空間站

Trackback: http://tb.blog.csdn.net/TrackBack.aspx?PostId=1827059

一、基本原理
Acegi認(rèn)證授權(quán)主要基于兩大技術(shù)，一是Filter機(jī)制，二是AOP的攔截機(jī)制。通過FilterSecurityInterceptor很好地實(shí)現(xiàn)了對(duì)URI的保護(hù)，通過MethodSecurityInterceptor實(shí)現(xiàn)了對(duì)Service的方法的攔截保護(hù)，通過ACL 實(shí)現(xiàn)了對(duì)prototype類型的Object進(jìn)行過濾和保護(hù)。

二、基本概念
HttpSessionContextIntegrationFilter 存儲(chǔ)SecurityContext in HttpSession
ChannelProcessingFilter 重定向到另一種協(xié)議，如http到https

ConcurrentSessionFilter 因?yàn)椴皇褂萌魏蜸ecurityContextHolder的功能，但是需要更新SessionRegistry來表示當(dāng)前的發(fā)送請(qǐng)求的principal，通過在web.xml中注冊(cè)Listener監(jiān)聽Session事件，并發(fā)布相關(guān)消息，然后由SessionRegistry獲得消息以判斷當(dāng)前用戶的Session數(shù)量。

AuthenticationProcessingFilter 普通認(rèn)證機(jī)制(大多數(shù)用這個(gè))

CasProcessingFilter CAS認(rèn)證機(jī)制

BasicProcessingFilter Http協(xié)議的Basic認(rèn)證機(jī)制

HttpRequestIntegrationFilter Authentication 從容器的HttpServletRequest.getUserPrincipal()獲得

JbossIntegrationFilter 與Jboss相關(guān)。

SecurityContextHolderAwareRequestFilter 與servlet容器結(jié)合使用。

RememberMeProcessingFilter 基于Cookies方式進(jìn)行認(rèn)證。

AnonymousProcessingFilter 匿名認(rèn)證。

ExceptionTranslationFilter 捕獲所有的Acegi Security 異常，這樣要么返回一個(gè)HTTP錯(cuò)誤響應(yīng)或者加載一個(gè)對(duì)應(yīng)的AuthenticationEntryPoint

AuthenticationEntryPoint 認(rèn)證入口

三、Acegi認(rèn)證授權(quán)流程
1、FilterToBeanProxy 負(fù)責(zé)代理請(qǐng)求給FilterChainProxy

2、FilterChainProxy 方便的將多個(gè)Filter串聯(lián)起來，如上面基本概念中提到的各種Filter，當(dāng)然如果對(duì)URI進(jìn)行授權(quán)保護(hù)，也可以包含F(xiàn)ilterSecurityInterceptor。注意各Filter的順序。

3、AbstractSecurityInterceptor 調(diào)度中心。負(fù)責(zé)調(diào)用各模塊完成相應(yīng)功能。
FilterSecurityInterceptor 對(duì)URI進(jìn)行攔截保護(hù)
AspectJSecurityInterceptor 對(duì)方法進(jìn)行攔截保護(hù)
MethodSecurityInterceptor 對(duì)方法進(jìn)行攔截保護(hù)

4、AuthenticationManager 用戶認(rèn)證
-> AuthenticationProvider 實(shí)際進(jìn)行用戶認(rèn)證的地方(多個(gè))。
-> UserDetailsService 返回帶有GrantedAuthority的UserDetail或者拋出異常。

5、AccessDecisionManager(UnanimousBased/AffirmativeBased/ConsensusBased) 授權(quán)
-> AccessDecisionVoter(RoleVoter/BaseAclEntryVoter) 實(shí)際投票的Voter(多個(gè)).

6、RunAsManager 變更GrantedAuthority

7、AfterInvocationManager 變更返回的對(duì)象
-> BaseInvocationProvider 實(shí)際完成返回對(duì)象變更的地方(多個(gè))。

四、Acegi實(shí)例

http://www.javaeye.com/topic/43341

本文出處
http://starcraft.blogdriver.com/starcraft/1135045.html

在我之前的一篇文章里, 說明了在 Acegi 中如何將資源權(quán)限數(shù)據(jù)存儲(chǔ)到數(shù)據(jù)庫中, 文章見 http://www.hibernate.org.cn/viewtopic.php?t=17538, 雖然文中方式實(shí)現(xiàn)了從數(shù)據(jù)庫讀取資源權(quán)限, 但是代碼量較大, 并且重載了 SecurityEnforcementFilter, 造成比較大的侵入性, 這里我將提供另一種更簡潔的方式實(shí)現(xiàn)此功能.

入口還是 org.acegisecurity.intercept.web.FilterSecurityInterceptor, 資源權(quán)限配置來自于 objectDefinitionSource, 標(biāo)準(zhǔn)配置方式采用 FilterInvocationDefinitionSourceEditor 解析, 支持 Perl5 和 AntPath 兩種風(fēng)格, 為了實(shí)現(xiàn)從其它位置(典型如數(shù)據(jù)庫), 我們要做的就是實(shí)現(xiàn)一個(gè)自定義的 FilterInvocationDefinitionSource, 查看類層次結(jié)構(gòu)圖后可以發(fā)現(xiàn), acegi 中已經(jīng)有一個(gè) AbstractFilterInvocationDefinitionSource 已經(jīng)實(shí)現(xiàn)此接口, 只要實(shí)現(xiàn)一個(gè)抽象方法即可

 public abstract ConfigAttributeDefinition lookupAttributes(String url);

因此, 自定義一個(gè) Class 如下 :

public class RdbmsBasedFilterInvocationDefinitionSource extends AbstractFilterInvocationDefinitionSource

因?yàn)?acegi 中已經(jīng)提供了 Perl5 和 AntPath 的實(shí)現(xiàn), 只需要集成過來即可, 因此定義接口如下

/**
 * <class>ConfigableFilterInvocationDefinition</class> 支持 Perl5 和 ant Path 兩種風(fēng)格的資源配置方式
 * @since 2006-1-19
 * @author 王政
 * @version $Id: ConfigableFilterInvocationDefinition.java,v 1.3 2006/01/19 09:40:37 wz Exp $
 */
public interface ConfigableFilterInvocationDefinition {
 
 /** The Perl5 expression  */
 String PERL5_KEY = "PATTERN_TYPE_PERL5";
   
    /** The ant path expression */
    String ANT_PATH_KEY = "PATTERN_TYPE_APACHE_ANT";
 
    /** 標(biāo)準(zhǔn)分隔符 */
    String STAND_DELIM_CHARACTER = ",";
   
    /**
     * Set resource expression, the value must be {@link #PERL5_KEY_REG_EXP} or {@link #ANT_PATH_KEY}
     * @see #REOURCE_EXPRESSION_PERL5_REG_EXP
     * @see #RESOURCE_EXPRESSION_ANT_PATH_KEY
     * @param resourceExpression the resource expression
     */
    void setResourceExpression(String resourceExpression);
   
    /**
     *
     * @return resource expression
     */
    String getResourceExpression();
   
    /**
     * Set whether convert url to lowercase before comparison
     * @param convertUrlToLowercaseBeforeComparison whether convertUrlToLowercaseBeforeComparison
     */
    void setConvertUrlToLowercaseBeforeComparison(boolean convertUrlToLowercaseBeforeComparison);
 
    /**
     *
     * @return whether convert url to lowercase before comparison
     */
    boolean isConvertUrlToLowercaseBeforeComparison();
  
}

 再讓 RdbmsBasedFilterInvocationDefinitionSource 實(shí)現(xiàn)此接口即可, 下面是簡略代碼 

/**
 * <class>RdbmsBasedFilterInvocationDefinitionSource</class> 是基于數(shù)據(jù)庫的權(quán)限存儲(chǔ)實(shí)現(xiàn), 它支持兩種風(fēng)格的配置
 * @see com.skyon.uum.security.acegi.intercept.web.ConfigableFilterInvocationDefinition
 * @see org.acegisecurity.intercept.web.RegExpBasedFilterInvocationDefinitionMap
 * @see org.acegisecurity.intercept.web.PathBasedFilterInvocationDefinitionMap
 * @since 2006-1-19
 * @author 王政
 * @version $Id: RdbmsBasedFilterInvocationDefinitionSource.java,v 1.6 2006/02/13 03:20:55 wz Exp $
 */
public class RdbmsBasedFilterInvocationDefinitionSource extends AbstractFilterInvocationDefinitionSource
 implements ConfigableFilterInvocationDefinition, InitializingBean {
 
 
    //~ Static fields/initializers =============================================

    private static final Log logger = LogFactory.getLog(RdbmsBasedFilterInvocationDefinitionSource.class);
 
