializable {
public int compare(GrantedAuthority g1, GrantedAuthority g2) {
// Neither should ever be null as each entry is checked before adding it to the set.
// If the authority is null, it is a custom authority and should precede others.
if (g2.getAuthority() == null) {
return -1;
}
if (g1.getAuthority() == null) {
return 1;
}
return g1.getAuthority().compareTo(g2.getAuthority());
}
}
public String toString() {
StringBuilder sb = new StringBuilder();
sb.append(super.toString()).append(": ");
sb.append("Username: ").append(this.username).append("; ");
sb.append("" +
"" +
": [PROTECTED]; ");
sb.append("UserAccount: ").append(this.userAccount).append("; ");
sb.append("UserDept: ").append(this.userDept).append("; ");
sb.append("UserDuty: ").append(this.userDuty).append("; ");
sb.append("UserDesc: ").append(this.userDesc).append("; ");
sb.append("UserSubSystem: ").append(this.subSystem).append("; ");
sb.append("UserIsSys: ").append(this.issys).append("; ");
sb.append("Enabled: ").append(this.enabled).append("; ");
sb.append("AccountNonExpired: ").append(this.accountNonExpired).append("; ");
sb.append("credentialsNonExpired: ").append(this.credentialsNonExpired).append("; ");
sb.append("AccountNonLocked: ").append(this.accountNonLocked).append("; ");
if ( null !=authorities && !authorities.isEmpty()) {
sb.append("Granted Authorities: ");
boolean first = true;
for (GrantedAuthority auth : authorities) {
if (!first) {
sb.append(",");
}
first = false;
sb.append(auth);
}
} else {
sb.append("Not granted any authorities");
}
return sb.toString();
}
}
SysUsersRoles.java
package org.joshua.ss.entity;
import java.io.Serializable;
public class SysUsersRoles implements Serializable {
/**
*
*/
private static final long serialVersionUID = 393623940722220854L;
private long id;
private SysUsers pubUsers;
private SysRoles pubRoles;
private Boolean enabled;
public SysUsersRoles() {
}
public SysUsersRoles(long id) {
this.id = id;
}
public SysUsersRoles(long id, SysUsers pubUsers, SysRoles pubRoles,
Boolean enabled) {
this.id = id;
this.pubUsers = pubUsers;
this.pubRoles = pubRoles;
this.enabled = enabled;
}
public long getId() {
return this.id;
}
public void setId(long id) {
this.id = id;
}
public SysUsers getSysUsers() {
return this.pubUsers;
}
public void setSysUsers(SysUsers pubUsers) {
this.pubUsers = pubUsers;
}
public SysRoles getSysRoles() {
return this.pubRoles;
}
public void setSysRoles(SysRoles pubRoles) {
this.pubRoles = pubRoles;
}
public Boolean getEnabled() {
return this.enabled;
}
public void setEnabled(Boolean enabled) {
this.enabled = enabled;
}
}2.2.2对应的映射文件xxx.hbm.xml
SysAuthorities.hbm.xml
<?xml version="1.0"?>
<!DOCTYPE hibernate-mapping PUBLIC "-//Hibernate/Hibernate Mapping DTD 3.0//EN"
"http://hibernate.sourceforge.net/hibernate-mapping-3.0.dtd">
<!-- Generated 2011-3-23 11:09:37 by Hibernate Tools 3.2.2.GA -->
<hibernate-mapping>
<class name="org.joshua.ss.entity.SysAuthorities" table="SYS_AUTHORITIES">
<id name="authorityId" type="string">
<column name="AUTHORITY_ID" length="32" />
<generator class="assigned" />
</id>
<property name="authorityName" type="string">
<column name="AUTHORITY_NAME" length="40" />
</property>
<property name="authorityDesc" type="string">
<column name="AUTHORITY_DESC" length="100" />
</property>
<property name="enabled" type="java.lang.Boolean">
<column name="ENABLED" precision="1" scale="0" />
</property>
<property name="issys" type="java.lang.Boolean">
<column name="ISSYS" precision="1" scale="0" />
</property>
<property name="module" type="string">
<column name="MODULE" length="4" />
</property>
<set name="sysRolesAuthoritieses" inverse="true" cascade="all" lazy="false">
<key>
<column name="AUTHORITY_ID" length="32" />
</key>
<one-to-many class="org.joshua.ss.entity.SysRolesAuthorities" />
</set>
<set name="sysAuthoritiesResourceses" inverse="true" cascade="all" lazy="false">
<key>
<column name="AUTHORITY_ID" length="32" />
</key>
<one-to-many class="org.joshua.ss.entity.SysAuthoritiesResources" />
</set>
</class>
</hibernate-mapping>
SysAuthoritiesResources.hbm.xml
<?xml version="1.0"?>
<!DOCTYPE hibernate-mapping PUBLIC "-//Hibernate/Hibernate Mapping DTD 3.0//EN"
"http://hibernate.sourceforge.net/hibernate-mapping-3.0.dtd">
<hibernate-mapping>
<class name="org.joshua.ss.entity.SysAuthoritiesResources" table="SYS_AUTHORITIES_RESOURCES">
<id name="id" type="long">
<column name="ID" precision="13" scale="0" />
<generator class="assigned" />
</id>
