Question

如何动态生成“intercept-url”。我的用户名和角色存储在数据库中，我想将所有这些用户映射到spring security.Is有什么方法可以做到这一点吗？

Answer 1

您必须提供自己的com.icod.solapCore.spring.security.FilterInvocationSecurityMetadataSource实现。

这可能是这样的：

public class MyFilterInvocationSecurityMetadataSource implements FilterInvocationSecurityMetadataSource {

      @Override
      public Collection<ConfigAttribute> getAttributes(Object object) throws IllegalArgumentException {
        FilterInvocation filterInvocation = (FilterInvocation) object;
        HttpServletRequest request = filterInvocation.getHttpRequest();
        Collection<ConfigAttribute> result = new ArrayList<ConfigAttribute>();
        // Find roles in database that secures the specified request
        // ...
        // For any role found, create a SecurityConfig object prefixed with "ROLE_" ex : 
        // for(String role : roles) {
        //   ConfigAttribute attribute = new SecurityConfig("ROLE_"+roleFound);
        //   result.add(attribute);
        // }

        return result;
      }

      @Override
      public Collection<ConfigAttribute> getAllConfigAttributes() {
        return null;
      }

      @Override
      public boolean supports(Class<?> clazz) {
        return FilterInvocation.class.isAssignableFrom(clazz);
      }
}

然后你必须用你自己的替换默认的FilterInvocationSecurityMetadataSource。我使用BeanPostProcessor进行操作，在Spring读取配置文件之后调用，但在配置正式之前。看起来像这样：

public class MyFilterInvocationSecurityMetadataSourceBeanPostProcessor implements BeanPostProcessor {

  private FilterInvocationSecurityMetadataSource metadataSource = new MyFilterInvocationSecurityMetadataSource();

  @Override
  public Object postProcessBeforeInitialization(Object bean, String name) throws BeansException {
    if (bean instanceof FilterInvocationSecurityMetadataSource) {
      return metadataSource;
    }
    return bean;
  }

  @Override
  public Object postProcessAfterInitialization(Object bean, String name) throws BeansException {
    return bean;
  }
}

然后你只需要配置bean post processor：

<bean id="solapcoreFilterInvocationSecurityMetadataSourceBeanPostProcessor" class="foo.bar.MyFilterInvocationSecurityMetadataSourceBeanPostProcessor"/>

希望得到这个帮助。

Answer 2

为所有用户提供相同的角色，并在配置中使用此角色。

您可以阅读角色here

Spring安全性动态添加用户和权限

2 个答案: