springsecurity+oauth2+springmvc+hibernate

最近整理的 基础框架在此备忘：

附上次配置的源码：

git:https://github.com/izhbg/typz

code:https://code.csdn.net/cai_chinasoft/typz/tree/master

一、springsecurity的xml配置

<!-- spring security 配置 -->
<security:http auto-config="true" create-session="never" use-expressions="true" access-denied-page="/common/403.jsp" >
<!-- 不要过滤图片等静态资源 -->
<security:intercept-url pattern="/**/*.jpg" access="permitAll"/>
<security:intercept-url pattern="/**/*.png" access="permitAll"/>
<security:intercept-url pattern="/**/*.gif" access="permitAll"/>
<security:intercept-url pattern="/**/*.css" access="permitAll"/>
<security:intercept-url pattern="/**/*.js" access="permitAll"/>

<security:intercept-url pattern="/common/401.jsp" access="permitAll"/>
<security:intercept-url pattern="/common/403.jsp" access="permitAll"/>
<security:intercept-url pattern="/common/404.jsp" access="permitAll"/>
<security:intercept-url pattern="/common/500.jsp" access="permitAll"/>
<!-- 登录页面和忘记密码页面不过滤 -->
<security:intercept-url pattern="/auth/login.izhbg" access="permitAll"/>
<!-- 登录配置 -->
<security:form-login
login-page="/auth/login.izhbg"
authentication-failure-url="/auth/login.izhbg?error=true"
authentication-success-handler-ref="authenticationSuccessHandler"/>
<!-- 退出配置 -->
<security:logout
invalidate-session="true"
logout-success-url="/auth/login.izhbg"
logout-url="/auth/logout.izhbg"/>

<!-- "记住我"功能，采用持久化策略（将用户的登录信息存放在数据库表中） -->
<security:remember-me data-source-ref="dataSource"
token-validity-seconds="1209600"
remember-me-parameter="remember-me" user-service-ref="customUserDetailsService"/>

<!-- session处理 -->
<security:session-management session-authentication-strategy-ref="concurrentSessionControlStrategy" invalid-session-url="/auth/login.izhbg" session-authentication-error-url="/auth/login.izhbg" />

<!-- 增加一个自定义的filter，放在FILTER_SECURITY_INTERCEPTOR之前， 实现用户、角色、权限、资源的数据库管理。 -->
<security:custom-filter ref="filterSecurityInterceptor" before="FILTER_SECURITY_INTERCEPTOR"/>

<security:custom-filter ref="concurrencyFilter" position="CONCURRENT_SESSION_FILTER"/>

</security:http>二、springsecurity中涉及自定义和相关引用的配置
<bean id="authenticationSuccessHandler" class="com.izhbg.typz.sso.security.handler.SimpleLoginSuccessHandler">
<property name="defaultTargetUrl" value="/main/common.izhbg"></property>
<property name="forwardToDestination" value="false"></property>
</bean>
<!-- 一个自定义的filter，必须包含authenticationManager, accessDecisionManager,securityMetadataSource三个属性。 -->
<bean id="filterSecurityInterceptor" class="com.izhbg.typz.sso.security.MyFilterSecurityInterceptor">
<property name="authenticationManager" ref="authenticationManager"/>
<property name="accessDecisionManager" ref="myAccessDecisionManager"/>
<property name="securityMetadataSource" ref="mySecurityMetadataSource"/>
</bean>
<bean id="myAccessDecisionManager" class="com.izhbg.typz.sso.security.MyAccessDecisionManager"/>
<bean id="mySecurityMetadataSource" class="com.izhbg.typz.sso.security.service.MyInvocationSecurityMetadataSourceService"/>

<!-- 指定一个自定义的authentication-manager :customUserDetailsService -->
<security:authentication-manager alias="authenticationManager">
<security:authentication-provider user-service-ref="customUserDetailsService">
<security:password-encoder ref="passwordEncoder">
<!-- <security:salt-source user-property="username"/> 盐值-->
</security:password-encoder>
</security:authentication-provider>
</security:authentication-manager>
<!-- 从数据库加载UserDetails的UserDetailsService -->
<bean id="customUserDetailsService" class="com.izhbg.typz.sso.security.service.CustomUserDetailsService">
<property name="userCache" ref="userCache"/>
</bean>
<!-- 密码加密器 -->
<bean id="passwordEncoder" class="com.izhbg.typz.sso.util.PasswordEncoderFactoryBean">
<property name="type" value="${security.passwordencoder.type}"/>
<property name="salt" value="${security.passwordencoder.salt}"/><!-- 盐值 -->
</bean>
<!-- 又一个密码加密器？ -->
<bean id="customPasswordEncoder" factory-bean="&passwordEncoder" factory-method="getCustomPasswordEncoder"/>

<!-- session 处理 -->
<bean id="concurrentSessionControlStrategy"
class="org.springframework.security.web.authentication.session.ConcurrentSessionControlStrategy">
<constructor-arg name="sessionRegistry" ref="sessionRegistry" />
<property name="maximumSessions" value="1"></property>
</bean>

<bean id="sessionRegistry" class="org.springframework.security.core.session.SessionRegistryImpl" />
<bean id="concurrencyFilter" class="org.springframework.security.web.session.ConcurrentSessionFilter">
<constructor-arg name="sessionRegistry" ref="sessionRegistry" />
<constructor-arg name="expiredUrl" value="/sessionOut.jsp" />
</bean>
<!-- 启用用户的缓存功能 -->
<bean id="userCache"
class="org.springframework.security.core.userdetails.cache.EhCacheBasedUserCache">
<property name="cache" ref="userEhCache" />
</bean>

<bean id="userEhCache" class="org.springframework.cache.ehcache.EhCacheFactoryBean">
<property name="cacheName" value="userCache" />
<property name="cacheManager" ref="cacheManager" />
</bean>

<bean id="cacheManager"
class="org.springframework.cache.ehcache.EhCacheManagerFactoryBean" />

<!-- spring security自带的与权限有关的数据读写Jdbc模板 -->
<bean id="jdbcTemplate" class="org.springframework.jdbc.core.JdbcTemplate">
<property name="dataSource" ref="dataSource" />
</bean>

三、oauth2的xml配置
<security:http pattern="/oauth/token" create-session="stateless" authentication-manager-ref="oauth2AuthenticationManager"
entry-point-ref="oauth2AuthenticationEntryPoint" use-expressions="true">
<!-- <security:intercept-url pattern="/oauth/token" access="IS_AUTHENTICATED_FULLY"/> -->
<security:anonymous enabled="false"/>
<security:http-basic entry-point-ref="oauth2AuthenticationEntryPoint"/>
<security:custom-filter ref="clientCredentialsTokenEndpointFilter" before="BASIC_AUTH_FILTER"/>
<security:access-denied-handler ref="oauth2AccessDeniedHandler"/>
</security:http> 四、oauth2 自定义以及相关引用的配置
<security:authentication-manager id="oauth2AuthenticationManager">
<security:authentication-provider user-service-ref="customUserDetailsService"/>
</security:authentication-manager>
<!-- <bean id="oauth2ClientDetailsUserService"
class="org.springframework.security.oauth2.provider.client.ClientDetailsUserDetailsService">
<constructor-arg ref="clientDetailsService"/>
</bean> -->
<bean id="clientDetailsService" class="com.izhbg.typz.sso.auth2.service.CustomJdbcClientDetailsService">
<constructor-arg index="0" ref="dataSource"/>
</bean>
<bean id="oauth2AuthenticationEntryPoint"
class="org.springframework.security.oauth2.provider.error.OAuth2AuthenticationEntryPoint"/>

<bean id="clientCredentialsTokenEndpointFilter"
class="org.springframework.security.oauth2.provider.client.ClientCredentialsTokenEndpointFilter">
<property name="authenticationManager" ref="oauth2AuthenticationManager"/>
</bean>
<bean id="oauth2AccessDeniedHandler"
class="org.springframework.security.oauth2.provider.error.OAuth2AccessDeniedHandler"/>
<bean id="tokenStore" class="org.springframework.security.oauth2.provider.token.store.JdbcTokenStore">
<constructor-arg index="0" ref="dataSource"/>
</bean>
<bean id="tokenServices" class="org.springframework.security.oauth2.provider.token.DefaultTokenServices">
<property name="tokenStore" ref="tokenStore"/>
<property name="clientDetailsService" ref="clientDetailsService"/>
<property name="supportRefreshToken" value="true"/>
</bean>
<bean class="org.springframework.security.oauth2.provider.request.DefaultOAuth2RequestFactory"
id="oAuth2RequestFactory">
<constructor-arg name="clientDetailsService" ref="clientDetailsService"/>
</bean>
<bean id="oauthUserApprovalHandler" class="com.izhbg.typz.sso.auth2.OauthUserApprovalHandler">
<property name="tokenStore" ref="tokenStore"/>
<property name="clientDetailsService" ref="clientDetailsService"/>
<property name="requestFactory" ref="oAuth2RequestFactory"/>
<property name="oauthService" ref="oauthService"/>
</bean>
<bean id="jdbcAuthorizationCodeServices"
class="org.springframework.security.oauth2.provider.code.JdbcAuthorizationCodeServices">
<constructor-arg index="0" ref="dataSource"/>
</bean>
<bean id="oauth2AccessDecisionManager" class="org.springframework.security.access.vote.UnanimousBased">
<constructor-arg>
<list>
<bean class="org.springframework.security.oauth2.provider.vote.ScopeVoter"/>
<bean class="org.springframework.security.access.vote.RoleVoter"/>
<bean class="org.springframework.security.access.vote.AuthenticatedVoter"/>
</list>
</constructor-arg>
</bean>
<oauth2:resource-server id="mobileResourceServer" resource-id="mobile-resource" token-services-ref="tokenServices"/>
<oauth2:authorization-server client-details-service-ref="clientDetailsService" token-services-ref="tokenServices"
user-approval-handler-ref="oauthUserApprovalHandler"
user-approval-page="oauth_approval"
error-page="oauth_error">
<oauth2:authorization-code authorization-code-services-ref="jdbcAuthorizationCodeServices"/>
<oauth2:implicit/>
<oauth2:refresh-token/>
<oauth2:client-credentials/>
<oauth2:password/>
</oauth2:authorization-server>

五、配置需要oauth2验证的资源
<!--mobile http configuration-->
<security:http pattern="/m/**" create-session="never" entry-point-ref="oauth2AuthenticationEntryPoint"
access-decision-manager-ref="oauth2AccessDecisionManager" use-expressions="true">
<security:anonymous enabled="false"/>

<!-- <security:intercept-url pattern="/m/**" access="ROLE_MOBILE,SCOPE_READ"/> -->
<security:custom-filter ref="filterSecurityInterceptor" before="FILTER_SECURITY_INTERCEPTOR"/>
<security:custom-filter ref="concurrencyFilter" position="CONCURRENT_SESSION_FILTER"/>

<security:custom-filter ref="mobileResourceServer" before="PRE_AUTH_FILTER"/>
<security:access-denied-handler ref="oauth2AccessDeniedHandler"/>
</security:http>源码 详见：

git:https://github.com/izhbg/typz

code:https://code.csdn.net/cai_chinasoft/typz/tree/master