>

1. <custom-filter before="FILTER_SECURITY_INTERCEPTOR" ref="securityInterceptor"/>

<custom-filter before="FILTER_SECURITY_INTERCEPTOR" ref="securityInterceptor"/>

1. <!--     自定义拦截器 -->
2. <beans:bean id="securityInterceptor" class="com.ultrapower.me.util.security.interceptor.SecurityInterceptor">
3. <beans:property name="authenticationManager" ref="authenticationManager"/>
4. <beans:property name="accessDecisionManager" ref="mesecurityAccessDecisionManager"/>
5. <beans:property name="securityMetadataSource" ref="secureResourceFilterInvocationDefinitionSource" />
6. </beans:bean>
7. <!--     获取访问url对应的所有权限 -->
8. <beans:bean id="secureResourceFilterInvocationDefinitionSource" class="com.ultrapower.me.util.security.interceptor.SecureResourceFilterInvocationDefinitionSource" />
9. <!--     校验用户的权限是否足够 -->
10. <beans:bean id="mesecurityAccessDecisionManager" class="com.ultrapower.me.util.security.interceptor.SecurityAccessDecisionManager" />

<!-- 	自定义拦截器 -->

	<beans:bean id="securityInterceptor" class="com.ultrapower.me.util.security.interceptor.SecurityInterceptor">

		<beans:property name="authenticationManager" ref="authenticationManager"/>

	    <beans:property name="accessDecisionManager" ref="mesecurityAccessDecisionManager"/>

	    <beans:property name="securityMetadataSource" ref="secureResourceFilterInvocationDefinitionSource" />

	</beans:bean>

<!-- 	获取访问url对应的所有权限 -->

	<beans:bean id="secureResourceFilterInvocationDefinitionSource" class="com.ultrapower.me.util.security.interceptor.SecureResourceFilterInvocationDefinitionSource" />

<!-- 	校验用户的权限是否足够 -->

	<beans:bean id="mesecurityAccessDecisionManager" class="com.ultrapower.me.util.security.interceptor.SecurityAccessDecisionManager" />
	

1. package com.ultrapower.me.util.security.interceptor;
2. import java.io.IOException;
3. import javax.servlet.Filter;
4. import javax.servlet.FilterChain;
5. import javax.servlet.FilterConfig;
6. import javax.servlet.ServletException;
7. import javax.servlet.ServletRequest;
8. import javax.servlet.ServletResponse;
9. import org.springframework.security.access.SecurityMetadataSource;
10. import org.springframework.security.access.intercept.AbstractSecurityInterceptor;
11. import org.springframework.security.access.intercept.InterceptorStatusToken;
12. import org.springframework.security.web.FilterInvocation;
13. import org.springframework.security.web.access.intercept.FilterInvocationSecurityMetadataSource;
14. public class SecurityInterceptor extends AbstractSecurityInterceptor implements Filter{
15. //配置文件注入
16. private FilterInvocationSecurityMetadataSource securityMetadataSource;
17. public FilterInvocationSecurityMetadataSource getSecurityMetadataSource() {
18. return securityMetadataSource;
19. }
20. public void setSecurityMetadataSource(
21. FilterInvocationSecurityMetadataSource securityMetadataSource) {
22. this.securityMetadataSource = securityMetadataSource;
23. }
24. @Override
25. public void doFilter(ServletRequest request, ServletResponse response,
26. FilterChain chain) throws IOException, ServletException {
27. // TODO Auto-generated method stub\
28. FilterInvocation fi = new FilterInvocation(request, response, chain);
29. //fi里面有一个被拦截的url
30. //里面调用MyInvocationSecurityMetadataSource的getAttributes(Object object)这个方法获取fi对应的所有权限
31. //再调用MyAccessDecisionManager的decide方法来校验用户的权限是否足够
32. InterceptorStatusToken token = super.beforeInvocation(fi);
33. try {
34. //执行下一个拦截器
35. fi.getChain().doFilter(fi.getRequest(), fi.getResponse());
36. } finally {
37. super.afterInvocation(token, null);
38. }
39. }
40. @Override
41. public void init(FilterConfig arg0) throws ServletException {
42. // TODO Auto-generated method stub
43. }
44. @Override
45. public Class<?> getSecureObjectClass() {
46. // TODO Auto-generated method stub
47. return FilterInvocation.class;
48. }
49. @Override
50. public SecurityMetadataSource obtainSecurityMetadataSource() {
51. // TODO Auto-generated method stub
52. return this.securityMetadataSource;
53. }
54. @Override
55. public void destroy() {
56. // TODO Auto-generated method stub
57. }
58. }

package com.ultrapower.me.util.security.interceptor;

import java.io.IOException;

import javax.servlet.Filter;


import javax.servlet.FilterChain;


import javax.servlet.FilterConfig;


import javax.servlet.ServletException;


import javax.servlet.ServletRequest;


import javax.servlet.ServletResponse;

import org.springframework.security.access.SecurityMetadataSource;


import org.springframework.security.access.intercept.AbstractSecurityInterceptor;


import org.springframework.security.access.intercept.InterceptorStatusToken;


import org.springframework.security.web.FilterInvocation;


import org.springframework.security.web.access.intercept.FilterInvocationSecurityMetadataSource;

public class SecurityInterceptor extends AbstractSecurityInterceptor implements Filter{
//配置文件注入

private FilterInvocationSecurityMetadataSource securityMetadataSource;

public FilterInvocationSecurityMetadataSource getSecurityMetadataSource() {

	return securityMetadataSource;

}

public void setSecurityMetadataSource(

		FilterInvocationSecurityMetadataSource securityMetadataSource) {

	this.securityMetadataSource = securityMetadataSource;

}

@Override

public void doFilter(ServletRequest request, ServletResponse response,

		FilterChain chain) throws IOException, ServletException {

	// TODO Auto-generated method stub\

	FilterInvocation fi = new FilterInvocation(request, response, chain);

	//fi里面有一个被拦截的url

    //里面调用MyInvocationSecurityMetadataSource的getAttributes(Object object)这个方法获取fi对应的所有权限

    //再调用MyAccessDecisionManager的decide方法来校验用户的权限是否足够

    InterceptorStatusToken token = super.beforeInvocation(fi);

    try {

        //执行下一个拦截器

        fi.getChain().doFilter(fi.getRequest(), fi.getResponse());

    } finally {

        super.afterInvocation(token, null);

    }   

}

@Override

public void init(FilterConfig arg0) throws ServletException {

	// TODO Auto-generated method stub

}

@Override

public Class<?> getSecureObjectClass() {

	// TODO Auto-generated method stub

	return FilterInvocation.class;

}

@Override

public SecurityMetadataSource obtainSecurityMetadataSource() {

	// TODO Auto-generated method stub

	return this.securityMetadataSource;

