Question

从spring petclinic sample app构建的应用程序添加了Spring安全性和自定义登录表单。

该应用程序没有 this tutorial建议的WebMvcConfiguration.java类。相反，它在mvc-core-config.xml中有以下行：

<mvc:view-controller path="/login" view-name="login" />

我在eclipse中完成了Ctrl-H并在整个工作区中对术语/login进行了关键词搜索，但没有可见的控制器。我还查看了上面教程链接中提到的messages-jc示例项目，但找不到＆＃34; /login＆＃34;那里的控制器。

如何添加一个控制器，该控制器将使用标准用户名和密码执行spring身份验证，但这也将允许我在＆＃34; /的登录表单中随后向身份验证过程添加其他代码登录＆＃34;网址已提交？

是否像在SomeOtherController.java中添加以下内容一样简单：

@RequestMapping(value = "/login", method = RequestMethod.GET)
public String showLoginForm(Model model) {
        //what goes here?       
    return "public/loginform";
}

@RequestMapping(value = "/login", method = RequestMethod.POST)
public String processLoginForm(HttpSession session, @ModelAttribute("user") User user,
        BindingResult result, Model model, final RedirectAttributes redirectAttributes)
{
        //what goes here?
    return "secure/main";
}

Answer 1

涉及登录表单的jsp文件应该是这样的。

<%@ page language="java" contentType="text/html; charset=ISO-8859-1" pageEncoding="ISO-8859-1"%>  
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">  
<%@ taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core"%>  
<html>  
<head>  
<title>Spring security</title>  
<style>  
.errorblock {  
 color: #ff0000;  
 background-color: #ffEEEE;  
 border: 3px solid #ff0000;  
 padding: 8px;  
 margin: 16px;  
}  
</style>  
</head>  
<body onload='document.f.j_username.focus();'>  
 <h3>Login with Username and Password</h3>  

 <c:if test="${not empty error}">  
  <div class="errorblock">  
   Your login attempt was not successful, try again.  
 Caused :  
   ${sessionScope["SPRING_SECURITY_LAST_EXCEPTION"].message}  
  </div>  
 </c:if>  
 <%-- <c:url value="/j_spring_security_check" var="index.htm" />
 <form name='f' action="${index.htm}" method='POST'>  --%>
 <form name='f' action="<c:url value='j_spring_security_check' />" method='POST'> 
  <table>
   <tr>  
    <td>User:</td>  
    <td><input type='text' name='j_username' value=''>  
    </td>  
   </tr>  
   <tr>  
    <td>Password:</td>  
    <td><input type='password' name='j_password' />  
    </td>  
   </tr>  
   <tr>  
    <td colspan='2'><input name="submit" type="submit"  
     value="submit" />  
    </td>  
   </tr>  
   <tr>  
    <td colspan='2'><input name="reset" type="reset" />  
    </td>  
   </tr>  
  </table>  
 </form>  
</body>  
</html>

您的spring-security.xml文件应该如下所示。

<?xml version="1.0" encoding="UTF-8"?>  
<beans xmlns="http://www.springframework.org/schema/beans"  
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"  
xmlns:security="http://www.springframework.org/schema/security"  
xmlns:p="http://www.springframework.org/schema/p"   
xsi:schemaLocation="http://www.springframework.org/schema/beans  
                    http://www.springframework.org/schema/beans/spring-beans.xsd  
                    http://www.springframework.org/schema/security  
                    http://www.springframework.org/schema/security/spring-security.xsd">

 <security:http auto-config="true" >  
 <security:intercept-url pattern="/index*" access="ROLE_USER" />  
 <security:form-login login-page="/login.htm" default-target-url="/index.htm"  
  authentication-failure-url="/loginerror.htm" />  
 <security:logout logout-success-url="/logout.htm" />
 <!-- <security:csrf disabled="true"/> -->  
 </security:http>  

<security:authentication-manager>  
<security:authentication-provider>  
<!-- <security:user-service>  
<security:user name="syed" password="1111" authorities="ROLE_USER" />  
</security:user-service> -->  
<security:jdbc-user-service data-source-ref="dataSource"    
users-by-username-query="select username, password, active from users where username=?"   
authorities-by-username-query="select us.username, ur.authority from users us, user_roles ur   
where us.user_id = ur.user_id and us.username =?  "   
/>  
</security:authentication-provider>  
</security:authentication-manager>
</beans>

在配置元素中，您可以使用一个或多个元素限制对特定URL的访问。每个元素都指定访问URL所需的URL模式和一组访问属性。请记住，您必须始终在URL模式的末尾包含通配符。如果不这样做，将使URL模式无法匹配具有请求参数的URL。

 <security:http auto-config="true" >  
 <security:intercept-url pattern="/index*" access="ROLE_USER" />
 <security:intercept-url pattern="/Transit*" access="ROLE_USER" />
 <security:form-login login-page="/login.htm" default-target-url="/index.htm"  
  authentication-failure-url="/loginerror.htm" />  
 <security:logout logout-success-url="/logout.htm" />
 </security:http>

如果我们要描述一个没有任何安全性的url，那么我们应该从安全配置的xml文件下面的上面代码行中删除特定的url。例如，如果我们不需要索引页面的任何安全性，那么上面的编码应该是这样的。

<security:http auto-config="true" >  
     <security:intercept-url pattern="/Transit*" access="ROLE_USER" />
     <security:form-login login-page="/login.htm" default-target-url="/index.htm"  
      authentication-failure-url="/loginerror.htm" />  
     <security:logout logout-success-url="/logout.htm" />
     </security:http>

Answer 2

为此，您可以通过从org.springframework.security.authentication实现AuthenticationProvider来使用自己的CustomAuthenticationProvider，并重写公共Authentication authenticate（Authentication authentication）方法。

代码示例如下

 public class EchoServer {
public static void Main() {
    TcpListener listener = null;

    try
    {
        listener = new TcpListener(IPAddress.Parse("127.0.0.1"), 9999);
        listener.Start();
        Console.WriteLine("TCP Server Has Started....");
        while (true)
        {
            Console.WriteLine("                                           ");
            Console.WriteLine("Waiting for incoming client connections....");
            Console.WriteLine("                                           ");
            Console.WriteLine("A message will display below once the client starts and establishes a connection ");
            TcpClient client = listener.AcceptTcpClient();
            Console.WriteLine("                                              ");
            Console.WriteLine("Okay, Accepting Client connection now");
            Console.WriteLine("                                       ");
            Console.WriteLine("Accepted new client connection.....");
            StreamReader reader = new StreamReader(client.GetStream());
            StreamWriter writer = new StreamWriter(client.GetStream());
            string s = string.Empty;
            while (!(s = reader.ReadLine()).Equals("Exit") || (s == null)) {
                Console.WriteLine("From client -> " + s);
                writer.WriteLine("From server -> " + s);
                writer.Flush();
            }
            reader.Close();
            writer.Close();
            client.Close();
        }



    } catch (Exception e)
    {
        Console.WriteLine(e);

    } finally
    {
        if (listener != null)
        {
            listener.Stop();
        }
    }

  }
}

因此默认的登录处理程序，即/ login（POST）将由此处理。

添加具有spring security

2 个答案: