spring安全性中的Ajax

使用spring security+JSF+primefaces
在自定义登录中，我放了一个命令按钮
但是命令按钮不起作用…
当在p:命令按钮 ----------> ajax = "假 " ---------> 是工作!
当使用f:ajax在jsf(core) --------> no work
我在spring中使用security。xml文件:

test.xhtml ----> jsf(核心 ) --------> 没有工作

 <?xml version="1.0" encoding="UTF-8"?>
    <!DOCTYPE html
            PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
            "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
    <html xmlns="http://www.w3.org/1999/xhtml" xmlns:h="http://java.sun.com/jsf/html" xmlns:f="http://java.sun.com/jsf/core"
          xml:lang="en" lang="en">
    <head>
        <title>faces-request</title>           
    </head>
    <body>
    <h:form>
        <center>
            <h:outputText id="outtxt" value="#{authentiocationBean.ajaxTest}"/><br/>
            <h:inputText id="intxt" value="#{authentiocationBean.ajaxTest}"/><br/>
            <h:commandButton value="Submit">
                <f:ajax execute="intxt" render="outtxt"/>
            </h:commandButton>        
        </center>
    </h:form>
    </body>
    </html>

Spring_security.xml:

<beans:beans xmlns="http://www.springframework.org/schema/security"
             xmlns:beans="http://www.springframework.org/schema/beans"
             xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
             xsi:schemaLocation="http://www.springframework.org/schema/beans
    http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
    http://www.springframework.org/schema/security
    http://www.springframework.org/schema/security/spring-security-3.2.xsd">

    <http auto-config="true" use-expressions="true">
        <intercept-url pattern="/Admin/*" access="hasRole('ROLE_ADMIN')"/>
        <intercept-url pattern="/user/*" access="hasAnyRole('ROLE_USER,ROLE_ADMIN')"/>           
        <form-login login-page="/login.xhtml"
                    authentication-failure-url="/Fail.xhtml?error"/>
        <logout logout-url="/j_spring_security_logout" delete-cookies="JSESSIONID,SPRING_SECURITY_REMEMBER_ME_COOKIE"
                invalidate-session="true"
                logout-success-url="/login.xhtml"/>
        <session-management session-authentication-error-url="/401.xhtml" session-fixation-protection="migrateSession">
            <concurrency-control max-sessions="1" expired-url="/login.xhtml"/>
        </session-management>
        <remember-me key="myAppKey"/>
        <access-denied-handler error-page="/AccDe.xhtml"/>
        <headers>
            <xss-protection/>
            <frame-options/>
            <cache-control/>
            <content-type-options/>
        </headers>
        <csrf/>
    </http>
    <authentication-manager alias="authenticationManager">
        <authentication-provider>
            <jdbc-user-service data-source-ref="myDataSource"
                               users-by-username-query="select username, password, active from users where username=?"
                               authorities-by-username-query="select us.username, ur.authority from users us, user_roles ur
                    where us.user_id = ur.user_id and us.username =?  "
                    />
            <password-encoder ref="passwordEncoder" hash="sha-256"/>
        </authentication-provider>
    </authentication-manager>

    <bean id="passwordEncoder"
          xmlns="http://www.springframework.org/schema/beans"
          class="org.springframework.security.authentication.encoding.ShaPasswordEncoder">
        <!--org.springframework.security.crypto.password.PasswordEncoder       for salt!-->
        <constructor-arg value="256"/>
    </bean>

</beans:beans>

LoginPage:

<?xml version='1.0' encoding='UTF-8' ?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
        "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:h="http://java.sun.com/jsf/html"
      xmlns:p="http://primefaces.org/ui">
<h:head>
    <title>faces-request</title>     
</h:head>
<h:body>
    <h:form prependId="false" id="formLogin">
        <center>
            <p:panelGrid style="border-width: 0px;" columns="2">
                UserName:
                <p:inputText required="true" id="j_username"/>
                Password:
                <p:password required="true" id="j_password"/>
            </p:panelGrid>               
            <p:commandButton type="submit" id="login" action="#{authentiocationBean.doLogin()}" value="Login"/>
            <p:outputLabel for="_spring_security_remember_me" value="Remember me: "/>
            <p:selectBooleanCheckbox id="_spring_security_remember_me"/>
            <br/>
        </center>
    </h:form>
</h:body>
</html>

