]]>
]]>
˜q™é‡Œé¢æœ‰ä¸¤ä¸ªæœ€åŸºæœ¬çš„概念：(x¨¬)authentication manager å’?access decision manageråQŒå‰è€…控制认è¯ï¼ŒåŽéƒ½æŽ§åˆ¶é‰´æƒã€?br />
1. åœ?ss 的认è¯ç³»¾lŸä¸åQŒé»˜è®¤çš„实现帮助我们æ供了三个概念，用户åQˆuseråQ‰ï¼Œè§’色åQˆauthorityåQŒä¸€èˆ¬å˜ roleåQ‰å’Œ¾l„（groupåQ‰ï¼Œä¸‰è€…的关系是，¾l„ã€è§’色与用户都是多对多关¾p»ï¼Œ¾l„和角色间没关系åQŒé»˜è®¤æ˜¯ä¸å¯ç”¨ç»„的。厾l，åœ?Acl æƒé™½Ž¡ç†ä¸ï¼Œå¯ä»¥çœ‹åˆ°è§’色之间åQŒæ˜¯å¯ä»¥æœ‰åŒ…å«ï¼ˆæ ?w¨¨i)åÅžåQŸï¼‰å…³ç³»çš„ã€?br />
2. åœ?ss 的鉴æƒç³»¾lŸä¸åQŒæ˜Žæ˜¾ä¼š(x¨¬)比认è¯å¤æ‚得多。有 AccessDecisionManager, AccessDecisionVoteråQˆå‰¾|®ï¼‰, AfterInvocationProvideråQˆåŽ¾|®ï¼‰, RoleHierarchy, SidRetrievalStrategy, LookupStrategy, PermissionGrantingStrategy, SecurityExpressionHandler, AclService, MutableAclService, AclCache 概念˜q‡å¤šäº†ï¼Œè¦ä¸€ä¸ªä¸€ä¸ªè§£é‡?br />
a) ä¸å¿ƒæ˜?AccessDecisionManageråQŒä¸»è¦è´Ÿè´?AccessDecisionVoter 的管ç†ï¼Œé»˜è®¤æä¾›äº?¿U实玎ͼš(x¨¬)1. AffirmativeBased 如果有ä“Q何一个投¼œ¨å™¨å…许讉K—®,è¯äh±‚ž®†è¢«ç«‹åˆ»å…许,而丽Ž¡ä¹‹å‰å¯èƒ½æœ‰çš„æ‹’¾l决定ã€?. ConsensusBased 多数¼œ?å…许或拒¾l?军_®šäº†ç»“果，òq›_±€çš„投¼œ?和空¼œ?全是弃æƒçš?的结果是å¯é…¾|®çš„ã€?. UnanimousBased 所有的投票器必™åÕd…¨æ˜¯å…许的,å¦åˆ™è®‰K—®ž®?被拒¾lã€?br />
AccessDecisionManager 在用äº?Web å’?Method Call 两ç§æƒ…况下，å¯èƒ½æ˜¯ä¸ä¸€è‡´çš„åQŒå› 为功能也ä¸ä¸€è‡´ã€?br />
b) Method Call 除了使用 AccessDecisionManager ˜q›è¡Œæƒé™åˆ¤æ–外，˜q˜å¯ä»¥å¢žåŠ?AfterInvocationProvider æ¥è¿›è¡Œå‡ºå£æ•°æ®çš„判æ–åQŒé»˜è®¤æ供了 3 ¿Uã€?br />
1) PostInvocationAdviceProvider: 需è¦æ供一ä¸?PostInvocationAuthorizationAdviceåQŒé»˜è®¤å®žçŽ°åªæœ‰ä¸€ä¸ªï¼Œž®±æ˜¯ ExpressionBasedPostInvocationAdviceåQŒå¯ä»¥é€šè¿‡ spel æ¥è¿›è¡Œæƒé™åˆ¤æ–。注æ„?ExpressionBasedPostInvocationAdvice ä¸éœ€è¦æ供一ä¸?MethodSecurityExpressionHandleråQŒèƒ½å¤Ÿåˆ›å»ºå‡ºä¸€ä¸?MethodSecurityExpressionOperationsåQŒæ”¾åˆ?spel context ä¸ï¼Œä¾?spel function 调用åQŒè¿™æ ïL(f¨¥ng)š„æ–¹å¼åQŒåœ¨åŽç®‹å¾ˆå¸¸è§ã€?br />
2) AclEntryAfterInvocationProvider å’?AclEntryAfterInvocationCollectionFilteringProvider : ˜q™ä¸¤¿U都差ä¸å¤šï¼Œä¸»è¦ä¾èµ– AclService, ObjectIdentityRetrievalStrategy, SidRetrievalStrategy æ¥é…åˆï¼Œ‹‚€æŸ¥è¿”回值的æƒé™ã€‚Collection 版本的，å¯ä»¥æŠŠæ— æƒé™çš„æ•°æ®åŽ»æŽ‰ï¼Œåªç•™ä¸‹æœ‰æƒé™çš„æ•°æ®ã€?br />
c) RoleHierarchy æ供了角色之间的关系åQŒæ供了两个实现åQŒä¸€ä¸ªæ˜¯æ²¡å…³¾pÈš„åQŒç›´æŽ¥æŠŠ user çš?role ˜q”回åQŒå¦å¤–一个是有ç‘ô承关¾pÈš„。ç‘ô承关¾pÕd®žçŽ°æŒºæœ‰æ„æ€çš„åQŒèƒ½å¤Ÿå¤„ç†å¤š¾U§çš„ include 关系åQŒæ¯”较好用ã€?br />