<many-to-one name="sysAuthorities" class="org.joshua.ss.entity.SysAuthorities" fetch="select" lazy="false">
<column name="AUTHORITY_ID" length="32" />
</many-to-one>
<many-to-one name="sysResources" class="org.joshua.ss.entity.SysResources" fetch="select" lazy="false">
<column name="RESOURCE_ID" length="32" />
</many-to-one>
<property name="enabled" type="java.lang.Boolean">
<column name="ENABLED" precision="1" scale="0" />
</property>
</class>
</hibernate-mapping>
SysResources.hbm.xml
<?xml version="1.0"?>
<!DOCTYPE hibernate-mapping PUBLIC "-//Hibernate/Hibernate Mapping DTD 3.0//EN"
"http://hibernate.sourceforge.net/hibernate-mapping-3.0.dtd">
<hibernate-mapping>
<class name="org.joshua.ss.entity.SysResources" table="Sys_RESOURCES">
<id name="resourceId" type="string">
<column name="RESOURCE_ID" length="32" />
<generator class="assigned" />
</id>
<property name="resourceName" type="string">
<column name="RESOURCE_NAME" length="100" />
</property>
<property name="resourceDesc" type="string">
<column name="RESOURCE_DESC" length="100" />
</property>
<property name="resourceType" type="string">
<column name="RESOURCE_TYPE" length="40" />
</property>
<property name="resourceString" type="string">
<column name="RESOURCE_STRING" length="200" />
</property>
<property name="priority" type="java.lang.Boolean">
<column name="PRIORITY" precision="1" scale="0" />
</property>
<property name="enabled" type="java.lang.Integer">
<column name="ENABLED" precision="1" scale="0" />
</property>
<property name="issys" type="java.lang.Integer">
<column name="ISSYS" precision="1" scale="0" />
</property>
<property name="module" type="string">
<column name="MODULE" length="4" />
</property>
<set name="sysAuthoritiesResourceses" inverse="true" lazy="false">
<key>
<column name="RESOURCE_ID" length="32" />
</key>
<one-to-many class="org.joshua.ss.entity.SysAuthoritiesResources" />
</set>
</class>
</hibernate-mapping>
SysRoles.hbm.xml
<?xml version="1.0"?>
<!DOCTYPE hibernate-mapping PUBLIC "-//Hibernate/Hibernate Mapping DTD 3.0//EN"
"http://hibernate.sourceforge.net/hibernate-mapping-3.0.dtd">
<hibernate-mapping>
<class name="org.joshua.ss.entity.SysRoles" table="SYS_ROLES">
<id name="roleId" type="string">
<column name="ROLE_ID" length="32" />
<generator class="assigned" />
</id>
<property name="roleName" type="string">
<column name="ROLE_NAME" length="40" />
</property>
<property name="roleDesc" type="string">
<column name="ROLE_DESC" length="100" />
</property>
<property name="enabled" type="java.lang.Boolean">
<column name="ENABLED" precision="1" scale="0" />
</property>
<property name="issys" type="java.lang.Boolean">
<column name="ISSYS" precision="1" scale="0" />
</property>
<property name="module" type="string">
<column name="MODULE" length="4" />
</property>
<set name="sysUsersRoles" inverse="true" cascade="all" lazy="false">
<key>
<column name="ROLE_ID" length="32" />
</key>
<one-to-many class="org.joshua.ss.entity.SysUsersRoles"/>
</set>
<set name="sysRolesAuthorities" inverse="true" cascade="all" lazy="false">
<key>
<column name="ROLE_ID" length="32" />
</key>
<one-to-many class="org.joshua.ss.entity.SysRolesAuthorities" />
</set>
</class>
</hibernate-mapping>
SysRolesAuthorities.hbm.xml
<?xml version="1.0"?>
<!DOCTYPE hibernate-mapping PUBLIC "-//Hibernate/Hibernate Mapping DTD 3.0//EN"
"http://hibernate.sourceforge.net/hibernate-mapping-3.0.dtd">
<!-- Generated 2011-3-23 11:09:37 by Hibernate Tools 3.2.2.GA -->
<hibernate-mapping>
<class name="org.joshua.ss.entity.SysRolesAuthorities" table="SYS_ROLES_AUTHORITIES">
<id name="id" type="long">
<column name="ID" precision="13" scale="0" />
<generator class="assigned" />
</id>
<many-to-one name="sysAuthorities" class="org.joshua.ss.entity.SysAuthorities" fetch="select" lazy="false">
<column name="AUTHORITY_ID" length="32" />
</many-to-one>
<many-to-one name="sysRoles" class="org.joshua.ss.entity.SysRoles" fetch="select" lazy="false">
<column name="ROLE_ID" length="32" />
</many-to-one>
<!--
<property name="authorityId" type="string">
<column name="AUTHORITY_ID" length="32" />
</property>
<property name="roleId" type="string">
<column name="ROLE_ID" length="32" />
</property> -->
<property name="enabled" type="java.lang.Boolean">
<column name="ENABLED" precision="1" scale="0" />
</property>
</class>
</hibernate-mapping>
SysUsers.hbm.xml
<?xml version="1.0"?>
<!DOCTYPE hibernate-mapping PUBLIC "-//Hibernate/Hibernate Mapping DTD 3.0//EN"
"http://hibernate.sourceforge.net/hibernate-mapping-3.0.dtd">