}

@Override

public void destroy() {

	// TODO Auto-generated method stub

}

}

1. /**
2. *
3. */
4. package com.ultrapower.me.util.security.interceptor;
5. import java.util.ArrayList;
6. import java.util.Collection;
7. import java.util.HashMap;
8. import java.util.Iterator;
9. import java.util.Map;
10. import javax.servlet.ServletContext;
11. import org.springframework.beans.factory.InitializingBean;
12. import org.springframework.security.access.ConfigAttribute;
13. import org.springframework.security.access.SecurityConfig;
14. import org.springframework.security.web.FilterInvocation;
15. import org.springframework.security.web.access.intercept.FilterInvocationSecurityMetadataSource;
16. import org.springframework.util.AntPathMatcher;
17. import org.springframework.util.PathMatcher;
18. public class SecureResourceFilterInvocationDefinitionSource implements FilterInvocationSecurityMetadataSource, InitializingBean {
19. private PathMatcher matcher;
20. private static Map<String, Collection<ConfigAttribute>> map = new HashMap<String, Collection<ConfigAttribute>>();
21. /*
22. * 初始化用户权限，为了简便操作没有从数据库获取
23. * 实际操作可以从数据库中获取所有资源路径url所对应的权限
24. */
25. public void afterPropertiesSet() throws Exception {
26. this.matcher = new AntPathMatcher();//用来匹配访问资源路径
27. Collection<ConfigAttribute> atts = new ArrayList<ConfigAttribute>();
28. ConfigAttribute ca = new SecurityConfig("ROLE_USER");
29. atts.add(ca);
30. map.put("/jsp/index/main.jsp", atts);
31. Collection<ConfigAttribute> attsno =new ArrayList<ConfigAttribute>();
32. ConfigAttribute cano = new SecurityConfig("ROLE_NO");
33. attsno.add(cano);
34. map.put("/http://blog.csdn.net/u012367513/article/details/other.jsp", attsno);
35. }
36. @Override
37. public Collection<ConfigAttribute> getAttributes(Object object)
38. throws IllegalArgumentException {
39. // TODO Auto-generated method stub
40. FilterInvocation filterInvocation = (FilterInvocation) object;
41. String requestURI = filterInvocation.getRequestUrl();
42. //循环资源路径，当访问的Url和资源路径url匹配时，返回该Url所需要的权限
43. for(Iterator<Map.Entry<String, Collection<ConfigAttribute>>> iter = map.entrySet().iterator(); iter.hasNext();) {
44. Map.Entry<String, Collection<ConfigAttribute>> entry = iter.next();
45. String url = entry.getKey();
46. if(matcher.match(url, requestURI)) {
47. return map.get(requestURI);
48. }
49. }
50. return null;
51. }
52. @Override
53. public Collection<ConfigAttribute> getAllConfigAttributes() {
54. // TODO Auto-generated method stub
55. return null;
56. }
57. /* (non-Javadoc)
58. * @see org.springframework.security.intercept.ObjectDefinitionSource#getConfigAttributeDefinitions()
59. */
60. @SuppressWarnings("rawtypes")
61. public Collection getConfigAttributeDefinitions() {
62. return null;
63. }
64. /* (non-Javadoc)
65. * @see org.springframework.security.intercept.ObjectDefinitionSource#supports(java.lang.Class)
66. */
67. public boolean supports(@SuppressWarnings("rawtypes") Class clazz) {
68. return true;
69. }
70. /**
71. *
72. * @param filterInvocation
73. * @return
74. */
75. @SuppressWarnings("unchecked")
76. private Map<String, String> getUrlAuthorities(org.springframework.security.web.FilterInvocation filterInvocation) {
77. ServletContext servletContext = filterInvocation.getHttpRequest().getSession().getServletContext();
78. return (Map<String, String>)servletContext.getAttribute("urlAuthorities");
79. }
80. }

/**

 *

 */

package com.ultrapower.me.util.security.interceptor;

import java.util.ArrayList;


import java.util.Collection;


import java.util.HashMap;


import java.util.Iterator;


import java.util.Map;

import javax.servlet.ServletContext;

import org.springframework.beans.factory.InitializingBean;


import org.springframework.security.access.ConfigAttribute;


import org.springframework.security.access.SecurityConfig;


import org.springframework.security.web.FilterInvocation;


import org.springframework.security.web.access.intercept.FilterInvocationSecurityMetadataSource;


import org.springframework.util.AntPathMatcher;


import org.springframework.util.PathMatcher;

public class SecureResourceFilterInvocationDefinitionSource implements FilterInvocationSecurityMetadataSource, InitializingBean {
private PathMatcher matcher;

private static Map<String, Collection<ConfigAttribute>> map = new HashMap<String, Collection<ConfigAttribute>>();

/*

 * 初始化用户权限，为了简便操作没有从数据库获取

 * 实际操作可以从数据库中获取所有资源路径url所对应的权限

 */

public void afterPropertiesSet() throws Exception {

    this.matcher = new AntPathMatcher();//用来匹配访问资源路径

    Collection<ConfigAttribute> atts = new ArrayList<ConfigAttribute>();

    ConfigAttribute ca = new SecurityConfig("ROLE_USER");

    atts.add(ca);

    map.put("/jsp/index/main.jsp", atts);

    Collection<ConfigAttribute> attsno =new ArrayList<ConfigAttribute>();

    ConfigAttribute cano = new SecurityConfig("ROLE_NO");

    attsno.add(cano);

    map.put("/http://blog.csdn.net/u012367513/article/details/other.jsp", attsno);

}

@Override

public Collection<ConfigAttribute> getAttributes(Object object)

		throws IllegalArgumentException {

	// TODO Auto-generated method stub

	FilterInvocation filterInvocation = (FilterInvocation) object;

	String requestURI = filterInvocation.getRequestUrl();

	//循环资源路径，当访问的Url和资源路径url匹配时，返回该Url所需要的权限

    for(Iterator<Map.Entry<String, Collection<ConfigAttribute>>> iter = map.entrySet().iterator(); iter.hasNext();) {

          Map.Entry<String, Collection<ConfigAttribute>> entry = iter.next();

          String url = entry.getKey();

          if(matcher.match(url, requestURI)) {

              return map.get(requestURI);

          }

    }

	return null;

}

@Override

public Collection<ConfigAttribute> getAllConfigAttributes() {

	// TODO Auto-generated method stub

	return null;

}

/* (non-Javadoc)

 * @see org.springframework.security.intercept.ObjectDefinitionSource#getConfigAttributeDefinitions()

 */

@SuppressWarnings("rawtypes")

public Collection getConfigAttributeDefinitions() {

    return null;

}

/* (non-Javadoc)

 * @see org.springframework.security.intercept.ObjectDefinitionSource#supports(java.lang.Class)

 */

public boolean supports(@SuppressWarnings("rawtypes") Class clazz) {

    return true;

}

/**

 *

 * @param filterInvocation

 * @return

 */

@SuppressWarnings("unchecked")

private Map<String, String> getUrlAuthorities(org.springframework.security.web.FilterInvocation filterInvocation) {

    ServletContext servletContext = filterInvocation.getHttpRequest().getSession().getServletContext();

    return (Map<String, String>)servletContext.getAttribute("urlAuthorities");

}

}

1. package com.ultrapower.me.util.security.interceptor;
2. import java.util.Collection;
3. import java.util.Iterator;
4. import org.springframework.security.access.AccessDecisionManager;
5. import org.springframework.security.access.AccessDeniedException;
6. import org.springframework.security.access.ConfigAttribute;
7. import org.springframework.security.access.SecurityConfig;
8. import org.springframework.security.authentication.InsufficientAuthenticationException;
9. import org.springframework.security.core.Authentication;
10. import org.springframework.security.core.GrantedAuthority;
11. public class SecurityAccessDecisionManager implements AccessDecisionManager {
12. /**
13. * 检查用户是否够权限访问资源
14. * authentication 是从spring的全局缓存SecurityContextHolder中拿到的，里面是用户的权限信息
15. * object 是url
16. * configAttributes 所需的权限
17. * @see org.springframework.security.access.AccessDecisionManager#decide(org.springframework.security.core.Authentication, java.lang.Object, java.util.Collection)
18. */
19. @Override
20. public void decide(Authentication authentication, Object object,
21. Collection<ConfigAttribute> configAttributes)
22. throws AccessDeniedException, InsufficientAuthenticationException {
23. // 对应url没有权限时，直接跳出方法
24. if(configAttributes == null){
25. return;
26. }
27. Iterator<ConfigAttribute> ite=configAttributes.iterator();
28. //判断用户所拥有的权限，是否符合对应的Url权限，如果实现了UserDetailsService，则用户权限是loadUserByUsername返回用户所对应的权限
29. while(ite.hasNext()){
30. ConfigAttribute ca=ite.next();
31. String needRole=((SecurityConfig)ca).getAttribute();
32. for(GrantedAuthority ga : authentication.getAuthorities()){
33. System.out.println(":::::::::::::"+ga.getAuthority());
34. if(needRole.equals(ga.getAuthority())){
35. return;
36. }
37. }
38. }
39. //注意：执行这里，后台是会抛异常的，但是界面会跳转到所配的access-denied-page页面
40. throw new AccessDeniedException("no right");
41. }
42. @Override
43. public boolean supports(ConfigAttribute attribute) {
44. return true;
45. }
46. @Override
47. public boolean supports(Class<?> clazz) {
48. return true;
49. }
50. }

package com.ultrapower.me.util.security.interceptor;

import java.util.Collection;


import java.util.Iterator;

import org.springframework.security.access.AccessDecisionManager;


import org.springframework.security.access.AccessDeniedException;


import org.springframework.security.access.ConfigAttribute;


import org.springframework.security.access.SecurityConfig;


import org.springframework.security.authentication.InsufficientAuthenticationException;


import org.springframework.security.core.Authentication;


import org.springframework.security.core.GrantedAuthority;

public class SecurityAccessDecisionManager implements AccessDecisionManager {
/**