RoleHierarchy çš„ä‹É用比较å¤æ‚，ä¼?x¨¬)è¢?AccessDecisionVoter, SidRetrievalStrategy, SecurityExpressionHandler 用到åQŒSecurityExpressionHandler åˆä¼š(x¨¬)è¢?AccessDecisionVoter 用到åQŒæ‰€ä»¥è¿˜æ˜¯æœ‰ç‚¹å„¿æ··äØ•ã€?br />
具体的说 SecurityExpressionHandler ä¼?x¨¬)用å?PermissionEvaluator å’?RoleHierarchyåQŒPermissionEvaluator 的一个实çŽ?AclPermissionEvaluator ä¼?x¨¬)用å?SidRetrievalStrategyã€?br />
d) SidRetrievalStrategy å’?RoleHierarchy 的功能比较接˜q‘，æ¯?RoleHierarchy 高一个抽象层‹Æ¡ï¼ŒåŠŸèƒ½ä¸Šä¹Ÿæœ‰æ‰€åŒºåˆ«åQŒæ˜¯ä»Žä¸€ä¸?authentication 拿到所有相关的 SidåQˆåŒ…æ‹?RoleåQˆGrantedAuthoritySidåQ?å’?UseråQˆPrincipalSidåQ‰ï¼‰åQŒè€?RoleHierarchy åªåŒ…括了 RoleåQˆGrantedAuthoritySidåQ‰çš„¾l§æ‰¿å…³ç³»ã€?br />
e) LookupStrategy 通过 ObjectIdentity å’?Sid 把相关的 Acl 查询出æ¥ã€‚å¯ä»¥åœ¨ LookupStrategy 扩展 Acl å’?Ace 的功能，比如åœ?Ace 上é¢åŠ 上旉™—´çš„æ¡ä»‰™™åˆÓž¼Œž®±éœ€è¦è‡ªå·±å®šä¹?LookupStrategyåQŒæŠŠæ—‰™—´æ¡äšg从数æ®åº“查询出æ¥åQŒåƈ攑ֈ°è‡ªå®šä¹‰çš„ Ace 当ä¸ã€?br />
但这件事情éžå¸”Rº»çƒ¦ï¼Œå› äØ“(f¨´)默认实现çš?BasicLookupStrategy 是个 Final çš„ç±»åQŒæ‰€ä»¥åªèƒ½è‡ªå·Þq›´æŽ¥å®žçŽ°æŽ¥å£ï¼Œæ— 法使用现有的功能ã€?br />
LookupStrategy ä¼?x¨¬)生æ?AclåQŒè€Œæœ€¾lˆçš„æƒé™éªŒè¯æ˜¯ç”± Acl 完æˆçš„，如果想验è¯å¸¦æ—‰™—´æ¡äšgçš?AceåQŒéœ€è¦ç»™ Acl 讄¡½®è‡ªå®šä¹‰çš„带有‹‚€æŸ¥æ—¶é—´åŠŸèƒ½çš„ PermissionGrantingStrategyåQŒå®žé™…上åQŒè¿™ä¸?PermissionGrantingStrategy ä¼?x¨¬)首先设¾|®ç»™ LookupStrategyåQŒLookupStrategy 在创å»?Acl 的时候，å†æ”¾åˆ?Acl ä¸åŽ»ã€?br />
f) SecurityExpressionHandler 能够执行 spelåQŒå¾—到是å¦å¯ä»¥è®¿é—®çš„¾l“æžœåQŒå®ƒçš„å¾c»éƒ½æ˜¯ç‘ô承自 AbstractSecurityExpressionHandler 的，有一个éžå¸”R‡è¦çš„æ–ÒŽ(gu¨©)³•æ˜?SecurityExpressionOperations createSecurityExpressionRoot(Authentication authentication, T invocation)åQŒåˆ›å»ÞZ¸€ä¸?SecurityExpressionOperations 攑ֈ° EvaluationContext ä¸åŽ»åQŒæä¾?spel ä¸æ‰§è¡Œçš„æ–ÒŽ(gu¨©)³•å®žçŽ°ã€‚比å¦?SecurityExpressionOperations 的一个抽象实çŽ?SecurityExpressionRoot ä¸ï¼Œž®±åŒ…å«äº†å¤§é‡çš„æƒé™éªŒè¯æ–¹æ³•ï¼Œå¦?hasRole, hasPermission ½{‰å¸¸ç”¨çš„功能ã€?br />
g) AclService, MutableAclService, AclCache 概念比较½Ž€å•ï¼ŒAclService 是通过 LookupStrategy 查询 AclåQŒè‡ªå·²å¯ä»¥æŸ¥è¯?ObjectIdentity 的父åå…³è”å…³¾p»ï¼ŒMutableAclService æ供了修改的能力åQŒAclCache ä¸?AclService æä¾›¾~“å˜åQŒé»˜è®¤çš„实现了一ä¸?EhCacheBasedAclCacheã€?br />
3. ss 的鉴æƒæ¨¡åž?Sid, ObjectIdentity, Acl, Ace, Permission
