Use Acegi to add a lock for your Spring application!

[Introduction]

For a typical web application, perfect authentication and authorization mechanisms are essential, in SpringFramework, the sample jpetstore provided by Juergen Hoeller gives some introductions, but far is not enough, Acegi is a specialized for SpringFramework Projects of the security mechanism, all called Acegi Security System for Spring, the current version is 0.5.1, and the functionality that is currently available should meet the needs of most applications. The main purpose of this article is to explain how to use Acegi in a Spring architecture, rather than detail each interface, each class. Note that even if the Spring application already exists, you can immediately enjoy the authentication and authorization provided by ACEGI immediately.

[basic work]

Add acegi-security.jar in the Acegi Download Pack in the LIB of your web application.

[Web.xml]

The most common way to achieve authentication and authorization is through Filter, Acegi is also the case, usually Acegi needs to add the following five filters to Web.xml:

acegi channel processing filter net.sf.acegisecurity.util.FiltertobeAnProxy targetclass < / param-name> net.sf.acegisecurity.securechannel.ChannelProcessingFilter Acegi Authentication Processing filter net.sf.acegisecurity.util.FilTerTobeAnProxy targetclass net.sf.acegisecurity .ui.webapp.authenticationProcessingFilter acegi http Basic Authorization filter net.sf. acegisecurity.util.FilterToBeanProxy targetClass net.sf.acegisecurity.ui.basicauth.BasicProcessingFilter acegi security system for Spring Auto Integration Filter net.sf.acegisecurity.ui.AutoIntegrationFilter Acegi HTTP Request Security Filter net.sf.acegisecurity.util.FilTertobeAnProxy targetclass net.sf.acegisecurity.intercept .web.securityenforcementfilter <

/ Filter> The first cause of confusion is net.sf.acegisecurity.util.FilterToBeanProxy, on Acegi own document explains that:. "What FilterToBeanProxy does is delegate the Filter's methods through to a bean which is obtained from the Spring application context This Enables the bean to benefit from the Spring Application Context Lifecy. ", if you want to study, go see the source code should not understand. Then add filter-mapping: acegi channel processing filter / * acegi authentication processing filter / * acegi http Basic Authorization filter / * acegi security system for Spring Auto Integration Filter / * acegi http request security filter / * Here you need to pay attention to the following two points: 1) These Filter's order cannot be changed, the order is not working properly; 2) If your application does not require secure transmission, such as HTTPS, then release the "Acegi Channel Processing Filter" can be released. can.

[ApplicationContext.xml] The next thing to add ApplicationContext.xml, from the explanation of FilTerTobeanFactory, you can see that true Filter is managed in Spring ApplicationContext: 1) First, you must have saved users in your database. Name and password Table, Acegi requires Table's schema must be as follows: Create Table Users (Username Varchar (50) Not Null Primary Key, Password VARCHAR (50) Not Null; Create Table Authorities (Username Varchar (50) NOT NULL, authority VARCHAR (50) NOT NULL); CREATE UNIQUE INDEX ix_auth_username ON authorities (username, authority); ALTER TABLE authorities ADD CONSTRAINT fk_authorities_users foreign key (username) REFERENCES users (username); 2) add access datasource your database and the Acegi jdbcDao, as follows: $ {jdbc.driverClassName} < / Property> $ {jdbc.url} $ {jdbc.username} < / Property> $ {jdbc.password} 3) Add daoAuthenticationProvider:

/> 5 If you need to encrypt your password, add: , Acegi provides several encryption methods, detailed information, net.sf.acegisecurity.providers.Encoding4) Add AuthenticationManager: 5) Add AccessDecisionManager: < bean id = "accessDecisionManager" class = "net.sf.acegisecurity.vote.AffirmativeBased"> false 6) Add authenticationProcessingFilterEntryPoint: /acegilogin.jsp

false where Acegilogin.jsp is the login page, a simplest login page as follows: <% @ Taglib prefix = 'c' uri = 'http://java.sun.com/jstl/core'%> <% @ page import = "Net.sf.acegisecurity.ui.abstractProcessingFilter"%> <% @ page import = "NET. sf.acegiseircurity.authenticationException "%>