Spring安全角色分配

Question

JEE容器通常提供使用专有部署描述符将外部映射到内部用户角色的机制。也就是说，应用程序声明并使用web.xml中的内部角色，并且有一个文件（例如weblogic的weblogic.xml），可将分配给用户的实际角色映射到内部角色。

使用Spring Security时如何实现这样的映射？我正在使用Spring Security 3.0.x.

Answer 1

Spring Security 3.0.x.没有提供这样的映射。

但是，您可以通过自己的方式实现它，方法是扩展用于身份验证方法的身份验证提供程序。

如果您使用DaoAuthenticationProvider（使用内部参数UserDetailsService），那么您可以覆盖addCustomAuthorities(String username, List<GrantedAuthority> authorities)方法以根据已授予的一次添加新的/映射的角色。

例如扩展UserDetailsService：

... 
@Override 
protected void addCustomAuthorities(String username, List<GrantedAuthority> authorities) { 
    super.addCustomAuthorities(username, authorities); 

    List<GrantedAuthority> additional = new ArrayList<GrantedAuthority>(); 
    for (GrantedAuthority role : authorities) { 
     additional .addAll(vourMappingService.getAdditionalForRole(role)); 
    } 
    authorities.addAll(additional); 
} 

使用在YourMappingService到角色映射（通过添加新的角色，一旦现有的）

public class YourMappingService 


/** 
    * Property bases mapping of roles to privileges. 
    * Every role is one line, the privileges are comma separated. 
    */ 
    private Properties roleToPrivileges; 

    public YourMappingService(Properties roleToPrivileges) { 
     if (roleToPrivileges == null) { 
      throw new IllegalArgumentException("roleToPrivileges must not be null"); 
     } 
     this.roleToPrivileges = roleToPrivileges; 
    } 

    @Override 
    public Collection<? extends GrantedAuthority> getAdditionalForRole(GrantedAuthority role) { 

     String authority = role.getAuthority(); 
     if(authority != null) { 
      String commaSeparatedPrivileges = roleToPrivileges.getProperty(role.getAuthority()); 
      if (commaSeparatedPrivileges != null) { 
       List<GrantedAuthority> privileges = new ArrayList<GrantedAuthority>(); 
       for(String privilegeName : StringUtils.commaDelimitedListToSet(commaSeparatedPrivileges)) { 
        privileges.add(new GrantedAuthorityImpl(privilegeName.trim())); 
       }     
       return privileges; 
      } else { 
       return Collections.emptyList(); 
      } 
     } else { 
      return Collections.emptyList(); 
     } 
    } 
} 

配置：

<bean id="myUserDetailsService" class="de.humanfork.springsecurityroles.impl.JdbcDaoPrivilegesImpl"> 
    <constructor-arg ref="yourMappingService"/> 
    <property name="dataSource" ref="dataSource"/> 
    <property name="usersByUsernameQuery" value="SELECT login,encryptedPassword,loginEnabled FROM user WHERE login = ?"/> 
    <property name="enableAuthorities" value="true"/> 
    <property name="authoritiesByUsernameQuery" value="SELECT u.login, r.securityRoles FROM user u, user2security_roles r WHERE u.login= ? AND u.id = r. User_fk;"/> 
</bean> 


    <bean id="yourMappingService" class="ZourMappingService"> 
    <constructor-arg> 
     <props> 
     <prop key="ROLE_ADMIN"> 
       ROLE_backend_access, 
       ROLE_user_mngt, 
       ROLE_passwordLostRequest_mngt, 
       ROLE_log_mngt 
      </prop> 
      <prop key="ROLE_USER"> 
      </prop> 
     </props> 
    </constructor-arg> 
</bean>