a) Sid: 是ä¸å¿ƒï¼Œæ‰€æœ‰çš„授æƒä¼?x¨¬)å…³è”åœ?Sid 上é¢åQŒSid 和之å‰çš„ Role Base Permission ä¼?x¨¬)有些相åŒçš„地方åQŒä½†ä¹Ÿæ˜Žæ˜¾ä¸åŒï¼ŒSid 默认实现情况下，分äØ“(f¨´) GrantedAuthoritySid å’?PrincipalSidåQŒå…¶å®žå°±æ˜?Role å’?UseråQŒé€šè¿‡ SidRetrievalStrategy 拿到一ä¸?Authentication çš?Sidã€?br />
b) ObjectIdentity: å¯ä»¥ç†è§£æˆ?ResourceåQŒå°±æ˜¯å¯è®‰K—®çš„ç›®æ ‡èµ„æºï¼Œæœ?id å’?type 两个å—段åQŒé»˜è®¤å®žçŽ°çš„ ObjectIdentityImpl ä¼?x¨¬)直接调用目æ?domainObject çš?getClass å’?getId æ–ÒŽ(gu¨©)³•æ‹¿åˆ°ä¸¤ä¸ªå‚数。在 PermissionEvaluator, AfterInvocationProvider ä¸ï¼Œä¼?x¨¬)用å?ObjectIdentityRetrievalStrategy å’?ObjectIdentityGeneratoråQŒObjectIdentityRetrievalStrategy ä¼?x¨¬)æ ¹æ?domainObject 拿到 ObjectIdentityåQŒç„¶åŽä‹Éç”?Acl ˜q›è¡Œé‰´æƒåQŒObjectIdentityGenerator ä¼?x¨¬)在¾pÈ»Ÿæ供的ä¸æ˜?domainObjectåQŒè€Œæ˜¯ type, id 的时候，拿到 ObjectIdentityåQŒç„¶åŽè¿›è¡?Acl 鉴æƒåQŒè¿™ä¸¤ä¸ªæŽ¥å£æœ‰ä¸€ä¸ªå…±åŒçš„实现 ObjectIdentityRetrievalStrategyImplåQŒå¦‚果需è¦åœ¨ ObjectIdentity ˜q›è¡Œæ–°çš„抽象åQŒéœ€è¦ç”¨æ–°çš„实现åQŒåˆ°å¾—ä¸åŒçš„ ObjectIdentityåQŒæ¯”如将业务对象分类鉴惘q™æ ·çš„需求ã€?br />
c) Acl, æ¯ä¸ª ObjectIdentity 最多对应一æ?AclåQŒAcl ä¸åŒ…å«äº†å¾ˆå¤šåQŒåŒ…æ‹?parentalåQŒè¯´æ˜?Acl 是有¾l§æ‰¿å…³ç³»çš„？其实ä¸æ˜¯åQŒå‘µå‘µï¼Œæ˜?ObjectIdentity 有ç‘ô承关¾p»è€Œå·²ã€‚有一ä¸?ObjectIdentityåQŒæœ‰å¾ˆå¤š SidåQŒè¿˜æœ‰ä¸€ä¸ªå«å?Owner çš?SidåQŒæœ‰ä»?LookupStrategy ä¼ è¿‡æ¥çš„ PermissionGrantingStrategyåQŒè¿›è¡Œå®žé™…的鉴æƒåQŒè¿˜æœ?AclAuthorizationStrategy ‹‚€æŸ¥æœ‰æ²¡æœ‰æƒé™˜q›è¡Œ Acl security check。实现时间æ¡ä»¶æ£€æŸ¥ï¼Œž®±æ‰©å±?PermissionGrantingStrategyã€?br />
ä¸ÞZ»€ä¹ˆæ²¡æœ?RoleHierarchy 或是 SidRetrievalStrategy å˜åœ¨å‘¢ï¼Ÿæ˜¯å› ä¸ø™°ƒç”?Acl ˜q›è¡Œæƒé™‹‚€æŸ¥ä¹‹å‰ï¼Œå·²ç»æŠŠç›¸å…³çš„ Sid 得到了，å†ç»™ Acl çš„ã€?br />
d) Ace, Permission: Ace å˜å‚¨ Sid, PermissionåQŒæ供给 Acl 鉴æƒç”¨ã€‚å¢žåŠ æ—¶é—´æ¡ä»¶çš„è¯ï¼Œæœ€åŸºæœ¬çš„，ž®±æ˜¯è¦åœ¨ Ace ä¸ï¼Œå¢žåŠ æ—‰™—´æ¡äšgå—段。Permission 是用二进制å˜å‚¨çš„åQŒä½†é»˜è®¤å®žçŽ°çš„æ•°æ®åº“å˜å‚¨òq¶ä¸æ˜¯ï¼Œæ˜¯ä¸€ä¸ªä¸€æ¡ï¼Œå˜åœ¨æ•°æ®åº“里é¢çš„ã€?/p>
好å§åQŒæ¦‚念还是éžå¸¸å¤šçš„，ä¸è¿‡é‰´äºŽæƒé™æŽ§åˆ¶æœ¬èínž®±æ˜¯ä¸ªå¤æ‚çš„è¯é¢˜åQŒss ˜q™äº›è®¾è®¡çš„我觉得已ç»éžå¸¸å¥½ï¼Œä¹ŸåŸºæœ¬å¤Ÿç”¨äº†ã€?/p>
@import url(http://www.aygfsteel.com/CuteSoft_Client/CuteEditor/Load.ashx?type=style&file=SyntaxHighlighter.css);@import url(/css/cuteeditor.css);
import javax.net.ssl.SSLContext;
import javax.net.ssl.SSLSocketFactory;
import javax.net.ssl.TrustManager;