 * 检查用户是否够权限访问资源

 * authentication 是从spring的全局缓存SecurityContextHolder中拿到的，里面是用户的权限信息

 * object 是url

 * configAttributes 所需的权限

 * @see org.springframework.security.access.AccessDecisionManager#decide(org.springframework.security.core.Authentication, java.lang.Object, java.util.Collection)

 */

@Override

public void decide(Authentication authentication, Object object,

		Collection<ConfigAttribute> configAttributes)

		throws AccessDeniedException, InsufficientAuthenticationException {

	// 对应url没有权限时，直接跳出方法

   if(configAttributes == null){

       return;

   }  

   Iterator<ConfigAttribute> ite=configAttributes.iterator();

   //判断用户所拥有的权限，是否符合对应的Url权限，如果实现了UserDetailsService，则用户权限是loadUserByUsername返回用户所对应的权限

   while(ite.hasNext()){

       ConfigAttribute ca=ite.next();

       String needRole=((SecurityConfig)ca).getAttribute();

       for(GrantedAuthority ga : authentication.getAuthorities()){

    	   System.out.println(":::::::::::::"+ga.getAuthority());

           if(needRole.equals(ga.getAuthority())){

               return;

           }

       }

   }

   //注意：执行这里，后台是会抛异常的，但是界面会跳转到所配的access-denied-page页面

   throw new AccessDeniedException("no right");

}

@Override

public boolean supports(ConfigAttribute attribute) {

	return true;

}

@Override

public boolean supports(Class<?> clazz) {

	return true;

}

}

这种验证以前项目用过，现在没有写示例代码，先写下大概流程和需要用到的类

1.用户登录时，先经过自定义的passcard_filter过滤器，该过滤器继承了AbstractAuthenticationProcessingFilter，并且绑定了登录失败和成功时需要的处理器(跳转页面使用)

2.执行attemptAuthentication方法，可以通过request获取登录页面传递的参数，实现自己的逻辑，并且把对应参数set到AbstractAuthenticationToken的实现类中

3.验证逻辑走完后，调用 this.getAuthenticationManager().authenticate(token);方法，执行AuthenticationProvider的实现类的supports方法

4.如果返回true则继续执行authenticate方法

5.在authenticate方法中，首先可以根据用户名获取到用户信息，再者可以拿自定义参数和用户信息做逻辑验证，如密码的验证

6.自定义验证通过以后，获取用户权限set到User中，用于springSecurity做权限验证

7.this.getAuthenticationManager().authenticate(token)方法执行完后，会返回Authentication，如果不为空，则说明验证通过

8.验证通过后，可实现自定义逻辑操作，如记录cookie信息

9.attemptAuthentication方法执行完成后，由springSecuriy来进行对应权限验证，成功于否会跳转到相对应处理器设置的界面。

1.自定义PassCardAuthenticationToken类，继承AbstractAuthenticationToken类，用于定义参数，需要实现的方法

/**

	 * 凭证，用户密码

	 */

	@Override

	public Object getCredentials() {

		return password;

	}
/**

 * 当事人，登录名 用户Id

 */

@Override

public Object getPrincipal() {

	return userID;

}</pre><br><br></div>

2.User类要实现Authentication，需要实现的方法



/**
* 返回用户所属权限
*/
@Override
public Collection<GrantedAuthority> getAuthorities() {
return this.accesses;
}
@Override
public Object getCredentials() {
return null;
}
@Override
public Object getDetails() {
return null;
}
/**
* 登录名称
*/
@Override
public Object getPrincipal() {
return loginName;
}
/**
* 是否认证
*/
@Override
public boolean isAuthenticated() {
return this.authenticated;
}
/**
* 设置是否认证字段
*/
@Override
public void setAuthenticated(boolean isAuthenticated)
throws IllegalArgumentException {
this.authenticated=isAuthenticated;
}


/**

	 * 返回用户所属权限

	 */

	@Override

	public Collection<GrantedAuthority> getAuthorities() {

		return this.accesses;

	}
@Override

public Object getCredentials() {

	return null;

}

@Override

public Object getDetails() {

	return null;

}

/**

 * 登录名称

 */

@Override

public Object getPrincipal() {

	return loginName;

}

/**

 * 是否认证

 */

@Override

public boolean isAuthenticated() {

	return this.authenticated;

