内容摘要：在本文中, 使用了基于组的权限管理, 并在Spring框架下利用HandlerInterceptorAdapter和Hibernate进行实现。
一切的身份验证交给一个继承HandlerInterceptorAdapter的类来做:
import org.springframework.web.servlet.handler.HandlerInterceptorAdapter;
import org.springframework.web.util.UrlPathHelper;
import org.springframework.util.AntPathMatcher;
import org.springframework.util.PathMatcher;
...
public class AuthorizeInterceptor extends HandlerInterceptorAdapter {
private UrlPathHelper urlPathHelper = new UrlPathHelper();
private PathMatcher pathMatcher = new AntPathMatcher();
private Properties groupMappings;
/** * Attach URL paths to group. */
public void setGroupMappings(Properties groupMappings) {
this.groupMappings = groupMappings;
}
public boolean preHandle(HttpServletRequest request, HttpServletResponse response,
Object handler) throws Exception {
String url = urlPathHelper.getLookupPathForRequest(request);
String group = lookupGroup(url);
// 找出资源所需要的权限, 即组名
if(group == null){
// 所请求的资源不需要保护.
return true;
}
// 如果已经登录, 一个User实例被保存在session中.
User loginUser = (User)request.getSession().getAttribute("loginUser");
ModelAndView mav = new ModelAndView("system/authorizeError");
if(loginUser == null){
mav.addObject("errorMsg", "你还没有登录!");
throw new ModelAndViewDefiningException(mav);
}else{
if(!loginUser.getGroups().contains(group)){
mav.addObject("errorMsg", "授权失败! 你不在 ＜b＞" + group + "＜/b＞ 组!");
throw new ModelAndViewDefiningException(mav);
} return true;
}
}
/* * 查看
org.springframework.web.servlet.handler.AbstractUrlHandlerMapping.lookupHandler()
* Ant模式的最长子串匹配法.
*/
private String lookupGroup(String url){
String group = groupMappings.getProperty(url);
if (group == null) {
String bestPathMatch = null;
for (Iterator it = this.groupMappings.keySet().iterator();it.hasNext();) {
String registeredPath = (String) it.next();
if (this.pathMatcher.match(registeredPath, url) && (bestPathMatch == null ||
bestPathMatch.length() ＜= registeredPath.length())) {
group = this.groupMappings.getProperty(registeredPath);
bestPathMatch = registeredPath;
}
}
}
return group;
}
}下面我们需要在Spring的应用上下文配置文件中设置:
＜bean id="authorizeInterceptor" class="net.ideawu.AuthorizeInterceptor"＞
＜property name="groupMappings"＞
＜value＞
＜!-- Attach URL paths to group --＞
/admin/*=admin
＜/value＞
＜/property＞
＜/bean＞
＜bean id="simpleUrlHandlerMapping"
class="org.springframework.web.servlet.handler.SimpleUrlHandlerMapping"＞
＜property name="interceptors"＞
＜list＞
＜ref bean="authorizeInterceptor" /＞ ＜/list＞
＜/property＞
＜property name="mappings"＞
＜value＞
/index.do=indexController /browse.do=browseController /admin/
removeArticle.do=removeArticleController
＜/value＞
＜/property＞
＜/bean＞注意到"/admin/*=admin", 所以/admin目录下的所有资源只有在admin组的用户才能访问, 这样就不用担心普通访客删除文章了。使用这种方法, 你不需要在removeArticleController中作身份验证和权限管理, 一切都交给AuthorizeInterceptor。
责编：豆豆技术应用
正在加载评论...