??xml version="1.0" encoding="utf-8" standalone="yes"?>午夜久久久久久,亚洲欧洲av,日产精品久久久久久久性色http://www.aygfsteel.com/tomato2088/category/17990.htmlzh-cnWed, 28 Feb 2007 04:35:03 GMTWed, 28 Feb 2007 04:35:03 GMT60转：Acegi安全pȝ的配|?/title><link>http://www.aygfsteel.com/tomato2088/archive/2007/02/02/97642.html</link><dc:creator>西红柿（tomatoQ?/dc:creator><author>西红柿（tomatoQ?/author><pubDate>Fri, 02 Feb 2007 12:31:00 GMT</pubDate><guid>http://www.aygfsteel.com/tomato2088/archive/2007/02/02/97642.html</guid><wfw:comment>http://www.aygfsteel.com/tomato2088/comments/97642.html</wfw:comment><comments>http://www.aygfsteel.com/tomato2088/archive/2007/02/02/97642.html#Feedback</comments><slash:comments>0</slash:comments><wfw:commentRss>http://www.aygfsteel.com/tomato2088/comments/commentRss/97642.html</wfw:commentRss><trackback:ping>http://www.aygfsteel.com/tomato2088/services/trackbacks/97642.html</trackback:ping><description><![CDATA[ <font color="#000080"> Acegi安全pȝ的配|?</font> <div id="wmqeeuq" class="postText"> <p>        <br />Acegi 的配|看h非常复杂,但事实上在实际项目的安全应用中我们ƈ不需要那么多功能,清楚的了解Acegi配置中各的功能Q有助于我们灉|的运用Acegi于实践中?/p> </div> <p>2.1 在Web.xml中的配置</p> <p>1)  <strong>FilterToBeanProxy</strong><br />　　Acegi通过实现了Filter接口的FilterToBeanProxy提供一U特D的使用Servlet Filter的方式，它委托Spring中的Bean -- FilterChainProxy来完成过滤功能，q好处是化了web.xml的配|，q且充分利用了Spring IOC的优ѝFilterChainProxy包含了处理认证过E的filter列表Q每个filter都有各自的功能?/p> <pre>    <filter><br />        <filter-name>Acegi Filter Chain Proxy</filter-name><br />        <filter-class>org.acegisecurity.util.FilterToBeanProxy</filter-class><br />        <init-param><br />            <param-name>targetClass</param-name><br />            <param-value>org.acegisecurity.util.FilterChainProxy</param-value><br />        </init-param><br />    </filter></pre> <p>2) <strong>filter-mapping</strong><br />　　<filter-mapping>限定了FilterToBeanProxy的URL匚w模式,只有*.do?.jsp?j_acegi_security_check 的请求才会受到权限控Ӟ对javascript,css{不限制?/p> <pre>   <filter-mapping><br />      <filter-name>Acegi Filter Chain Proxy</filter-name><br />      <url-pattern>*.do</url-pattern><br />    </filter-mapping><br />    <br />    <filter-mapping><br />      <filter-name>Acegi Filter Chain Proxy</filter-name><br />      <url-pattern>*.jsp</url-pattern><br />    </filter-mapping><br />    <br />    <filter-mapping><br />      <filter-name>Acegi Filter Chain Proxy</filter-name><br />      <url-pattern>/j_acegi_security_check</url-pattern><br /> </filter-mapping></pre> <p>3) <strong>HttpSessionEventPublisher</strong><br />　　<listener>的HttpSessionEventPublisher用于发布HttpSessionApplicationEvents和HttpSessionDestroyedEvent事glspring的applicationcontext?/p> <pre>    <listener><br />        <listener-class>org.acegisecurity.ui.session.HttpSessionEventPublisher</listener-class><br />    </listener><br /></pre> <h2> <br />2.2 在applicationContext-acegi-security.xml?/h2> <h3>2.2.1 FILTER CHAIN</h3> <p>　　FilterChainProxy会按序来调用这些filter,使这些filter能n用Spring ioc的功? CONVERT_URL_TO_LOWERCASE_BEFORE_COMPARISON定义了url比较前先转ؓ写Q?PATTERN_TYPE_APACHE_ANT定义了用Apache ant的匹配模?</p> <pre> <bean id="filterChainProxy" class="org.acegisecurity.util.FilterChainProxy"><br />        <property name="filterInvocationDefinitionSource"><br />            <value><br />                CONVERT_URL_TO_LOWERCASE_BEFORE_COMPARISON<br />                PATTERN_TYPE_APACHE_ANT<br />               /**=httpSessionContextIntegrationFilter,authenticationProcessingFilter,<br />basicProcessingFilter,rememberMeProcessingFilter,anonymousProcessingFilter,<br /> exceptionTranslationFilter,filterInvocationInterceptor<br />            </value><br />        </property><br />    </bean></pre> <h3>2.2.2 基础认证</h3> <p>1) <strong>authenticationManager</strong><br />　　起到认证理的作用，它将验证的功能委托给多个ProviderQƈ通过遍历Providers, 以保证获取不同来源的w䆾认证Q若某个Provider能成功确认当前用Lw䆾Qauthenticate()Ҏ会返回一个完整的包含用户授权信息的Authentication对象Q否则会抛出一个AuthenticationException?br />Acegi提供了不同的AuthenticationProvider的实?如：<br />        DaoAuthenticationProvider 从数据库中读取用户信息验证n?br />        AnonymousAuthenticationProvider 匿名用户w䆾认证<br />        RememberMeAuthenticationProvider 已存cookie中的用户信息w䆾认证<br />        AuthByAdapterProvider 使用容器的适配器验证n?br />        CasAuthenticationProvider ҎYale中心认证服务验证w䆾, 用于实现单点登陆<br />        JaasAuthenticationProvider 从JASS登陆配置中获取用户信息验证n?br />        RemoteAuthenticationProvider Ҏq程服务验证用户w䆾<br />        RunAsImplAuthenticationProvider 对n份已被管理器替换的用戯行验?br />        X509AuthenticationProvider 从X509认证中获取用户信息验证n?br />        TestingAuthenticationProvider 单元试时?/p> <p>        每个认证者会对自己指定的证明信息q行认证Q如DaoAuthenticationProvider仅对UsernamePasswordAuthenticationTokenq个证明信息q行认证?/p> <pre><bean id="authenticationManager" class="org.acegisecurity.providers.ProviderManager"><br />        <property name="providers"><br />            <list><br />                <ref local="daoAuthenticationProvider"/><br />                <ref local="anonymousAuthenticationProvider"/><br />                <ref local="rememberMeAuthenticationProvider"/><br />            </list><br />        </property><br /></bean></pre> <p> <br />2) <strong>daoAuthenticationProvider</strong><br />　　q行单的Z数据库的w䆾验证。DaoAuthenticationProvider获取数据库中的̎号密码ƈq行匚wQ若成功则在通过用户w䆾的同时返回一个包含授权信息的Authentication对象Q否则n份验证失败，抛出一个AuthenticatiionException?/p> <pre>    <bean id="daoAuthenticationProvider" class="org.acegisecurity.providers.dao.DaoAuthenticationProvider"><br />        <property name="userDetailsService" ref="jdbcDaoImpl"/><br />        <property name="userCache" ref="userCache"/><br />        <property name="passwordEncoder" ref="passwordEncoder"/><br />   </bean></pre> <p> <br />3) <strong>passwordEncoder</strong><br />　　使用加密器对用户输入的明文进行加密。Acegi提供了三U加密器:<br />PlaintextPasswordEncoder—默认，不加密，q回明文.<br />ShaPasswordEncoder—哈希算?SHA)加密<br />Md5PasswordEncoder—消息摘?MD5)加密</p> <pre><bean id="passwordEncoder" class="org.acegisecurity.providers.encoding.Md5PasswordEncoder"/></pre> <p> <br />4) <strong>jdbcDaoImpl</strong><br />　　用于在数据中获取用户信息?acegi提供了用户及授权的表l构Q但是您也可以自己来实现。通过usersByUsernameQueryq个SQL得到你的(用户ID,密码,状态信?;通过authoritiesByUsernameQueryq个SQL得到你的(用户ID,授权信息)</p> <pre> <bean id="jdbcDaoImpl" class="org.acegisecurity.userdetails.jdbc.JdbcDaoImpl"><br />        <property name="dataSource" ref="dataSource"/><br />        <property name="usersByUsernameQuery"><br />            <value>select loginid,passwd,1 from users where loginid = ?</value><br />        </property><br />        <property name="authoritiesByUsernameQuery"><br />            <value>select u.loginid,p.name from users u,roles r,permissions p,user_role ur,role_permis rp where u.id=ur.user_id and r.id=ur.role_id and p.id=rp.permis_id and<br />                r.id=rp.role_id and p.status='1' and u.loginid=?</value><br />        </property><br /></bean></pre> <p>5) <strong>userCache　&  resourceCache</strong><br />　　~存用户和资源相对应的权限信息。每当请求一个受保护资源ӞdaoAuthenticationProvider׃被调用以获取用户授权信息。如果每ơ都从数据库获取的话Q那代h很高Q对于不常改变的用户和资源信息来_最好是把相x权信息缓存v来?详见 <a >2.6.3 资源权限定义扩展</a> )<br />userCache提供了两U实? NullUserCache和EhCacheBasedUserCache, NullUserCache实际上就是不q行M~存QEhCacheBasedUserCache是用Ehcache来实现缓功能?/p> <pre>    <bean id="userCacheBackend" class="org.springframework.cache.ehcache.EhCacheFactoryBean"><br />        <property name="cacheManager" ref="cacheManager"/><br />        <property name="cacheName" value="userCache"/><br />    </bean><br />    <bean id="userCache" class="org.acegisecurity.providers.dao.cache.EhCacheBasedUserCache" autowire="byName"><br />        <property name="cache" ref="userCacheBackend"/><br />     </bean><br />    <bean id="resourceCacheBackend" class="org.springframework.cache.ehcache.EhCacheFactoryBean"><br />        <property name="cacheManager" ref="cacheManager"/><br />        <property name="cacheName" value="resourceCache"/><br />    </bean><br />    <bean id="resourceCache" class="org.springside.modules.security.service.acegi.cache.ResourceCache" autowire="byName"><br />        <property name="cache" ref="resourceCacheBackend"/><br />    </bean></pre> <p> <br />6) <strong>basicProcessingFilter</strong><br />　　用于处理HTTP头的认证信息Q如从Springq程协议(如Hessian和Burlap)或普通的览器如IE,Navigator的HTTP头中获取用户信息Q将他们转交l通过authenticationManager属性装配的认证理器。如果认证成功，会将一个Authentication对象攑ֈ会话中，否则Q如果认证失败，会将控制转交l认证入口点(通过authenticationEntryPoint属性装?</p> <pre>    <bean id="basicProcessingFilter" class="org.acegisecurity.ui.basicauth.BasicProcessingFilter"><br />        <property name="authenticationManager" ref="authenticationManager"/><br />        <property name="authenticationEntryPoint" ref="basicProcessingFilterEntryPoint"/><br />    </bean></pre> <p>7) <strong>basicProcessingFilterEntryPoint</strong><br />　　通过向浏览器发送一个HTTP401(未授?消息Q提C用L录?br />处理ZHTTP的授权过E， 在当验证q程出现异常后的"d"Q通常实现转向、在response里加入error信息{功能?/p> <pre> <bean id="basicProcessingFilterEntryPoint" class="org.acegisecurity.ui.basicauth.BasicProcessingFilterEntryPoint"><br />        <property name="realmName" value="SpringSide Realm"/><br /></bean></pre> <p>8) <strong>authenticationProcessingFilterEntryPoint</strong><br />　　当抛出AccessDeniedExceptionӞ用户重定向到登录界面。属性loginFormUrl配置了一个登录表单的URL,当需要用L录时QauthenticationProcessingFilterEntryPoint会将用户重定向到该URL</p> <pre> <bean id="authenticationProcessingFilterEntryPoint" class="org.acegisecurity.ui.webapp.AuthenticationProcessingFilterEntryPoint"><br />        <property name="loginFormUrl"><br />            <value>/security/login.jsp</value><br />        </property><br />        <property name="forceHttps" value="false"/><br /></bean></pre> <h2>2.2.3 HTTP安全h</h2> <p>1) <strong>httpSessionContextIntegrationFilter</strong><br />　　每次request?HttpSessionContextIntegrationFilter从Session中获取Authentication对象Q在request完后, 又把Authentication对象保存到Session中供下次request使用,此filter必须其他Acegi filter前用，使之能跨多个请求?/p> <pre><bean id="httpSessionContextIntegrationFilter" class="org.acegisecurity.context.HttpSessionContextIntegrationFilter"></bean><br />    <bean id="httpRequestAccessDecisionManager" class="org.acegisecurity.vote.AffirmativeBased"><br />        <property name="allowIfAllAbstainDecisions" value="false"/><br />        <property name="decisionVoters"><br />            <list><br />                <ref bean="roleVoter"/><br />            </list><br />        </property><br /></bean></pre> <p> <br />2) <strong>httpRequestAccessDecisionManager</strong><br />　　l过投票机制来决定是否可以访问某一资源(URL或方?。allowIfAllAbstainDecisions为false时如果有一个或以上的decisionVoters投票通过,则授权通过。可选的决策机制有ConsensusBased和UnanimousBased</p> <pre>    <bean id="httpRequestAccessDecisionManager" class="org.acegisecurity.vote.AffirmativeBased"><br />        <property name="allowIfAllAbstainDecisions" value="false"/><br />        <property name="decisionVoters"><br />            <list><br />                <ref bean="roleVoter"/><br />            </list><br />        </property><br />    </bean></pre> <p> <br />3) <strong>roleVoter</strong><br /> 　　必须是以rolePrefix讑֮的value开头的权限才能q行投票,如AUTH_ , ROLE_</p> <pre>    <bean id="roleVoter" class="org.acegisecurity.vote.RoleVoter"><br />        <property name="rolePrefix" value="AUTH_"/><br />   </bean></pre> <p>4Q?strong>exceptionTranslationFilter</strong><br />　　异常转换qo器，主要是处理AccessDeniedException和AuthenticationExceptionQ将l每个异常找到合适的"d" </p> <pre>   <bean id="exceptionTranslationFilter" class="org.acegisecurity.ui.ExceptionTranslationFilter"><br />        <property name="authenticationEntryPoint" ref="authenticationProcessingFilterEntryPoint"/><br />    </bean></pre> <p>5) <strong>authenticationProcessingFilter</strong><br />　　和servlet spec差不?处理登陆h.当n份验证成功时QAuthenticationProcessingFilter会在会话中放|一个Authentication对象Qƈ且重定向到登录成功页?br />         authenticationFailureUrl定义登陆p|时{向的面<br />         defaultTargetUrl定义登陆成功时{向的面<br />         filterProcessesUrl定义登陆h的页?br />         rememberMeServices用于在验证成功后dcookie信息</p> <pre>    <bean id="authenticationProcessingFilter" class="org.acegisecurity.ui.webapp.AuthenticationProcessingFilter"><br />        <property name="authenticationManager" ref="authenticationManager"/><br />        <property name="authenticationFailureUrl"><br />            <value>/security/login.jsp?login_error=1</value><br />        </property><br />        <property name="defaultTargetUrl"><br />            <value>/admin/index.jsp</value><br />        </property><br />        <property name="filterProcessesUrl"><br />            <value>/j_acegi_security_check</value><br />        </property><br />        <property name="rememberMeServices" ref="rememberMeServices"/><br />    </bean></pre> <p>6) <strong>filterInvocationInterceptor</strong><br />　　在执行{向url前检查objectDefinitionSource中设定的用户权限信息。首先，objectDefinitionSource中定义了讉KURL需要的属性信?q里的属性信息仅仅是标志Q告诉accessDecisionManager要用哪些voter来投?。然后，authenticationManager掉用自己的provider来对用户的认证信息进行校验。最后，有投者根据用h有认证和讉Kurl需要的属性，调用自己的voter来投，军_是否允许讉K?/p> <pre>    <bean id="filterInvocationInterceptor" class="org.acegisecurity.intercept.web.FilterSecurityInterceptor"><br />        <property name="authenticationManager" ref="authenticationManager"/><br />        <property name="accessDecisionManager" ref="httpRequestAccessDecisionManager"/><br />        <property name="objectDefinitionSource" ref="filterDefinitionSource"/><br />    </bean></pre> <p> <br />7) <strong>filterDefinitionSource </strong>(详见 <a >2.6.3 资源权限定义扩展</a>)<br />　　自定义DBFilterInvocationDefinitionSource从数据库和cache中读取保护资源及光要的讉K权限信息 </p> <pre><bean id="filterDefinitionSource" class="org.springside.modules.security.service.acegi.DBFilterInvocationDefinitionSource"><br />        <property name="convertUrlToLowercaseBeforeComparison" value="true"/><br />        <property name="useAntPath" value="true"/><br />        <property name="acegiCacheManager" ref="acegiCacheManager"/><br /></bean></pre> <h2>2.2.4 Ҏ调用安全控制</h2> <p>(详见 <a >2.6.3 资源权限定义扩展</a>)</p> <p>1) methodSecurityInterceptor<br />　　在执行方法前q行拦截Q检查用h限信?br />2) methodDefinitionSource<br />　　自定义MethodDefinitionSource从cache中读取权?/p> <pre>   <bean id="methodSecurityInterceptor" class="org.acegisecurity.intercept.method.aopalliance.MethodSecurityInterceptor"><br />        <property name="authenticationManager" ref="authenticationManager"/><br />        <property name="accessDecisionManager" ref="httpRequestAccessDecisionManager"/><br />        <property name="objectDefinitionSource" ref="methodDefinitionSource"/><br />    </bean><br />    <bean id="methodDefinitionSource" class="org.springside.modules.security.service.acegi.DBMethodDefinitionSource"><br />        <property name="acegiCacheManager" ref="acegiCacheManager"/><br />    </bean></pre> <h2>2.3 Jcaptcha验证?/h2> <p>采用 <a >http://jcaptcha.sourceforge.net</a> 作ؓ通用的验证码ҎQ请参考SpringSide中的例子Q或|上的：<br /><a >http://www.coachthrasher.com/page/blog?entry=jcaptcha_with_appfuse</a>?/p> <p>差沙在此q程中又发现acegi logout filter的错误，q行了修正?/p> <p>另外它默认提供的囄比较难认Q我们custom了一个美观一点的版本?/p> <img src ="http://www.aygfsteel.com/tomato2088/aggbug/97642.html" width = "1" height = "1" /><br><br><div align=right><a style="text-decoration:none;" href="http://www.aygfsteel.com/tomato2088/" target="_blank">西红柿（tomatoQ?/a> 2007-02-02 20:31 <a href="http://www.aygfsteel.com/tomato2088/archive/2007/02/02/97642.html#Feedback" target="_blank" style="text-decoration:none;">发表评论</a></div>]]></description></item><item><title>转：CAS及客LAcegi的安装配|指?http://www.aygfsteel.com/tomato2088/archive/2007/02/02/97639.html西红柿（tomatoQ?/dc:creator>西红柿（tomatoQ?/author>Fri, 02 Feb 2007 12:28:00 GMThttp://www.aygfsteel.com/tomato2088/archive/2007/02/02/97639.htmlhttp://www.aygfsteel.com/tomato2088/comments/97639.htmlhttp://www.aygfsteel.com/tomato2088/archive/2007/02/02/97639.html#Feedback0http://www.aygfsteel.com/tomato2088/comments/commentRss/97639.htmlhttp://www.aygfsteel.com/tomato2088/services/trackbacks/97639.html阅读全文

]]>Acegi1.0.3 + Spring2.0.1 + Hibernate3.2 _解Demo http://www.aygfsteel.com/tomato2088/archive/2006/12/11/86862.html西红柿（tomatoQ?/dc:creator>西红柿（tomatoQ?/author>Mon, 11 Dec 2006 04:21:00 GMThttp://www.aygfsteel.com/tomato2088/archive/2006/12/11/86862.htmlhttp://www.aygfsteel.com/tomato2088/comments/86862.htmlhttp://www.aygfsteel.com/tomato2088/archive/2006/12/11/86862.html#Feedback3http://www.aygfsteel.com/tomato2088/comments/commentRss/86862.htmlhttp://www.aygfsteel.com/tomato2088/services/trackbacks/86862.htmlAcegi1.0.3 使用的是Spring1.2.8
本hl过对Acegi1.0.3 的源代码q行删选，q引入到Spring2.0.1环境下，做了严格的测试?br />
本demo 是 ?Spring2.0.1 + Hibernate3.2 环境下，针对视图层?Struts ?JSF 分别q行了集成，单鲜明描q如何?Acegi1.0.3 q行Z用户角色的动态授权安全控制?/p>

本demo既适合于JSF + Spring2.0.1 + Hibernate3.2 目也适合于Struts + Spring2.0.1 + Hibernate3.2目Q?br />
未列入特别说明没有授权的企业和个人都可以自由免费下蝲使用提供宝贵意见Q?br />
本h不急功q利Q正在做完整的文档编写，做最后严格的试Q近期在此免费发布，敬请xQ?/p>

]]>AcegiQhibernate 动态实现基于角色的权限理http://www.aygfsteel.com/tomato2088/archive/2006/12/03/85190.html西红柿（tomatoQ?/dc:creator>西红柿（tomatoQ?/author>Sun, 03 Dec 2006 08:04:00 GMThttp://www.aygfsteel.com/tomato2088/archive/2006/12/03/85190.htmlhttp://www.aygfsteel.com/tomato2088/comments/85190.htmlhttp://www.aygfsteel.com/tomato2088/archive/2006/12/03/85190.html#Feedback1http://www.aygfsteel.com/tomato2088/comments/commentRss/85190.htmlhttp://www.aygfsteel.com/tomato2088/services/trackbacks/85190.html阅读全文

]]> վ֩ģ壺 | | | «Ϫ| 캵| Т| | | ƽ| ɳ| | | ɿ| | | | Ϫ| ᰸| | ƽ| | Ҷ| ԭ| | Ҷ| | | | | | ͨɽ| | ϰˮ| | | | 廪| | | ʡ| ³ľ|