Spring MVC+BlazeDS+Flex框架实践：Security篇

    在Spring MVC+BlazeDS+Flex框架实践：Database篇的基础上，这次要加入的是Spring Security的配置与应用。至于Spring Security的原理及配置详解网上已经有很多可参考的文章，在这里就不再重复了。

一、Spring Security配置

1）添加Application-Security.xml

在JAVA工程src下创建Application-Security.xml
<?xml version=”1.0″ encoding=”UTF-8″?><br /> <beans:beans xmlns:beans=”http://www.springframework.org/schema/beans”<br /> xmlns=”http://www.springframework.org/schema/security”<br /> xmlns:xsi=”http://www.w3.org/2001/XMLSchema-instance”<br /> xsi:schemaLocation=”http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-2.5.xsd<br /> http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-2.0.4.xsd<br /> “><br /> <http auto-config=”true” session-fixation-protection=”none” access-denied-page=”/modules/common/403.jsp”><br /> <form-login login-page=”/modules/common/Index.html” authentication-failure-url=”/modules/common/Index.html”<br /> default-target-url=”/modules/common/Index.html” /><br /> <logout logout-success-url=”/modules/common/index.html” /><br /> <intercept-url pattern=”/modules/common/**” access=”ROLE_ANONYMOUS” /><br /> <intercept-url pattern=”/messagebroker/**” access=”ROLE_ANONYMOUS” /><br /> <intercept-url pattern=”/modules/admin/**” access=”ROLE_ADMIN” /><br /> <intercept-url pattern=”/**” access=”ROLE_USER” /><br /> </http><br /> <authentication-manager alias=”authenticationManager” /></p> <p> <authentication-provider user-service-ref=”customUserDetailsService”><br /> </authentication-provider><br /> <beans:bean id=”loggerListener” class=”com.hand.common.security.SecurityLogListener”><br /> <beans:property name=”genericService” ref=”genericService” /><br /> </beans:bean><br /> <beans:bean id=”customLogoutFilter” class=”org.springframework.security.ui.logout.LogoutFilter”><br /> <custom-filter before=”LOGOUT_FILTER” /><br /> <beans:constructor-arg value=”/”></beans:constructor-arg><br /> <beans:constructor-arg><br /> <beans:list><br /> <beans:bean class=”com.hand.common.security.SecurityLogoutHandler”><br /> <beans:property name=”genericService” ref=”genericService” /><br /> </beans:bean><br /> </beans:list><br /> </beans:constructor-arg><br /> </beans:bean></p> <p> <beans:bean id=”customUserDetailsService” class=”com.hand.common.security.FlexUserDetailsService”><br /> <beans:property name=”genericService” ref=”genericService”></beans:property><br /> <beans:property name=”userNameProperty”><br /> <beans:value>userName</beans:value><br /> </beans:property><br /> </beans:bean><br /> </beans:beans>

2）修改web.xml

在添加Application-Security.xml后，需要在web.xml中将其添加到初始化加载列表中
修改web.xml以下配置：
<context-param><br /> <param-name>contextConfigLocation</param-name><br /> <param-value><br /> classpath:ApplicationContext.xml,classpath:Application-Flex.xml,classpath:Application-hibernate.xml,classpath:Application-Security.xml<br /> </param-value><br /> </context-param>

 

二、Security类创建

在JAVA工程src下创建package com.common.security

创建SecurityLogListener.java

package com.common.security;<br /> import java.util.Date;<br /> import java.util.HashMap;<br /> import java.util.List;<br /> import java.util.Map;<br /> import org.apache.commons.logging.Log;<br /> import org.apache.commons.logging.LogFactory;<br /> import org.springframework.context.ApplicationEvent;<br /> import org.springframework.context.ApplicationListener;<br /> import org.springframework.security.event.authentication.AbstractAuthenticationEvent;<br /> import org.springframework.security.event.authentication.AuthenticationSuccessEvent;<br /> import org.springframework.security.event.authentication.InteractiveAuthenticationSuccessEvent;<br /> import org.springframework.security.ui.WebAuthenticationDetails;<br /> import org.springframework.security.ui.session.HttpSessionApplicationEvent;<br /> import org.springframework.security.ui.session.HttpSessionDestroyedEvent;<br /> import com.common.hibernate.GenericService;<br /> import flex.messaging.FlexContext;<br /> public class SecurityLogListener implements ApplicationListener {<br /> private static final Log logger = LogFactory.getLog(SecurityLogListener.class);<br /> GenericService genericService;<br /> public GenericService getGenericService() {<br /> return genericService;<br /> }<br /> public void setGenericService(GenericService genericService) {<br /> this.genericService = genericService;<br /> }<br /> public void onApplicationEvent(ApplicationEvent event) {<br /> if (event instanceof AbstractAuthenticationEvent) {<br /> try {<br /> AbstractAuthenticationEvent authEvent = (AbstractAuthenticationEvent) event;<br /> if (event instanceof AuthenticationSuccessEvent) {<br /> Object obj = authEvent.getAuthentication().getPrincipal();<br /> if (obj instanceof FlexUserDetails) {</p> <p> System.out.println(“Username: “+((FlexUserDetails) obj).getUsername());<br /> System.out.println(“Login Date: “+new Date());<br /> System.out.println(“Session Id: “+FlexContext.getFlexSession().getId());<br /> }<br /> } else if (event instanceof InteractiveAuthenticationSuccessEvent)<br /> logger.warn(“InteractiveAuthenticationSuccessEvent:” + authEvent.getAuthentication().getDetails());<br /> } catch (Exception e) {<br /> // TODO Auto-generated catch block<br /> e.printStackTrace();<br /> }<br /> } else if (event instanceof HttpSessionApplicationEvent) {<br /> HttpSessionApplicationEvent sessionEvent = (HttpSessionApplicationEvent) event;<br /> if (event instanceof HttpSessionDestroyedEvent) {<br /> logger.info(“[destroy]”+sessionEvent.getSession().getId());<br /> Map<String, Object> params = new HashMap<String, Object>();<br /> params.put(“sessionId”, sessionEvent.getSession().getId());<br /> System.out.println(“Session Id: “+sessionEvent.getSession().getId());<br /> System.out.println(“Session remove date: “+new Date());</p> <p> }else<br /> logger.info(“[create]”+sessionEvent.getSession().getId());<br /> }<br /> }<br /> }<br />

 

创建SecurityLogoutHandler.java
package com.common.security;<br /> import java.util.Date;<br /> import java.util.HashMap;<br /> import java.util.List;<br /> import java.util.Map;<br /> import javax.servlet.http.HttpServletRequest;<br /> import javax.servlet.http.HttpServletResponse;<br /> import org.apache.commons.logging.Log;<br /> import org.apache.commons.logging.LogFactory;<br /> import org.springframework.security.Authentication;<br /> import org.springframework.security.ui.logout.SecurityContextLogoutHandler;<br /> import com.common.hibernate.GenericService;<br /> public class SecurityLogoutHandler extends SecurityContextLogoutHandler {<br /> private static final Log logger = LogFactory.getLog(SecurityLogoutHandler.class);<br /> GenericService genericService;<br /> public SecurityLogoutHandler() {<br /> super();<br /> }<br /> public GenericService getGenericService() {<br /> return genericService;<br /> }<br /> public void setGenericService(GenericService genericService) {<br /> this.genericService = genericService;<br /> }<br /> public void logout(HttpServletRequest httpservletrequest, HttpServletResponse httpservletresponse,<br /> Authentication authentication) {<br /> try {<br /> Map<String, Object> params = new HashMap<String, Object>();<br /> params.put(“sessionId”, httpservletrequest.getSession().getId());</p> <p> } catch (Exception e) {<br /> // TODO Auto-generated catch block<br /> e.printStackTrace();<br /> }<br /> super.logout(httpservletrequest, httpservletresponse, authentication);<br /> }<br /> }<br />

 