<hibernate-mapping>
<class name="org.joshua.ss.entity.SysUsers" table="SYS_USERS">
<id name="userId" type="string">
<column name="USER_ID" length="32" />
<generator class="assigned" />
</id>
<property name="userAccount" type="string">
<column name="USER_ACCOUNT" length="30" />
</property>
<property name="userName" type="string">
<column name="USER_NAME" length="40" />
</property>
<property name="userPassword" type="string">
<column name="USER_PASSWORD" length="100" />
</property>
<property name="userDesc" type="string">
<column name="USER_DESC" length="100" />
</property>
<property name="userDuty" type="string">
<column name="USER_DUTY" length="10" />
</property>
<property name="userDept" type="string">
<column name="USER_DEPT" length="20" />
</property>
<property name="subSystem" type="string">
<column name="SUB_SYSTEM" length="30" />
</property>
<property name="enabled" type="java.lang.Boolean">
<column name="ENABLED" precision="1" scale="0" />
</property>
<property name="issys" type="java.lang.Boolean">
<column name="ISSYS" precision="1" scale="0" />
</property>
<set name="sysUsersRoleses" inverse="true" cascade="all" lazy="false">
<key>
<column name="USER_ID" length="32" />
</key>
<one-to-many class="org.joshua.ss.entity.SysUsersRoles" />
</set>
</class>
</hibernate-mapping>
SysUsersRoles.hbm.xml
<?xml version="1.0"?>
<!DOCTYPE hibernate-mapping PUBLIC "-//Hibernate/Hibernate Mapping DTD 3.0//EN"
"http://hibernate.sourceforge.net/hibernate-mapping-3.0.dtd">
<hibernate-mapping>
<class name="org.joshua.ss.entity.SysUsersRoles" table="SYS_USERS_ROLES">
<id name="id" type="long">
<column name="ID" precision="13" scale="0" />
<generator class="assigned" />
</id>
<many-to-one name="sysUsers" class="org.joshua.ss.entity.SysUsers" fetch="select" lazy="false">
<column name="USER_ID" length="32" />
</many-to-one>
<many-to-one name="sysRoles" class="org.joshua.ss.entity.SysRoles" fetch="select" lazy="false">
<column name="ROLE_ID" length="32" />
</many-to-one>
<property name="enabled" type="java.lang.Boolean">
<column name="ENABLED" precision="1" scale="0" />
</property>
</class>
</hibernate-mapping>
2.3DAO层和service层的创建
最近看到通用dao,模仿着写了一个在这里
BaseDao.java
package org.joshua.ss.dao;
import java.io.Serializable;
import java.util.List;
/**
*
* @author Joshua
*
* @param <T>
* DAO操作的对象类型
* @param <PK>
* 主键类型
*/
public interface BaseDao<T,PK extends Serializable> {
/**
* 按id获取对象.
*
*/
T getById(PK id);
/**
* 保存新增或修改的对象.
*
*/
T save(T object);
/**
* 按id删除对象.
*/
void remove(PK id);
/**
* 删除对象.
*/
void remove(final T object);
/**
* 查询全部对象
*/
List<T> getAll();
}
SysAuthoritiesDao.java接口下同
package org.joshua.ss.dao;
/**
*@author Joshua
*@version 2011-12-15 上午11:06:22
*/
public interface SysAuthoritiesDao{
}
SysAuthoritiesResourcesDao.java
SysResourcesDao.java
SysRolesAuthoritiesDao.java
SysRolesDao.java
SysUsersDao.java
SysUsersRolesDao.java
dao层接口的实现类
BaseDaoImpl.java
package org.joshua.ss.dao.daoimpl;
import java.io.Serializable;
import java.lang.reflect.ParameterizedType;
import java.lang.reflect.Type;
import java.util.List;
import javax.annotation.Resource;
import org.joshua.ss.dao.BaseDao;
import org.springframework.orm.hibernate3.HibernateTemplate;
import org.springframework.util.Assert;
/**
*@author Joshua
*@version 2011-12-15 下午02:27:43
*/
/**
* 可以在service层直接调用,也可以在DAO层扩展调用
*/
public class BaseDaoImpl<T, PK extends Serializable> implements BaseDao<T, PK>{
@Resource(name="hibernateTemplate")
private HibernateTemplate hibernateTemplate;
private Class<T> persistentClass;
/**
* 用于Dao层子类使用的构造函数. 通过子类的泛型定义取得对象类型
*/
@SuppressWarnings("unchecked")
public BaseDaoImpl(){
//getClass() 返回表示此 Class 所表示的实体（类、接口、基本类型或 void）的超类的 Class。
this.persistentClass=(Class<T>)getSuperClassGenricType(getClass(), 0);
}
public List<T> getAll() {
return hibernateTemplate.loadAll(this.persistentClass);
}
public T getById(PK id) {
Assert.notNull(id, "id 不可空");
T entity =hibernateTemplate.get(this.persistentClass, id);
return entity;
}
public void remove(PK id) {
Assert.notNull(id, "id 不可空!");
hibernateTemplate.delete(this.getById(id));
}
public void remove(final T entity) {
Assert.notNull(entity, "entity 不可空!");
hibernateTemplate.delete(entity);
}
public T save(T entity) {
Assert.notNull(entity, "entity 不可空!");
return hibernateTemplate.merge(entity);
}
/**
* 通过反射, 获得定义Class时声明的父类的泛型参数的类型. 如无法找到, 返回Object.class.
*
*@param clazz
* clazz The class to introspect
* @param index
* the Index of the generic ddeclaration,start from 0.
* @return the index generic declaration, or Object.class if cannot be
* determined
*/
@SuppressWarnings("unchecked")
public static Class<Object> getSuperClassGenricType(final Class clazz, final int index) {
//返回表示此 Class 所表示的实体（类、接口、基本类型或 void）的直接超类的 Type。
Type genType = clazz.getGenericSuperclass();
if (!(genType instanceof ParameterizedType)) {
return Object.class;
}
//返回表示此类型实际类型参数的 Type 对象的数组。
Type[] params = ((ParameterizedType) genType).getActualTypeArguments();
if (index >= params.length || index < 0) {
return Object.class;
}
if (!(params[index] instanceof Class)) {
return Object.class;
}
return (Class) params[index];
}
}
SysAuthoritiesDaoImpl.java
package org.joshua.ss.dao.daoimpl;
import org.joshua.ss.dao.SysAuthoritiesDao;
import org.joshua.ss.entity.SysAuthorities;
/**
*@author Joshua
*@version 2011-12-15 上午11:06:22
*/
public class SysAuthoritiesDaoImpl extends BaseDaoImpl<SysAuthorities, Long> implements SysAuthoritiesDao {
}
下同，继承通用dao传递实体类型，也可自定义方法
SysAuthoritiesResourcesDaoImpl.java
SysResourcesDaoImpl.java
SysRolesAuthoritiesDaoImpl.java
SysRolesDaoImpl.java
SysUsersDaoImpl.java
package org.joshua.ss.dao.daoimpl;
import java.util.List;
import javax.annotation.Resource;
import org.joshua.ss.dao.SysUsersDao;
import org.joshua.ss.entity.SysUsers;
import org.springframework.orm.hibernate3.HibernateTemplate;
import org.springframework.stereotype.Service;
/**
*@author Joshua
*@version 2011-12-15 上午11:08:02
*/
@Service("sysUsersDaoImpl")
public class SysUsersDaoImpl extends BaseDaoImpl<SysUsersDao, Long> implements
SysUsersDao {
@Resource(name="hibernateTemplate")
private HibernateTemplate hibernateTemplate;
public SysUsers findByUserAccount(String userName) {
try {
SysUsers instance;
List<SysUsers> instances = hibernateTemplate.find(
"from SysUsers where userAccount='" + userName+"'");
if ( null ==instances||instances.isEmpty()) {
System.out.println("没有相匹配的SysUsers实例对象！");
instance = new SysUsers();
} else {
instance=instances.get(0);
System.out.println("相匹配的SysUsers实例对象被找到！");
}
return instance;
} catch (RuntimeException re) {
System.out.println("findByUserAccount() 错误！");
throw re;
}
}
}
SysUsersRolesDaoImpl.java
service层的实现
AuthoritiesResourcesManager.java
package org.joshua.ss.service;
import org.joshua.ss.dao.daoimpl.BaseDaoImpl;
import org.joshua.ss.entity.SysAuthoritiesResources;
import org.springframework.stereotype.Service;
/**
*@author Joshua
*@version 2011-12-20 下午02:19:19
*/
@Service("authoritiesResourcesManager")
public class AuthoritiesResourcesManager extends BaseDaoImpl<SysAuthoritiesResources,Long>{
}
下同,
这里说明一下我没有去操作对应的dao层而直接去操作通用dao,如果对应到里没有自定义的方法，或者没有用到dao自定义的方法，可以直接继承通dao，这样也可省去dao层
这也是springside封装通用dao将dao彻底省略掉，将增删改查分页等功能都封装到通用dao中.
AuthorityManager.java
ResourceManager.java
RoleManager.java
RolesAuthoritiesManager.java
UserManager.java
这里用到dao自定义的方法,所以注入dao
package org.joshua.ss.service;
import java.util.ArrayList;
import java.util.List;
import java.util.Set;
import javax.annotation.Resource;
import org.joshua.ss.dao.daoimpl.BaseDaoImpl;
import org.joshua.ss.dao.daoimpl.SysUsersDaoImpl;
import org.joshua.ss.entity.SysRolesAuthorities;
import org.joshua.ss.entity.SysUsers;
import org.joshua.ss.entity.SysUsersRoles;
import org.springframework.orm.hibernate3.HibernateTemplate;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.authority.GrantedAuthorityImpl;
import org.springframework.stereotype.Service;
/**
*@author Joshua
*@version 2011-12-15 下午03:58:38
* @param <SysUsers>
*/
@Service("userManager")
public class UserManager extends BaseDaoImpl<SysUsers,Long>{
@Resource(name="hibernateTemplate")
public HibernateTemplate hibernateTemplate;
@Resource(name="sysUsersDaoImpl")
public SysUsersDaoImpl userDao;
public SysUsersDaoImpl getUserDao() {
return userDao;
}
public void setUserDao(SysUsersDaoImpl userDao) {
this.userDao = userDao;
}
public SysUsers queryUnique(String id){
return hibernateTemplate.get(SysUsers.class, id);
}
public List<GrantedAuthority> loadUserAuthoritiesByName(String username) {
try {
List<GrantedAuthority> auths = new ArrayList<GrantedAuthority>();
List<String> authorityNameList = loadUserAuthorities(username);
for (String authorityName : authorityNameList) {
//??
System.out.println(getClass().getName()+authorityName);
GrantedAuthorityImpl authority = new GrantedAuthorityImpl(authorityName);
auths.add(authority);
}
return auths;
} catch (RuntimeException re) {
throw re;
}
}
public List<String> loadUserAuthorities(final String username) {
try {
List<String> authNameList = new ArrayList<String>();
//根据用户名获得user
SysUsers user = userDao.findByUserAccount(username);
//根据user获得roles
Set<SysUsersRoles> usersRoles = user.getSysUsersRoleses();
for(SysUsersRoles usersrole:usersRoles){
//更据roles获得authenority 获得auth_name
Set<SysRolesAuthorities> rolesAuthorities = usersrole.getSysRoles().getSysRolesAuthorities();
for(SysRolesAuthorities roleAuthoritiy:rolesAuthorities){
String authName = roleAuthoritiy.getSysAuthorities().getAuthorityName();
authNameList.add(authName);
}
}
return authNameList;
} catch (RuntimeException re) {
System.out.println("find by authorities by username failed."
+ re.getMessage());
throw re;
}
}
}
2.4配置容器的xxx.xml文件
web.xml
<?xml version="1.0" encoding="UTF-8"?>
<web-app version="2.5"
xmlns="http://java.sun.com/xml/ns/javaee"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://java.sun.com/xml/ns/javaee
http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd">
<!-- 配置ioc容器路径 -->
<context-param>
<param-name>contextConfigLocation</param-name>
<param-value>classpath:applicationContext*.xml</param-value>
</context-param>
<!-- 通过监听器加载ioc容器 -->
<listener>
<listener-class>
org.springframework.web.context.ContextLoaderListener
</listener-class>
</listener>
<!-- 通过过滤器加载struts2框架 -->
<filter>
<filter-name>struts2</filter-name>
<filter-class>
org.apache.struts2.dispatcher.ng.filter.StrutsPrepareAndExecuteFilter
</filter-class>
</filter>
<!-- Spring Secutiry-->
<filter>
<filter-name>springSecurityFilterChain</filter-name>
<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>
<filter-mapping>
<filter-name>springSecurityFilterChain</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
<!-- 解决Hibernate的延迟加载造成的Session提前关闭问题，设置该项使Session保持Request请求
完成才关闭Session。 -->
<filter>
<filter-name>opensession</filter-name>
<filter-class>org.springframework.orm.hibernate3.support.OpenSessionInViewFilter</filter-class>
<init-param>
<param-name>singleSession</param-name>
<param-value>true</param-value>
</init-param>
</filter>
<filter-mapping>
<filter-name>opensession</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
<!--
使用Spring中的过滤器解决在请求和应答中的中文乱码问题(不是为了初始化每个jsp页面)
-->
<filter>
<filter-name>characterEncodingFilter</filter-name>
<filter-class>org.springframework.web.filter.CharacterEncodingFilter</filter-class>
<init-param>
<param-name>encoding</param-name>
<param-value>gbk</param-value>
</init-param>
<init-param>
<!--强制转换编码(request和response均适用) -->
<param-name>ForceEncoding</param-name>
<param-value>true</param-value>
</init-param>
</filter>
<filter-mapping>
<filter-name>characterEncodingFilter</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
<filter-mapping>
<filter-name>struts2</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
<!-- 避免乱码问题 -->
<filter>
<filter-name>struts-cleanup</filter-name>
<filter-class>
org.apache.struts2.dispatcher.ActionContextCleanUp
</filter-class>
</filter>
<filter-mapping>
<filter-name>struts-cleanup</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
<welcome-file-list>
<welcome-file>index.jsp</welcome-file>
</welcome-file-list>
</web-app>
applicationContext.xml
<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:context="http://www.springframework.org/schema/context"
xmlns:aop="http://www.springframework.org/schema/aop"
xsi:schemaLocation="http://www.springframework.org/schema/beans
http://www.springframework.org/schema/beans/spring-beans-2.5.xsd
http://www.springframework.org/schema/context
http://www.springframework.org/schema/context/spring-context-2.5.xsd
http://www.springframework.org/schema/aop http://www.springframework.org/schema/aop/spring-aop-2.5.xsd">
<!-- 通过注解完成对bean的管理 -->
<context:component-scan base-package="org.joshua.ss" />
</beans>
applicationContext_db.xml
<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:context="http://www.springframework.org/schema/context"
xmlns:tx="http://www.springframework.org/schema/tx"
xmlns:aop="http://www.springframework.org/schema/aop"
xsi:schemaLocation="http://www.springframework.org/schema/beans
http://www.springframework.org/schema/beans/spring-beans-2.5.xsd
http://www.springframework.org/schema/context
http://www.springframework.org/schema/context/spring-context-2.5.xsd
http://www.springframework.org/schema/aop http://www.springframework.org/schema/aop/spring-aop-2.5.xsd
http://www.springframework.org/schema/tx http://www.springframework.org/schema/tx/spring-tx-2.5.xsd">
<!-- 加载属性文件 -->
<bean
class="org.springframework.beans.factory.config.PropertyPlaceholderConfigurer">
<property name="locations">
<value>classpath:dbConfig.properties</value>
</property>
</bean>
<!-- 配置数据源 -->
<bean id="dataSource"
class="org.apache.commons.dbcp.BasicDataSource"
destroy-method="close">
<property name="driverClassName" value="${jdbc.driver}" />
<property name="url" value="${jdbc.url}" />
<property name="username" value="${jdbc.user}" />
<property name="password" value="${jdbc.pwd}" />
</bean>
<!-- 创建session 工厂 -->
<bean id="sessionFactory"
class="org.springframework.orm.hibernate3.LocalSessionFactoryBean">
<property name="dataSource" ref="dataSource" />
<!-- 加载映射文件 -->
<property name="mappingResources">
<list>
<value>org/joshua/ss/res/SysAuthorities.hbm.xml</value>
<value>org/joshua/ss/res/SysAuthoritiesResources.hbm.xml</value>
<value>org/joshua/ss/res/SysResources.hbm.xml</value>
<value>org/joshua/ss/res/SysRoles.hbm.xml</value>
<value>org/joshua/ss/res/SysRolesAuthorities.hbm.xml</value>
<value>org/joshua/ss/res/SysUsers.hbm.xml</value>
<value>org/joshua/ss/res/SysUsersRoles.hbm.xml</value>
</list>
</property>
<!--
通过扫描包路径加载
--><!--<property name="annotatedPackages">
<list>
<value>org.joshua.ss.webapp.entity</value>
</list>
</property>
--><!-- 配置session factory 的属性 -->
<property name="hibernateProperties">
<value>
hibernate.dialect=org.hibernate.dialect.OracleDialect
hibernate.show_sql=true
<!-- 启用二级缓存 -->
hibernate.cache.use_second_level_cache=true
hibernate.cache.provider_class=org.hibernate.cache.EhCacheProvider
</value>
</property>
</bean>
<!-- 配置事务管理器 -->
<bean id="txManager"
class="org.springframework.orm.hibernate3.HibernateTransactionManager">
<property name="sessionFactory" ref="sessionFactory" />
</bean>
<!-- 启用注解管理事务 -->
<tx:annotation-driven transaction-manager="txManager" />
<!-- 获取HibernateTemplate 对象 -->
<bean id="hibernateTemplate"
class="org.springframework.orm.hibernate3.HibernateTemplate">
<property name="sessionFactory" ref="sessionFactory"></property>
</bean>
</beans>
applicationContext_security.xml
<?xml version="1.0" encoding="UTF-8"?>
<b:beans xmlns="http://www.springframework.org/schema/security"
xmlns:b="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://www.springframework.org/schema/beans
http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
http://www.springframework.org/schema/security
http://www.springframework.org/schema/security/spring-security-3.0.xsd">
<http auto-config="true" access-denied-page="/accessDenied.jsp">
<!-- 不要过滤图片等静态资源 filters="none"-->
<intercept-url pattern="/**/*.jpg" filters="none" />
<intercept-url pattern="/**/*.png" filters="none" />
<intercept-url pattern="/**/*.gif" filters="none" />
<intercept-url pattern="/**/*.css" filters="none" />
<intercept-url pattern="/**/*.js" filters="none" />
<!-- 登陆页和忘记密码或注册等不需要过滤的页面 -->
<intercept-url pattern="/login.jsp" filters="none" />
<intercept-url pattern="/jsp/forgotpassword.jsp"
filters="none" />
<form-login login-page="/login.jsp"
authentication-failure-url="/login.jsp?error=true"
default-target-url="/index.jsp" />
<logout logout-success-url="/login.jsp" />
<!-- "记住我"功能，采用持久化策略（将用户的登录信息存放在数据库表中）需要创建一张persistent_logins 表
<remember-me data-source-ref="dataSource" />
--><!-- 检测失效的sessionId,超时时定位到另外一个URL -->
<session-management invalid-session-url="/sessionTimeout.jsp" />
<!--
增加一个自定义的filter，放在FILTER_SECURITY_INTERCEPTOR之前，实现用户、角色、权限、资源的数据库管理。
-->
<custom-filter ref="myFilter" before="FILTER_SECURITY_INTERCEPTOR" />
</http>
<!--
一个自定义的filter
必须包含authenticationManager,accessDecisionManager,securityMetadataSource三个属性。
-->
<b:bean id="myFilter" class="org.joshua.ss.MyFilterSecurityInterceptor">
<b:property name="authenticationManager" ref="authenticationManager" />
<b:property name="accessDecisionManager" ref="myAccessDecisionManager" />
<b:property name="securityMetadataSource" ref="mySecurityMetadataSource" />
</b:bean>
<!-- 注意能够为authentication-manager 设置alias别名 -->
<authentication-manager alias="authenticationManager">
<authentication-provider user-service-ref="myUserDetailService"><!--
<password-encoder hash="md5" />
--></authentication-provider>
</authentication-manager>
<b:bean id="myUserDetailService" class="org.joshua.ss.MyUserDetailService" />
<!-- 访问决策器，决定某个用户具有的角色，是否有足够的权限去访问某个资源。11/3/23 -->
<b:bean id="myAccessDecisionManager"
class="org.joshua.ss.MyAccessDecisionManager">
</b:bean>
<!-- 资源源数据定义，将所有的资源和权限对应关系建立起来，即定义某一资源可以被哪些角色去访问。11/3/23 -->
<b:bean id="mySecurityMetadataSource"
class="org.joshua.ss.MyInvocationSecurityMetadataSource">
</b:bean>
</b:beans>
dbConfig.properties
jdbc.user=scott
jdbc.pwd=snail
jdbc.url=jdbc\:oracle\:thin\:@localhost\:1521\:oracle
jdbc.driver=oracle.jdbc.driver.OracleDriver
ehcache.xml 没有深入的研究，暂且搁置
<?xml version="1.0" encoding="UTF-8" ?>
<ehcache>
<diskStore path="user.dir"></diskStore>
<defaultCache
maxElementsInMemory="10000"
eternal="false"
timeToIdleSeconds="120"
timeToLiveSeconds="120"
overflowToDisk="true" />
</ehcache>
struts.xml
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE struts PUBLIC
"-//Apache Software Foundation//DTD Struts Configuration 2.0//EN"
"http://struts.apache.org/dtds/struts-2.0.dtd">
<struts>
<!-- 常量 -->
<constant name="struts.il8n.encoding" value="UTF-8"/>
<constant name="struts.enable.DynamicMethodInvocation" value="false"/>
<constant name="struts.action.extension" value="do"/>
<!-- 表示struts2中action 来自于spring的ioc容器 -->
<constant name="struts.objectFactory" value="spring"/>
<package name="user" namespace="" extends="struts-default">
<action name="*" class="loginAction" method="{1}">
<result name="success">/success.jsp</result>
<result name="error">/error.jsp</result>
</action>
</package>
</struts>
spring security 中最重要的核心
MyAccessDecisionManager.java
MyFilterSecurityInterceptor.java
MyInvocationSecurityMetadataSource.java
MyUserDetails.java(自定义的SysUsers实现的接口，可以省掉，使用框架提供的User，
org.springframework.security.core.userdetails.User
)
MyUserDetailService.java
MyAccessDecisionManager.java
package org.joshua.ss;
import java.util.Collection;
import java.util.Iterator;
import org.springframework.security.access.AccessDecisionManager;
import org.springframework.security.access.AccessDeniedException;
import org.springframework.security.access.ConfigAttribute;
import org.springframework.security.access.SecurityConfig;
import org.springframework.security.authentication.InsufficientAuthenticationException;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.GrantedAuthority;
/**
*AccessdecisionManager在Spring security中是很重要的。
*
*在验证部分简略提过了，所有的Authentication实现需要保存在一个GrantedAuthority对象数组中。
*这就是赋予给主体的权限。 GrantedAuthority对象通过AuthenticationManager
*保存到 Authentication对象里，然后从AccessDecisionManager读出来，进行授权判断。
*
*Spring Security提供了一些拦截器，来控制对安全对象的访问权限，例如方法调用或web请求。
*一个是否允许执行调用的预调用决定，是由AccessDecisionManager实现的。
*这个 AccessDecisionManager 被AbstractSecurityInterceptor调用，
*它用来作最终访问控制的决定。 这个AccessDecisionManager接口包含三个方法：
*
void decide(Authentication authentication, Object secureObject,
List<ConfigAttributeDefinition> config) throws AccessDeniedException;
boolean supports(ConfigAttribute attribute);
boolean supports(Class clazz);
从第一个方法可以看出来，AccessDecisionManager使用方法参数传递所有信息，这好像在认证评估时进行决定。
特别是，在真实的安全方法期望调用的时候，传递安全Object启用那些参数。
比如，让我们假设安全对象是一个MethodInvocation。
很容易为任何Customer参数查询MethodInvocation，
然后在AccessDecisionManager里实现一些有序的安全逻辑，来确认主体是否允许在那个客户上操作。
如果访问被拒绝，实现将抛出一个AccessDeniedException异常。
这个 supports(ConfigAttribute) 方法在启动的时候被
AbstractSecurityInterceptor调用，来决定AccessDecisionManager
是否可以执行传递ConfigAttribute。
supports(Class)方法被安全拦截器实现调用，
包含安全拦截器将显示的AccessDecisionManager支持安全对象的类型。
* @author Joshua
*
*/
public class MyAccessDecisionManager implements AccessDecisionManager {
// In this method, need to compare authentication with configAttributes.
// 1, A object is a URL, a filter was find permission configuration by this
// URL, and pass to here.
// 2, Check authentication has attribute in permission configuration
// (configAttributes)
// 3, If not match corresponding authentication, throw a
// AccessDeniedException.
public void decide(Authentication authentication, Object object,
Collection<ConfigAttribute> configAttributes)
throws AccessDeniedException, InsufficientAuthenticationException {
if (configAttributes == null) {
return;
}
// object is a URL.
Iterator<ConfigAttribute> ite = configAttributes.iterator();
while (ite.hasNext()) {
ConfigAttribute ca = ite.next();
String needRole = ((SecurityConfig) ca).getAttribute();
//ga 为用户所被赋予的权限。 needRole 为访问相应的资源应该具有的权限。
for (GrantedAuthority ga : authentication.getAuthorities()) {
if (needRole.trim().equals(ga.getAuthority().trim())) {
return;
}
}
}
//
throw new AccessDeniedException("no right!");
}
public boolean supports(ConfigAttribute arg0) {
return true;
}
public boolean supports(Class<?> clazz) {
return true;
}
}
MyFilterSecurityInterceptor.java
package org.joshua.ss;
import java.io.IOException;
import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import org.springframework.security.access.SecurityMetadataSource;
import org.springframework.security.access.intercept.AbstractSecurityInterceptor;
import org.springframework.security.access.intercept.InterceptorStatusToken;
import org.springframework.security.web.FilterInvocation;
import org.springframework.security.web.access.intercept.FilterInvocationSecurityMetadataSource;
/**
* 该过滤器的主要作用就是通过spring的IoC生成securityMetadataSource。
* securityMetadataSource相当于本包中自定义的MyInvocationSecurityMetadataSource。
* 该MyInvocationSecurityMetadataSource的作用提从数据库提取权限和资源，装配到HashMap中， 供Spring
* Security使用，用于权限校验。
*
* @author Joshua
*
*/
public class MyFilterSecurityInterceptor extends AbstractSecurityInterceptor
implements Filter {
private FilterInvocationSecurityMetadataSource securityMetadataSource;
@Override
public Class<? extends Object> getSecureObjectClass() {
return FilterInvocation.class;
}
public FilterInvocationSecurityMetadataSource getSecurityMetadataSource() {
return securityMetadataSource;
}
public void setSecurityMetadataSource(
FilterInvocationSecurityMetadataSource securityMetadataSource) {
this.securityMetadataSource = securityMetadataSource;
}
@Override
public SecurityMetadataSource obtainSecurityMetadataSource() {
return this.securityMetadataSource;
}
public void invoke(FilterInvocation fi) throws IOException,
ServletException {
InterceptorStatusToken token = super.beforeInvocation(fi);
try {
fi.getChain().doFilter(fi.getRequest(), fi.getResponse());
} finally {
super.afterInvocation(token, null);
}
}
public void destroy() {
}
public void doFilter(ServletRequest request, ServletResponse response,
FilterChain chain) throws IOException, ServletException {
FilterInvocation fi = new FilterInvocation(request, response, chain);
invoke(fi);
}
public void init(FilterConfig arg0) throws ServletException {
}
}
MyInvocationSecurityMetadataSource.java
package org.joshua.ss;
import java.util.ArrayList;
import java.util.Collection;
import java.util.HashMap;
import java.util.Iterator;
import java.util.List;
import java.util.Map;
import java.util.Set;
import org.joshua.ss.entity.SysAuthorities;
import org.joshua.ss.entity.SysAuthoritiesResources;
import org.joshua.ss.service.AuthorityManager;
import org.springframework.context.ApplicationContext;
import org.springframework.context.support.ClassPathXmlApplicationContext;
import org.springframework.security.access.ConfigAttribute;
import org.springframework.security.access.SecurityConfig;
import org.springframework.security.web.FilterInvocation;