<<p> AuthentiocationBean类/strong>
import org.springframework.security.core.Authentication; import org.springframework.security.core.context.SecurityContextHolder; import java.io.IOException; import javax.faces.bean.ManagedBean; import javax.faces.bean.RequestScoped; import javax.faces.context.ExternalContext; import javax.faces.context.FacesContext; import javax.servlet.RequestDispatcher; import javax.servlet.ServletException; import javax.servlet.ServletRequest; import javax.servlet.ServletResponse; import javax.servlet.http.HttpServletRequest; /** * @author Admin */ @RequestScoped @ManagedBean public class AuthentiocationBean { public String ajaxTest = "Test"; boolean isLogged = false; public String role = "ROLE_ADMIN"; Authentication auth = SecurityContextHolder.getContext().getAuthentication(); String name = auth.getName(); public String getName() { return name; } public void setName(String name) { this.name = name; } public String doLogin() throws IOException, ServletException { isLogged = true; FacesContext facesContext = FacesContext.getCurrentInstance(); ExternalContext context = facesContext.getExternalContext(); RequestDispatcher dispatcher = ((ServletRequest) context.getRequest()).getRequestDispatcher("/j_spring_security_check"); dispatcher.forward((ServletRequest) context.getRequest(), (ServletResponse) context.getResponse()); FacesContext.getCurrentInstance().responseComplete(); // It's OK to return null here because Faces is just going to exit. return null; } public void doLogout() { // FacesContext.getCurrentInstance().getExternalContext().invalidateSession(); // return "/logout.xhtml"; // return null; } public boolean isLogged() { return isLogged; } public void setLogged(boolean logged) { isLogged = logged; } public String getRole() { return role; } public void setRole(String role) { this.role = role; } public String getAjaxTest() { return ajaxTest; } public void setAjaxTest(String ajaxTest) { this.ajaxTest = ajaxTest; } }
谢谢

这只是一个登录页面，那么为什么要使用AJAX呢?

我已经将Spring 3.1.4 LDAP支持集成到JSF中。虽然我最初编写了一个自定义身份验证bean，但我不再使用它了。我不是专家，我肯定有不同于我实现的方法。

(1) 简单登录页面(摘录):

<h:inputText id="j_username"/> <h:inputText type="password" id="j_password" value=""/> <h:commandButton name="submit" type="submit" value="Log In" /> <input type="reset" value="Reset" />

(2.1)在web.xml中，我声明了一个上下文参数来命名安全配置文件(在下面的步骤3中提到)。
我还声明了Spring安全过滤器链，您可以在这里阅读:http://docs.spring.io/spring-security/site/docs/3.1.4.RELEASE/reference/security-filter-chain.html filter-chains-with-ns

(2.2)在faces-config中声明:<el-resolver>org.springframework.web.jsf.el.SpringBeanFacesELResolver</el-resolver>

(2.3)在faces-config中，我声明了一个具有会话范围的自定义UserSession bean。
UserSession bean有这个方法:

@PostConstruct  
public void loadAuthorities() {
    Authentication auth = SecurityContextHolder.getContext().getAuthentication();
    . . .
    . . .
}

(3) UserSession bean从登陆页(menu.xhtml)中引用，这是在我的安全配置文件中声明的(在上面的步骤2.1中在web.xml中声明):

<security:form-login default-target-url="/menu.xhtml" always-use-default-target="true"     authentication-failure-url="/denied.xhtml" />                
<security:logout invalidate-session="true" delete-cookies="JSESSIONID" logout-url="/j_spring_security_logout" />

(4)用户被认证，然后重定向到menu.xhtmlxhtml导致UserSession bean加载。

UserSession bean从SecurityContext中提取一个权限列表。

UserSession bean提供了简单的包装器来检查用户是否有权限查看页面和资源:

public boolean isRole(String role) {
    return authorities.contains((String) role);
}
public boolean roleContains(String s);
public boolean roleEndsWith(String s);
. . .
. . .

相关内容

最新更新

热门标签：