创建FlexUserDetails.java

此类中的信息与数据库的结构有关
package com.common.security;<br /> import java.util.Date;<br /> import org.springframework.security.GrantedAuthority;<br /> import org.springframework.security.userdetails.UserDetails;<br /> import com.admin.domain.FrameworkUser;<br /> public class FlexUserDetails implements UserDetails {<br /> private FrameworkUser fu;<br /> private GrantedAuthority[] authorities;<br /> public FlexUserDetails(FrameworkUser user,GrantedAuthority[] roles){<br /> this.fu=user;<br /> this.authorities=roles;</p> <p> }<br /> public GrantedAuthority[] getAuthorities() {<br /> return authorities;<br /> }<br /> public String getPassword() {<br /> return fu.getUserPassword();<br /> }<br /> public String getUsername() {<br /> // TODO Auto-generated method stub<br /> return fu.getUserName();<br /> }<br /> public boolean isAccountNonExpired() {<br /> return true;<br /> }<br /> public boolean isAccountNonLocked() {<br /> // TODO Auto-generated method stub<br /> return true;<br /> }<br /> public boolean isCredentialsNonExpired() {<br /> // TODO Auto-generated method stub<br /> return true;<br /> }<br /> public boolean isEnabled() {<br /> Date now=new Date();<br /> return fu.getStartDateActive().before(now)&&(fu.getEndDateActive()==null||fu.getEndDateActive().after(now));<br /> }<br /> public FrameworkUser getFu() {<br /> return fu;<br /> }<br /> public void setFu(FrameworkUser fu) {<br /> this.fu = fu;<br /> }<br /> public void setAuthorities(GrantedAuthority[] authorities) {<br /> this.authorities = authorities;<br /> }<br /> }<br />

 

创建FlexUserDetailsService.java
     此类中具体执行了用户登录时的授权等操作，其中明确了当用户为”admin”时，为其授予ROLE_ADMIN、ROLE_USER、ROLE_ANONYMOUS权限；而其他用户则只有ROLE_USER、ROLE_ANONYMOUS权限。不同权限的访问范围在Application-Security.xml中进行控制。本例中只有ROLE_ADMIN权限的角色才能访问modules/admin下的页面。
package com.common.security;<br /> import java.util.ArrayList;<br /> import java.util.HashMap;<br /> import java.util.List;<br /> import java.util.Map;<br /> import org.apache.log4j.Logger;<br /> import org.springframework.context.support.MessageSourceAccessor;<br /> import org.springframework.dao.DataAccessException;<br /> import org.springframework.security.GrantedAuthority;<br /> import org.springframework.security.GrantedAuthorityImpl;<br /> import org.springframework.security.SpringSecurityMessageSource;<br /> import org.springframework.security.userdetails.UserDetails;<br /> import org.springframework.security.userdetails.UserDetailsService;<br /> import org.springframework.security.userdetails.UsernameNotFoundException;<br /> import com.admin.domain.FrameworkUser;<br /> import com.common.hibernate.GenericService;<br /> public class FlexUserDetailsService implements UserDetailsService {<br /> private static final Logger logger = Logger.getLogger(AuthenticationHelper.class);<br /> private GenericService genericService;<br /> private String userNameProperty;<br /> protected MessageSourceAccessor messages;<br /> private String authoritiesbyUsernameQuery;<br /> public FlexUserDetailsService() {<br /> messages = SpringSecurityMessageSource.getAccessor();<br /> }<br /> public GenericService getGenericService() {<br /> return genericService;<br /> }<br /> public void setGenericService(GenericService genericService) {<br /> this.genericService = genericService;<br /> }<br /> public String getUserNameProperty() {<br /> return userNameProperty;<br /> }<br /> public void setUserNameProperty(String userNameProperty) {<br /> this.userNameProperty = userNameProperty;<br /> }<br /> public String getAuthoritiesbyUsernameQuery() {<br /> return authoritiesbyUsernameQuery;<br /> }<br /> public void setAuthoritiesbyUsernameQuery(String authoritiesbyUsernameQuery) {<br /> this.authoritiesbyUsernameQuery = authoritiesbyUsernameQuery;<br /> }<br /> public UserDetails loadUserByUsername(String name) throws UsernameNotFoundException, DataAccessException {<br /> System.out.println(“UserDetails: loadUserByUsername”);<br /> List users = new ArrayList();<br /> try {<br /> users = this.loadUsersByUsername(name);<br /> } catch (Exception e) {<br /> // TODO Auto-generated catch block<br /> e.printStackTrace();<br /> }<br /> if (users.size() == 0)<br /> throw new UsernameNotFoundException(messages.getMessage(“JdbcDaoImpl.notFound”, new Object[] { name },<br /> “Username {0} not found”), name);<br /> FrameworkUser user = (FrameworkUser) users.get(0);<br /> GrantedAuthority[] roles = loadUserAuthorities(name);<br /> if (roles == null)<br /> throw new UsernameNotFoundException(messages.getMessage(“JdbcDaoImpl.noAuthority”, new Object[] { name },<br /> “User {0} has no GrantedAuthority”), name);<br /> logger.info(“roles ” + roles.length);<br /> logger.info(“login in success,” + user.getUserName());<br /> return new FlexUserDetails(user, roles);<br /> }<br /> private List<Object> loadUsersByUsername(String name) throws Exception {<br /> System.out.println(“List<Object>: loadUserByUsername”);<br /> Map<String, Object> params = new HashMap<String, Object>();<br /> params.put(this.userNameProperty, name);<br /> return genericService.findByProperty(FrameworkUser.class.getName(), params);<br /> }<br /> private GrantedAuthority[] loadUserAuthorities(String name) {<br /> Map params = new HashMap();<br /> params.put(“userName”, name);</p> <p> List<GrantedAuthority> roles = new ArrayList<GrantedAuthority>();</p> <p> if(name.equals(“admin”)){<br /> roles.add(new GrantedAuthorityImpl(name));<br /> roles.add(new GrantedAuthorityImpl(“ROLE_ANONYMOUS”));<br /> roles.add(new GrantedAuthorityImpl(“ROLE_ADMIN”));<br /> roles.add(new GrantedAuthorityImpl(“ROLE_USER”));<br /> System.out.println(“授权: ROLE_ADMIN,ROLE_ANONYMOUS”);<br /> }else{<br /> roles.add(new GrantedAuthorityImpl(name));<br /> roles.add(new GrantedAuthorityImpl(“ROLE_ANONYMOUS”));<br /> roles.add(new GrantedAuthorityImpl(“ROLE_USER”));<br /> System.out.println(“授权: ROLE_USER,ROLE_ANONYMOUS”);<br /> }<br /> GrantedAuthority[] authoritiesarray = new GrantedAuthority[roles.size()];<br /> roles.toArray(authoritiesarray);<br /> return authoritiesarray;<br /> }<br /> }<br />

 

创建AuthenticationHelper.java

     此类在用户登录时被调用

package com.common.security;<br /> import java.util.HashMap;<br /> import java.util.Map;<br /> import org.apache.log4j.Logger;<br /> import org.springframework.security.Authentication;<br /> import org.springframework.security.AuthenticationManager;<br /> import org.springframework.security.GrantedAuthority;<br /> import org.springframework.security.context.SecurityContextHolder;<br /> import org.springframework.security.providers.UsernamePasswordAuthenticationToken;<br /> import org.springframework.security.userdetails.UserDetails;<br /> import flex.messaging.FlexContext;<br /> public class AuthenticationHelper {<br /> private static final Logger logger = Logger.getLogger(AuthenticationHelper.class);<br /> private AuthenticationManager authenticationManager;<br /> public AuthenticationManager getAuthenticationManager() {<br /> return authenticationManager;<br /> }<br /> public void setAuthenticationManager(AuthenticationManager authenticationManager) {<br /> this.authenticationManager = authenticationManager;<br /> }<br /> public void authenticatePrincipal(String username, String password) {<br /> //try{<br /> logger.info(“user login system! username:” + username);<br /> UsernamePasswordAuthenticationToken usernamePasswordAuthenticationToken = new UsernamePasswordAuthenticationToken(<br /> username, password);<br /> Authentication authentication = authenticationManager.authenticate(usernamePasswordAuthenticationToken);<br /> SecurityContextHolder.getContext().setAuthentication(authentication);<br /> GrantedAuthority[] authorities = SecurityContextHolder.getContext().getAuthentication().getAuthorities();<br /> int numAuthorities = authorities.length;<br /> String[] grantedRoles = new String[numAuthorities];<br /> for (int counter = 0; counter < numAuthorities; counter++) {<br /> grantedRoles[counter] = authorities[counter].getAuthority();<br /> }<br /> String name = SecurityContextHolder.getContext().getAuthentication().getName();<br /> logger.info(“登录成功!”);<br /> //}catch(Exception e){e.printStackTrace();}<br /> }<br /> public Map getCurrentUser() {<br /> if (SecurityContextHolder.getContext() == null<br /> || SecurityContextHolder.getContext().getAuthentication() == null<br /> || SecurityContextHolder.getContext().getAuthentication().getPrincipal() == null) {<br /> Map temp = new HashMap();<br /> temp.put(“userName”, “System”);<br /> temp.put(“userId”, 0);<br /> return temp;<br /> }<br /> Map user = new HashMap();<br /> Object obj = SecurityContextHolder.getContext().getAuthentication().getPrincipal();<br /> if (obj instanceof UserDetails) {<br /> user.put(“userDescription”, ((FlexUserDetails) obj).getFu().getUserDescription());<br /> user.put(“userId”, ((FlexUserDetails) obj).getFu().getUserId());<br /> user.put(“userName”, ((FlexUserDetails) obj).getUsername());<br /> } else {<br /> user.put(“userName”, obj.toString());<br /> user.put(“userId”, -100);<br /> }<br /> logger.info(user);<br /> return user;<br /> }<br /> public Long getCurrentUserId() {<br /> if (this.getCurrentUser().get(“userId”) != null)<br /> return Long.valueOf(this.getCurrentUser().get(“userId”).toString());<br /> return new Long(-100);<br /> }<br /> }<br />

 

三、配置AuthenticationHelper

1）发布AuthenticationHelper

在Application-Flex.xml中添加如下配置：
<bean id=”authenticationHelper” class=”com.hand.common.security.AuthenticationHelper”><br /> <property name=”authenticationManager” ref=”authenticationManager”></property><br /> <flex:remoting-destination /><br /> </bean>

2）创建CommonModule.mxml

在FLEX工程modules/common目录下创建CommonModule.mxml，用以实现Security验证
<?xml version=”1.0″ encoding=”utf-8″?><br /> <mx:Module xmlns:mx=”http://www.adobe.com/2006/mxml” layout=”absolute” width=”500″ height=”300″><br /> <mx:RichTextEditor x=”0″ y=”0″ title=”Title” width=”100%” height=”100%”><br /> </mx:RichTextEditor><br /> </mx:Module><br />

3）引用authenticationHelper
在FLEX工程remoting-config.xml中添加如下配置：
<destination id=”authenticationHelper”><br /> <properties><br /> <source>authenticationHelper</source><br /> </properties><br /> </destination>

