java - Spring安全角色分配

Question

JEE 容器通常提供一种使用专有部署描述符将外部用户角色映射到内部用户角色的机制。也就是说，应用程序在 web.xml 中声明并使用内部角色，并且有一个文件(例如 weblogic 的 weblogic.xml)将分配给用户的实际角色映射到内部角色。

使用 Spring Security 时如何实现这样的映射？我正在使用 Spring Security 3.0.x。

Answer 1

Spring 安全 3.0.x。不提供这样的开箱即用的映射。

但是您可以通过扩展用于您的身份验证方法的身份验证提供程序来自行实现它。

如果您使用 DaoAuthenticationProvider (使用内部 UserDetailsService )然后您可以覆盖 addCustomAuthorities(String username, List<GrantedAuthority> authorities)方法根据已授予的一次添加新的/映射的角色。

例如扩展 UserDetailsService :

...
@Override
protected void addCustomAuthorities(String username, List<GrantedAuthority> authorities) {
    super.addCustomAuthorities(username, authorities);

    List<GrantedAuthority> additional = new ArrayList<GrantedAuthority>();
    for (GrantedAuthority role : authorities) {
        additional .addAll(vourMappingService.getAdditionalForRole(role));
    }
    authorities.addAll(additional );
}

使用 YourMappingService映射角色(通过向现有角色添加新角色)

public class YourMappingService


 /**
     * Property bases mapping of roles to privileges.
     * Every role is one line, the privileges are comma separated.
     */
    private Properties roleToPrivileges;

    public YourMappingService(Properties roleToPrivileges) {
        if (roleToPrivileges == null) {
            throw new IllegalArgumentException("roleToPrivileges must not be null");
        }
        this.roleToPrivileges = roleToPrivileges;
    }

    @Override
    public Collection<? extends GrantedAuthority> getAdditionalForRole(GrantedAuthority role) {

        String authority = role.getAuthority();
        if(authority != null) {
            String commaSeparatedPrivileges = roleToPrivileges.getProperty(role.getAuthority());
            if (commaSeparatedPrivileges != null) {
                List<GrantedAuthority> privileges = new ArrayList<GrantedAuthority>();
                for(String privilegeName : StringUtils.commaDelimitedListToSet(commaSeparatedPrivileges)) {
                    privileges.add(new GrantedAuthorityImpl(privilegeName.trim()));
                }                
                return privileges;
            } else {
                return Collections.emptyList();
            }
        } else {
            return Collections.emptyList();
        }
    }   
}

配置:

<bean id="myUserDetailsService" class="de.humanfork.springsecurityroles.impl.JdbcDaoPrivilegesImpl">
    <constructor-arg ref="yourMappingService"/>
    <property name="dataSource" ref="dataSource"/>
    <property name="usersByUsernameQuery" value="SELECT login,encryptedPassword,loginEnabled FROM user WHERE login = ?"/>
    <property name="enableAuthorities" value="true"/>
    <property name="authoritiesByUsernameQuery" value="SELECT u.login, r.securityRoles FROM user u, user2security_roles r WHERE u.login= ? AND u.id = r. User_fk;"/>
</bean>


  <bean id="yourMappingService" class="ZourMappingService">
    <constructor-arg>
        <props>
        <prop key="ROLE_ADMIN">
                ROLE_backend_access,
                ROLE_user_mngt,
                ROLE_passwordLostRequest_mngt,
                ROLE_log_mngt
            </prop>
            <prop key="ROLE_USER">
            </prop>
        </props>
    </constructor-arg>
</bean>