import org.springframework.security.web.access.intercept.FilterInvocationSecurityMetadataSource; //import org.springframework.security.web.access.intercept.RequestKey;
import org.springframework.security.web.util.AntUrlPathMatcher;
import org.springframework.security.web.util.UrlMatcher;
/**
* 最核心的地方，就是提供某个资源对应的权限定义，即getAttributes方法返回的结果。 此类在初始化时，应该取到所有资源及其对应角色的定义。
*
* @author Joshua
*
*/
public class MyInvocationSecurityMetadataSource implements
FilterInvocationSecurityMetadataSource {
private UrlMatcher urlMatcher = new AntUrlPathMatcher();
private static Map<String, Collection<ConfigAttribute>> resourceMap=null;
public MyInvocationSecurityMetadataSource() {
loadResourceDefine();
}
private void loadResourceDefine() {
resourceMap = new HashMap<String, Collection<ConfigAttribute>>();
// Collection<ConfigAttribute> atts = new ArrayList<ConfigAttribute>();
// 获取所有的authority_name的List
ApplicationContext context = new ClassPathXmlApplicationContext(
new String[] { "applicationContext.xml",
"applicationContext_db.xml" });
// 获取业务层对象
AuthorityManager authorityManager = (AuthorityManager) context
.getBean("authorityManager");
List<SysAuthorities> authoritiesList = new ArrayList<SysAuthorities>();
authoritiesList = authorityManager.getAll();
// 获得为authority_name 对应的 resource_string的 放入resourceMap
for (SysAuthorities auth : authoritiesList) {
ConfigAttribute ca = new SecurityConfig(auth.getAuthorityName());
Set<SysAuthoritiesResources> authoritiesResources = auth
.getSysAuthoritiesResourceses();
for (SysAuthoritiesResources authorityResource : authoritiesResources) {
// resourceList.add(authorityResource.getSysResources());
String url = authorityResource.getSysResources()
.getResourceString();
if (resourceMap.containsKey(url)) {
Collection<ConfigAttribute> value = resourceMap.get(url);
value.add(ca);
resourceMap.put(url, value);
} else {
Collection<ConfigAttribute> atts = new ArrayList<ConfigAttribute>();
atts.add(ca);
resourceMap.put(url, atts);
}
}
}
}
// According to a URL, Find out permission configuration of this URL.
public Collection<ConfigAttribute> getAllConfigAttributes() {
return null;
}
public Collection<ConfigAttribute> getAttributes(Object object)
throws IllegalArgumentException {
// object 是一个URL，被用户请求的url。
String url = ((FilterInvocation) object).getRequestUrl();
//??
System.out.println(getClass().getName() + "~~~~~~~~~" + url);
int firstQuestionMarkIndex = url.indexOf("?");
if (firstQuestionMarkIndex != -1) {
url = url.substring(0, firstQuestionMarkIndex);
}
Iterator<String> ite = resourceMap.keySet().iterator();
while (ite.hasNext()) {
String resURL = ite.next();
if (urlMatcher.pathMatchesUrl(url, resURL)) {
return resourceMap.get(resURL);
}
}
return null;
}
public boolean supports(Class<?> arg0) {
return true;
}
}
MyUserDetails.java
package org.joshua.ss;
import java.util.Set;
import org.springframework.security.core.userdetails.UserDetails;
/**
*@author Joshua
*@version 2011-12-27 上午11:14:46
*/
public interface MyUserDetails extends UserDetails{
//用户id
public String getUserId();
//用户账户
public String getUserAccount();
//用户名
public String getUserName();
//用户密码
public String getUserPassword();
//用户描述或简介
public String getUserDesc();
//用户是否能用
public boolean getEnabled();
//是否超级用户
public Boolean getIssys();
//所属的单位
public String getUserDept();
//用户职位
public String getUserDuty();
//用户分管的子系统
public String getSubSystem();
//用户相对应的角色集
public Set getSysUsersRoleses();
}
MyUserDetailService.java
package org.joshua.ss;
import java.util.ArrayList;
import java.util.Collection;
import java.util.HashSet;
import javax.annotation.Resource;
import org.joshua.ss.entity.SysUsers;
import org.joshua.ss.service.UserManager;
import org.springframework.dao.DataAccessException;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.core.userdetails.UsernameNotFoundException;
public class MyUserDetailService implements UserDetailsService {
@Resource(name = "userManager")
private UserManager userManager;
public UserDetails loadUserByUsername(String username)
throws UsernameNotFoundException, DataAccessException {
Collection<GrantedAuthority> auths = new ArrayList<GrantedAuthority>();
if (null == userManager) {
userManager = new UserManager();
}
// 得到用户的权限
auths = userManager.loadUserAuthoritiesByName(username);
// 根据用户名取得一个SysUsers对象，以获取该用户的其他信息。
SysUsers user = userManager.userDao.findByUserAccount(username);
System.out.println("user.getUserId() "+user.getUserId()+" user.getUserName()"+user.getUserName()+" user.getUserPassword()"+user.getUserPassword());
return new SysUsers(
user.getUserId(),
user.getUserAccount(),
user.getUserName(),
user.getUserPassword(),
user.getUserDesc(),
user.getEnabled(),
user.getIssys(),
user.getUserDuty(),
user.getUserDept(),
user.getSubSystem(),
new HashSet(0),
true,
true,
true,
auths);
/*return new User(username, user.getUserPassword(), true, true, true, true, auths);
*/
}
}
参考：http://www.blogjava.net/SpartaYew/archive/2011/06/15/350630.html
http://wenku.baidu.com/view/4ec7e324ccbff121dd368364.html
Spring+Security+安全权限管理手册 family168 （讲的比较细，够基础，好理解）
本文章为转载内容，我们尊重原作者对文章享有的著作权。如有内容错误或侵权问题，欢迎原作者联系我们进行内容更正或删除文章。