3）修改Index.mxml

在Index.mxml中调用authenticationHelper，修改后的Index.mxml内容如下：
<?xml version=”1.0″ encoding=”utf-8″?><br /> <mx:Application xmlns:mx=”http://www.adobe.com/2006/mxml”<br /> layout=”vertical”<br /> horizontalAlign=”center”<br /> creationComplete=”initApp()”<br /> fontSize=”15″ ></p> <p> <mx:Script><br /> <!–[CDATA[<br /> import mx.rpc.events.FaultEvent;<br /> import mx.rpc.events.ResultEvent;<br /> import mx.controls.Alert;</p> <p> private function initApp():void{</p> <p> UserService.getMessage();<br /> UserService.getMessage.addEventListener(ResultEvent.RESULT, getMessageHandler);<br /> }<br /> private function getMessageHandler(evt:ResultEvent):void{<br /> UserService.getMessage.removeEventListener(ResultEvent.RESULT, getMessageHandler);<br /> initText.text = evt.result as String;<br /> }<br /> private function login():void{<br /> //添加登录成功监听器<br /> authenticationHelper.authenticatePrincipal.addEventListener(ResultEvent.RESULT, loginSuccess);<br /> //添加登录失败监听器<br /> authenticationHelper.authenticatePrincipal.addEventListener(FaultEvent.FAULT, loginFailure);<br /> //向服务器发送登录请求<br /> authenticationHelper.authenticatePrincipal(username.text, password.text);<br /> }</p> <p> private function loginSuccess(event:Event):void<br /> {<br /> authenticationHelper.authenticatePrincipal.removeEventListener(ResultEvent.RESULT, loginSuccess);<br /> this.currentState=’loginSuccess’;<br /> }</p> <p> private function loginFailure(event:FaultEvent):void<br /> {<br /> Alert.show(“登录不成功！”+event.fault.faultString);<br /> authenticationHelper.removeEventListener(FaultEvent.FAULT, loginFailure);<br /> }<br /> private function changeState(sign:String):void{<br /> currentState = ‘moduleState’;<br /> if(sign==’A’){<br /> currentState = ‘moduleState’;<br /> moduleLoader.url = ‘../admin/UserModule.swf’;<br /> }else{<br /> currentState = ‘moduleState’;<br /> moduleLoader.url = ‘../common/CommonModule.swf’;<br /> }<br /> }<br /> private function logout():void{<br /> navigateToURL(new URLRequest(“javascript:location.href=’TestProject/j_spring_security_logout’;”), “_self”);<br /> }</p> <p> ]]–><br /> </mx:Script><br /> <mx:RemoteObject id=”UserService” destination=”UserService”/><br /> <mx:RemoteObject id=”authenticationHelper” destination=”authenticationHelper”/><br /> <mx:states><br /> <mx:State name=”loginSuccess”><br /> <mx:RemoveChild target=”{vbox1}”/><br /> <mx:AddChild position=”lastChild”><br /> <mx:VBox width=”50%” height=”30%” horizontalAlign=”center” verticalAlign=”middle”><br /> <mx:LinkButton label=”admin.mxml” click=”changeState(‘A’)”/><br /> <mx:LinkButton label=”common.mxml” click=”changeState(‘B’)”/><br /> </mx:VBox><br /> </mx:AddChild><br /> </mx:State><br /> <mx:State name=”moduleState”><br /> <mx:RemoveChild target=”{vbox1}”/><br /> <mx:AddChild position=”lastChild”><br /> <mx:ModuleLoader width=”50%” height=”50%” id=”moduleLoader” url=”../admin/UserModule.swf”/><br /> </mx:AddChild><br /> <mx:AddChild position=”lastChild”><br /> <mx:LinkButton label=”返回” click=”currentState=’loginSuccess'”/><br /> </mx:AddChild><br /> <mx:AddChild position=”lastChild”><br /> <mx:LinkButton label=”退出” click=”logout()”/><br /> </mx:AddChild><br /> </mx:State><br /> </mx:states><br /> <mx:Label text=”Welcome” id=”initText” fontWeight=”bold”/><br /> <mx:VBox width=”50%” height=”50%” horizontalAlign=”center” verticalAlign=”middle” id=”vbox1″><br /> <mx:FormItem label=”用户名” labelWidth=”100″><br /> <mx:TextInput id=”username” width=”200″/><br /> </mx:FormItem><br /> <mx:FormItem label=”密码” labelWidth=”100″><br /> <mx:TextInput id=”password” width=”200″ displayAsPassword=”true”/><br /> </mx:FormItem><br /> <mx:Button label=”登录” width=”80″ click=”login()”/><br /> </mx:VBox><br /> </mx:Application><br />

 

四、编译运行
1）编译FLEX工程
选择Project—>Clean—>TestProject

2）拷贝FLEX编译目录bin-debug/modules到JAVA工程WebRoot下

3）启动本地数据库

4）启动服务器

5）服务器正常启动后，在浏览器内输入(其中9090为服务器端口号)

http://localhost:9090/TestProject/modules/common/Index.html

 

运行结果：
以Sky用户登录

 

登录首页

 

查看modules/admin/UserModule.swf，由于权限控制将无法访问

 

查看modules/common/CommonModule.swf

 

以admin用户登录

 

查看modules/admin/UserModule/swf，由于已经为该用户授予了权限，因此可以访问

 

查看modules/common/CommonModule.swf

 

 

到此Spring MVC+BlzeDS+Flex框架的搭建三个过程都已经结束，如果今后还有新的内容我会及时和大家分享。