import javax.net.ssl.X509TrustManager;
import java.io.IOException;
import java.net.InetAddress;
import java.net.Socket;
import java.security.KeyManagementException;
import java.security.KeyStoreException;
import java.security.NoSuchAlgorithmException;
import java.security.UnrecoverableKeyException;
import java.security.cert.CertificateException;
import java.security.cert.X509Certificate;
public class TrustAllSSLSocketFactory extends SSLSocketFactory {
SSLContext sslContext = SSLContext.getInstance("TLS");
public TrustAllSSLSocketFactory() throws NoSuchAlgorithmException, KeyManagementException, KeyStoreException, UnrecoverableKeyException {
TrustManager tm = new X509TrustManager() {
public void checkClientTrusted(X509Certificate[] chain, String authType) throws CertificateException {
}
public void checkServerTrusted(X509Certificate[] chain, String authType) throws CertificateException {
}
public X509Certificate[] getAcceptedIssuers() {
return null;
}
};
sslContext.init(null, new TrustManager[]{tm}, null);
}
@Override
public Socket createSocket(Socket socket, String host, int port, boolean autoClose) throws IOException {
return sslContext.getSocketFactory().createSocket(socket, host, port, autoClose);
}
@Override
public Socket createSocket(String host, int port) throws IOException {
return sslContext.getSocketFactory().createSocket(host, port);
}
@Override
public Socket createSocket(String host, int port, InetAddress localHost, int localPort) throws IOException {
return sslContext.getSocketFactory().createSocket(host, port, localHost, localPort);
}
@Override
public Socket createSocket(InetAddress host, int port) throws IOException {
return sslContext.getSocketFactory().createSocket(host, port);
}
@Override
public Socket createSocket(InetAddress address, int port, InetAddress localAddress, int localPort) throws IOException {
return sslContext.getSocketFactory().createSocket(address, port, localAddress, localPort);
}
@Override
public Socket createSocket() throws IOException {
return sslContext.getSocketFactory().createSocket();
}
@Override
public String[] getDefaultCipherSuites() {
return new String[0];
}
@Override
public String[] getSupportedCipherSuites() {
return new String[0];
}
}
]]>