SpringSecurity學習筆記（一）：搭建最簡單的SpringSecurity應用

學習過程參考自：http://www.mossle.com/docs/auth/html/pt01-quickstart.html

 

一、搭建Maven項目：

　　所需引用的jar包如下：

 

　　pom.xml文件：

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">

    <modelVersion>4.0.0</modelVersion>
    <packaging>war</packaging>

    <name>SpringSecurityLearn</name>
    <groupId>org.yoki.edu</groupId>
    <artifactId>SpringSecurityLearn</artifactId>
    <version>1.0-SNAPSHOT</version>

    <dependencies>
        <dependency>
            <groupId>org.springframework.security</groupId>
            <artifactId>spring-security-web</artifactId>
            <version>3.2.0.RELEASE</version>
        </dependency>
        <dependency>
            <groupId>org.springframework.security</groupId>
            <artifactId>spring-security-config</artifactId>
            <version>3.2.0.RELEASE</version>
        </dependency>
        <dependency>
            <groupId>commons-logging</groupId>
            <artifactId>commons-logging</artifactId>
            <version>1.1.3</version>
        </dependency>
    </dependencies>
</project>

　　目錄結構如下：

 

二、各個配置文件：

　　web.xml文件的配置：

<?xml version="1.0" encoding="UTF-8"?>
<web-app version="2.4"
         xmlns="http://java.sun.com/xml/ns/j2ee"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://java.sun.com/xml/ns/j2ee http://java.sun.com/xml/ns/j2ee/web-app_2_4.xsd">

    <!--載入Spring配置文件-->
    <context-param>
        <param-name>contextConfigLocation</param-name>
        <param-value>classpath:applicationContext*.xml</param-value>
    </context-param>

    <!--配置SpringSecurity過濾器-->
    <filter>
        <filter-name>springSecurityFilterChain</filter-name>
        <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
    </filter>
    <filter-mapping>
        <filter-name>springSecurityFilterChain</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>

    <!--配置Spring監聽器，此處必須配置，否則訪問的時候將出現下面的錯誤!!!-->
    <listener>
        <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
    </listener>
    
    <!--配置首頁-->
    <welcome-file-list>
        <welcome-file>dispatcher.jsp</welcome-file>
    </welcome-file-list>
    
</web-app>
        

　　Spring監聽器，此處必須配置，否則訪問的時候將出現下面的錯誤:

 

　　applicationContext.xml配置文件：

<?xml version="1.0" encoding="UTF-8"?>
<beans:beans xmlns="http://www.springframework.org/schema/security"
             xmlns:beans="http://www.springframework.org/schema/beans"
             xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
             xsi:schemaLocation="http://www.springframework.org/schema/beans
        http://www.springframework.org/schema/beans/spring-beans.xsd
        http://www.springframework.org/schema/security
        http://www.springframework.org/schema/security/spring-security.xsd">

    <!-- http部分配置如何攔截用戶請求。auto-config='true'將自動配置幾種常用的權限控制機制，包括form, anonymous, rememberMe -->
    <http auto-config='true'>
        <!-- 設置URL權限 -->
        <!-- Spring Security采用的是一種就近原則，就是說當用戶訪問的url資源滿足多個intercepter-url時，系統將使用第一個符合條件的intercept-url進行權限控制 -->
        <!-- 此處權限的名稱必須以ROLE_作為前綴，如果不這樣做，在啟動Web容器的時候就將報錯，錯誤如下圖-->
        <intercept-url pattern="/admin.jsp" access="ROLE_ADMIN"/>
        <intercept-url pattern="/**" access="ROLE_USER"/>
    </http>

    <authentication-manager>
        <authentication-provider>
            <user-service>
                <!-- 創建一個用戶，用戶名為admin，密碼admin，分配ROLE_USER、ROLE_ADMIN兩個角色 -->
                <user name="admin" password="admin" authorities="ROLE_USER, ROLE_ADMIN"/>
                <!-- 創建一個用戶，用戶名為user，密碼user，分配ROLE_USER兩個角色 -->
                <user name="user" password="user" authorities="ROLE_USER"/>
            </user-service>
        </authentication-provider>
    </authentication-manager>

</beans:beans>

　　權限的名稱必須以ROLE_作為前綴，如果不這樣做，在啟動Web容器的時候就將報錯:

org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'org.springframework.security.filterChains': Cannot resolve reference to bean 'org.springframework.security.web.DefaultSecurityFilterChain#0' while setting bean property 'sourceList' with key [0]; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'org.springframework.security.web.DefaultSecurityFilterChain#0': Cannot resolve reference to bean 'org.springframework.security.web.access.intercept.FilterSecurityInterceptor#0' while setting constructor argument with key [11]; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'org.springframework.security.web.access.intercept.FilterSecurityInterceptor#0': Invocation of init method failed; nested exception is java.lang.IllegalArgumentException: Unsupported configuration attributes: [AROLE_ADMIN, AROLE_USER]
    at org.springframework.beans.factory.support.BeanDefinitionValueResolver.resolveReference(BeanDefinitionValueResolver.java:326)
    at org.springframework.beans.factory.support.BeanDefinitionValueResolver.resolveValueIfNecessary(BeanDefinitionValueResolver.java:107)
    at org.springframework.beans.factory.support.BeanDefinitionValueResolver.resolveManagedList(BeanDefinitionValueResolver.java:350)
    at org.springframework.beans.factory.support.BeanDefinitionValueResolver.resolveValueIfNecessary(BeanDefinitionValueResolver.java:154)
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.applyPropertyValues(AbstractAutowireCapableBeanFactory.java:1417)
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.populateBean(AbstractAutowireCapableBeanFactory.java:1158)
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:519)
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:458)
    at org.springframework.beans.factory.support.AbstractBeanFactory$1.getObject(AbstractBeanFactory.java:296)
    at org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:223)
    at org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:293)

 

三、頁面的編寫： 

 　　dispatcher.jsp，此頁面只起到一個頁面跳轉的作用。

<%@ page contentType="text/html;charset=UTF-8" language="java" %>
<html>
<head>
    <title>Title</title>
</head>
<body>
    <h1>Hello this is dispatcher.jsp</h1>
    <div>if you want go to admin.jsp , please click <a href="admin.jsp">here</a> !</div>
    <div>if you want go to index.jsp , please click <a href="index.jsp">here</a> !</div>
</body>
</html>

　　index.jsp

<%@ page contentType="text/html;charset=UTF-8" language="java" %>
<html>
<head>
    <title>Title</title>
</head>
<body>
    <h1>Hello this is index.jsp</h1>
</body>
</html>

　　admin.jsp

<%@ page contentType="text/html;charset=UTF-8" language="java" %>
<html>
<head>
    <title>Title</title>
</head>
<body>
<h1>Hello this is admin.jsp</h1>
</body>
</html>

 

 四、結果：

 　　注意：我這里使用的是IDEA配置Tomcat進行項目啟動，URL路徑配置為localhost:8080，如果是將項目打包放在Tomcat的webapp目錄下，則為：localhost:8080/項目名稱

　　具體的IDEA配置Tomcat請點擊傳送門

 

　　此登錄頁面是Spring Security自動生成的，一來為了演示的方便，二來避免用戶自己編寫登陸頁面時犯錯。

 

　　登錄失敗頁面展示：

 

　　登錄成功后進來跳轉頁面：

 　　如果使用user用戶登錄的，跳轉admin.jsp的時候，將會出現如下錯誤：

 

 轉載請標明轉載出處 ： https://www.cnblogs.com/FlyingPuPu/p/7117368.html