spring安全框架Security（二） 转

<security:authentication-manager>  
     <security:authentication-provider user-service-ref="customUserDetailsService">  
         <security:password-encoder ref="passwordEncoder" />  
     </security:authentication-provider>  
</security:authentication-manager>  
  
    <!-- 对密码进行MD5编码 -->  
<bean id="passwordEncoder" class="org.springframework.security.authentication.encoding.Md5PasswordEncoder" />  
<bean id="customUserDetailsService" class="org.yzsoft.springmvcdemo.util.CustomUserDetailsService" />

package org.yzsoft.springmvcdemo.util;  
  
import java.util.ArrayList;  
import java.util.Collection;  
import java.util.List;  
  
import org.apache.log4j.Logger;  
import org.springframework.beans.factory.annotation.Autowired;  
import org.springframework.dao.DataAccessException;  
import org.springframework.security.core.GrantedAuthority;  
import org.springframework.security.core.authority.GrantedAuthorityImpl;  
import org.springframework.security.core.userdetails.User;  
import org.springframework.security.core.userdetails.UserDetails;  
import org.springframework.security.core.userdetails.UserDetailsService;  
import org.springframework.security.core.userdetails.UsernameNotFoundException;  
import org.yzsoft.springmvcdemo.serviceimpl.UsersServiceImpl;  
import org.yzsoft.springmvcdemo.vo.TUsers;  
  
/** 
 * 一个自定义的类用来和数据库进行操作. 即以后我们要通过数据库保存权限.则需要我们继承UserDetailsService 
 *  
 * @author  
 *  
 */  
public class CustomUserDetailsService implements UserDetailsService {  
  
    protected static Logger logger = Logger.getLogger("service");//log4j，不用解释了吧。。  
    @Autowired  
    private UsersServiceImpl usersService;  
  
    public UsersServiceImpl getUsersService() {  
        return usersService;  
    }  
  
    public void setUsersService(UsersServiceImpl usersService) {  
        this.usersService = usersService;  
    }  
  
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException, DataAccessException {  
  
        UserDetails user = null;  
  
        try {  
  
            // 搜索数据库以匹配用户登录名.  
            // 我们可以通过dao使用Hibernate来访问数据库  
            System.out.println(username + "   用户页面输入的用户名");  
            TUsers tusers = this.usersService.findByUsername(username);  
            System.out.println(tusers.getUsername() + "   数据库取出的用户名");  
            // Populate the Spring User object with details from the dbUser  
            // Here we just pass the username, password, and access level  
            // getAuthorities() will translate the access level to the correct  
            // role type  
            // 用户名、密码、是否启用、是否被锁定、是否过期、权限  
            user = new User(tusers.getUsername(), tusers.getPassword().toLowerCase(), true, true, true, true, getAuthorities(Integer.parseInt(tusers.getRole())));  
               
               
        } catch (Exception e) {  
            logger.error("用户信息错误！");  
            throw new UsernameNotFoundException("异常处理：检索用户信息未通过！");  
        }  
           
        return user;  
    }  
  
    /** 
     * 获得访问角色权限列表 
     *  
     * @param access 
     * @return 
     */  
    public Collection<GrantedAuthority> getAuthorities(Integer role) {  
        System.out.println("取得的权限是  :" + role);  
        List<GrantedAuthority> authList = new ArrayList<GrantedAuthority>();  
  
        // 所有的用户默认拥有ROLE_USER权限  
        if (role == 0) {  
            System.out.println("普通用户");  
            logger.debug("取得普通用户权限-->");  
            authList.add(new GrantedAuthorityImpl("ROLE_USERS"));  
        }  
        // 如果参数role为1.则拥有ROLE_ADMIN权限  
        if (role == 1) {  
            logger.debug("取得ADMIN用户权限-->");  
            authList.add(new GrantedAuthorityImpl("ROLE_ADMIN"));  
        }  
        System.out.println(authList.size()+"  权限列表长度");  
        return authList;  
    }  
}

TUsers tusers = this.usersService.findByUsername(username);  
user = new User(tusers.getUsername(), tusers.getPassword().toLowerCase(), true, true, true, true, getAuthorities(Integer.parseInt(tusers.getRole())));

<%@ page language="java" import="java.util.*" pageEncoding="UTF-8"%>  
<%  
String path = request.getContextPath();  
String basePath = request.getScheme()+"://"+request.getServerName()+":"+request.getServerPort()+path+"/";  
%>  
  
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">  
<html>  
  <head>  
    <base href="<%=basePath%>">  
      
    <title>My JSP 'index.jsp' starting page</title>  
    <meta http-equiv="pragma" content="no-cache">  
    <meta http-equiv="cache-control" content="no-cache">  
    <meta http-equiv="expires" content="0">      
    <meta http-equiv="keywords" content="keyword1,keyword2,keyword3">  
    <meta http-equiv="description" content="This is my page">   
  </head>  
    
  <body>  
    用户登陆 <br>  
     ${SPRING_SECURITY_LAST_EXCEPTION.message}  
      <form action="j_spring_security_check" method="post">  
        USERNAME:<input type="text" name="j_username" value="${sessionScope['SPRING_SECURITY_LAST_USERNAME']}" /><br/>  
        PASSWORD:<input type="password" name="j_password" value="" /><br/>  
        <input type="checkbox" name="_spring_security_remember_me" />两周之内不必登陆(这个功能没有做的)<br/>  
        <input type="submit">       
    </form>  
  </body>  
</html>