    // ~ Instance fields ========================================================
 
    private String resourceExpression = PERL5_KEY;
   
    private boolean convertUrlToLowercaseBeforeComparison = false;
    
    private ResourceMappingProvider resourceMappingProvider;
   
    //  ~ Methods ================================================================
   
 /**
  *
  * @see org.acegisecurity.intercept.web.AbstractFilterInvocationDefinitionSource#lookupAttributes(java.lang.String)
  */
 public ConfigAttributeDefinition lookupAttributes(String url) {
  FilterInvocationDefinitionSource actualSource = populateFilterInvocationDefinitionSource();
  
  if (RegExpBasedFilterInvocationDefinitionMap.class.isInstance(actualSource)) {
   return ((RegExpBasedFilterInvocationDefinitionMap) actualSource).lookupAttributes(url);
  } else if (PathBasedFilterInvocationDefinitionMap.class.isInstance(actualSource)) {
   return ((PathBasedFilterInvocationDefinitionMap) actualSource).lookupAttributes(url);
  }
  
  throw new IllegalStateException("wrong type of " + actualSource + ", it should be " + RegExpBasedFilterInvocationDefinitionMap.class
    + " or " + PathBasedFilterInvocationDefinitionMap.class);  
 }
 
 /**
  *
  * @see org.acegisecurity.intercept.ObjectDefinitionSource#getConfigAttributeDefinitions()
  */
 public Iterator getConfigAttributeDefinitions() {
  FilterInvocationDefinitionSource actualSource = populateFilterInvocationDefinitionSource();
  
  if (RegExpBasedFilterInvocationDefinitionMap.class.isInstance(actualSource)) {
   return ((RegExpBasedFilterInvocationDefinitionMap) actualSource).getConfigAttributeDefinitions();
  } else if (PathBasedFilterInvocationDefinitionMap.class.isInstance(actualSource)) {
   return ((PathBasedFilterInvocationDefinitionMap) actualSource).getConfigAttributeDefinitions();
  }
  
  throw new IllegalStateException("wrong type of " + actualSource + ", it should be " + RegExpBasedFilterInvocationDefinitionMap.class
    + " or " + PathBasedFilterInvocationDefinitionMap.class); 
 }
 
 
    private FilterInvocationDefinitionSource populateFilterInvocationDefinitionSource() {             
     FilterInvocationDefinitionMap definitionSource = null;
     
     if (PERL5_KEY.equals(getResourceExpression())) {
      definitionSource = new RegExpBasedFilterInvocationDefinitionMap();
     } else if (ANT_PATH_KEY.equals(getResourceExpression())) {
      definitionSource = new PathBasedFilterInvocationDefinitionMap();
     } else {
      throw new IllegalArgumentException("wrong resourceExpression value");
     }
       
        definitionSource.setConvertUrlToLowercaseBeforeComparison(isConvertUrlToLowercaseBeforeComparison());
       
        ResourceMapping[] mappings = getResourceMappingProvider().getResourceMappings();
        if (mappings == null || mappings.length ==0) {
            return (FilterInvocationDefinitionSource) definitionSource;
        }
       
        for (int i = 0; i < mappings.length; i++) {
            ResourceMapping mapping = mappings[i];
            String[] recipents = mapping.getRecipients();
           
            if (recipents == null || recipents.length == 0) {
                if (logger.isErrorEnabled()) {
                    logger.error("Notice, the resource : " + mapping.getResourcePath() + " hasn't no recipents, it will access by any one ! ");
                }
                continue;
            }
           
            StringBuffer valueBuffer = new StringBuffer();
            for (int j = 0; j < recipents.length; j++) {
                valueBuffer.append(recipents[j]);
                if (j < recipents.length - 1) {
                    valueBuffer.append(STAND_DELIM_CHARACTER);
                }
            }
            String value = valueBuffer.toString();                   
            addSecureUrl(definitionSource, mapping.getResourcePath(), value);
         }
    
        return (FilterInvocationDefinitionSource )definitionSource;
    }
 
   
    /**
     * @param source
     * @param name
     * @param value
     * @throws IllegalArgumentException
     */
    private synchronized void addSecureUrl(FilterInvocationDefinitionMap source, String name, String value)
        throws IllegalArgumentException {
       
        // Convert value to series of security configuration attributes
        ConfigAttributeEditor configAttribEd = new ConfigAttributeEditor();
        configAttribEd.setAsText(value);

        ConfigAttributeDefinition attr = (ConfigAttributeDefinition) configAttribEd.getValue();

        // Register the regular expression and its attribute
        source.addSecureUrl(name, attr);
    }
   
    省去 getter， setter....

}

ResourceMappingProvider

public interface ResourceMappingProvider {
   
 String RESOURCE_PATH_PREFIX = "/";
 
    /**
     * Get Resource Mapping
     * @return resource mapping
     */
    ResourceMapping[] getResourceMappings();
   
}

public class ResourceMapping {
   
    // url
    private String resourcePath;
   
    // 即角色
    private String[] recipients = new String[0];
      
    省去 getter， setter....

} 

這樣就很完美的既支持了從數(shù)據(jù)庫的讀取數(shù)據(jù), 又可以自由選擇 Perl5 和 AntPath 兩種風(fēng)格的配置, 最后不要忘了給 ResourceMappingProvider 加一層 cache, 我的配置如下

<bean id="resourceCache" class="com.skyon.uum.security.acegi.intercept.web.cache.EhCacheBasedResourceCache">
  <property name="dataSource">
   <ref bean="dataSource"></ref>
  </property>
  <property name="cache">
   <bean parent="cacheTemplate">    
    <property name="cacheName"><value>resourceCache</value></property>
   </bean>
        </property>
  <property name="allResourcesQuery">
   <value>
   select distinct t.id, t.id, t.parent_id, t.url, t.title, t.layer, t.type, t.application_id
   from uum_resource t order by t.orderField
   </value>
  </property>
 </bean>
 
 <bean id="permissionCache" class="com.skyon.uum.security.acegi.intercept.web.cache.EhCacheBasedPermissionCache">
  <property name="dataSource">
   <ref bean="dataSource"></ref>
  </property>
  <property name="cache">
   <bean parent="cacheTemplate">    
    <property name="cacheName"><value>permissionCache</value></property>
   </bean>
        </property>
  <property name="recipentsResourceMappingQuery">
   <value>
   select r.name, p.resource_id from uum_permission p left outer join uum_role r on p.role_id = r.id
   </value>
  </property> 
 </bean>
 
   
 <bean id="resourceMappingProvider" class="com.skyon.uum.security.acegi.intercept.web.ResourceMappingProviderImpl" autowire="byType"/>

    <!-- ======================== AUTHENTICATION ======================= -->
   
    <!-- Note the order that entries are placed against the objectDefinitionSource is critical.
         The FilterSecurityInterceptor will work from the top of the list down to the FIRST pattern that matches the request URL.
         Accordingly, you should place MOST SPECIFIC (ie a/b/c/d.*) expressions first, with LEAST SPECIFIC (ie a/.*) expressions last -->
    <bean id="filterInvocationInterceptor" class="org.acegisecurity.intercept.web.FilterSecurityInterceptor">
        <property name="authenticationManager"><ref local="authenticationManager"/></property>
        <property name="accessDecisionManager"><ref local="accessDecisionManager"/></property>
        <property name="objectDefinitionSource"><ref local="filterInvocationDefinitionSource"></ref></property>
  <!--
  <property name="rejectPublicInvocations"><value>true</value></property>
  -->
    </bean>
 
 <bean id="filterInvocationDefinitionSource" class="com.skyon.uum.security.acegi.intercept.web.RdbmsBasedFilterInvocationDefinitionSource">
  <property name="resourceMappingProvider">
   <ref local="resourceMappingProvider"></ref>
  </property>
  <property name="resourceExpression">
   <value>PATTERN_TYPE_APACHE_ANT</value>
  </property>
 </bean>

 這段時(shí)間看了很多人對(duì) Acegi 的評(píng)價(jià), 有不少觀點(diǎn)認(rèn)為 Acegi 的配置太過繁瑣, 其實(shí)權(quán)限控制本來就不是一件很輕松的事, Acegi 用 AOP 實(shí)現(xiàn), 配置文件的確有些繁瑣, 但是只要一個(gè)配置文件就解決了整個(gè)系統(tǒng)的權(quán)限問題, 可謂一勞永逸, 相比較在 Action 中實(shí)現(xiàn)應(yīng)該還是利遠(yuǎn)大于弊, 也有人說用 WebWork 的 Interceptor 實(shí)現(xiàn), 雖然也是不錯(cuò)的 solution, 但是不要忘了, 并不是所有的項(xiàng)目都使用 webwork , 假如有一個(gè) struts 的項(xiàng)目, 權(quán)限控制就會(huì)有移植性的問題.

我的 msn : shartcn@msn.com, 有問題歡迎討論