}

/**

 * 设置是否认证字段

 */

@Override

public void setAuthenticated(boolean isAuthenticated)

		throws IllegalArgumentException {

	this.authenticated=isAuthenticated;

}</pre><br><br></div>

3.需要userService实现AuthenticationProvider的 authenticate(Authentication authentication)方法
  


@SuppressWarnings("unchecked")
@Override
public Authentication authenticate(Authentication authentication)
throws AuthenticationException {
PassCardAuthenticationToken token=(PassCardAuthenticationToken)authentication;
/*
* 这里进行逻辑认证操作，可以获取token中的属性来自定义验证逻辑，代码验证逻辑可以不用管
* 如果使用UserDetailsService的实现类来验证，就只能获取userName，不够灵活
*/
if(token.getUserID()!=null&&token.getPassword()!=null){
User user=(User)this.getDao().executeQueryUnique("User.loadByLoginName", QueryCmdType.QUERY_NAME, token.getUserID());
String password=token.getPassword();
if(this.passwordEncoder!=null){
password=this.passwordEncoder.encodePassword(password, null);
}
if(!password.equalsIgnoreCase(user.getPassword())){
token.setErrCode("2");
return null;
}
if( token.isEnablePasscard() && usePassCard ){//token中激活密码卡且系统使用密码卡
int position1=((token.getRow1()-1)*7)+token.getColumn1();
int position2=((token.getRow2()-1)*7)+token.getColumn2();
//System.out.println( "---pos:"+position1+"---"+position2 );
if(user.getPassCardId()==null){
token.setErrCode("10");
return null;
}
PassCard passcard=this.passCardDao.findById(user.getPassCardId(), false);
if(passcard==null||passcard.getStatus()==PassCardHelper.STATUS_CANCEL ){
token.setErrCode("10");
return null;
}
if(passcard.getConfusedContent()==null || passcard.getConfusedContent().length()<7*7*32 ){
token.setErrCode("10");
return null;
}
String content=passcard.getConfusedContent();
int perLen=content.length()/49;
String str1=content.substring((position1-1)*perLen, position1*perLen);
String str2=content.substring((position2-1)*perLen, position2*perLen);
String inputStr1=token.getCard1();
String inputStr2=token.getCard2();
if(this.passwordEncoder!=null){
inputStr1 = md5.getMD5ofStr(md5.getMD5ofStr(inputStr1));
inputStr2 = md5.getMD5ofStr(md5.getMD5ofStr(inputStr2));
}
if((!str1.equalsIgnoreCase(inputStr1))||(!str2.equalsIgnoreCase(inputStr2))){
token.setErrCode("10");
return null;
}
}
user.setLastIp(token.getIp());
user.setLastLogin(new Date());
this.getDao().saveOrUpdate(user);
user.setAuthenticated(true);
/*
* 导入一次角色权限，并且把权限set到User中，用于spring验证用户权限(getAuthorities方法)
*/
List<UserRole> userRoles=(List<UserRole>)this.getDao().executeQueryList("UserRole.listRoleByUserID", QueryCmdType.QUERY_NAME, -1, -1, user.getId());
Set<GrantedAuthority> accesses=new HashSet<GrantedAuthority>();
for(UserRole ur:userRoles){
accesses.add(ur.getRole());
}
user.getOrg().getOrgName();
if(user.getOrg().getCertTypes()!=null) user.getOrg().getCertTypes().size();//延迟载入一下
user.setAccesses(accesses);
return user;
}
return null;
}


@SuppressWarnings("unchecked")

	@Override

	public Authentication authenticate(Authentication authentication)

			throws AuthenticationException {

		PassCardAuthenticationToken token=(PassCardAuthenticationToken)authentication;

		/*

		 * 这里进行逻辑认证操作，可以获取token中的属性来自定义验证逻辑，代码验证逻辑可以不用管

		 * 如果使用UserDetailsService的实现类来验证，就只能获取userName，不够灵活

		 */

		if(token.getUserID()!=null&&token.getPassword()!=null){

			User user=(User)this.getDao().executeQueryUnique("User.loadByLoginName", QueryCmdType.QUERY_NAME, token.getUserID());
		String password=token.getPassword();

		if(this.passwordEncoder!=null){

			password=this.passwordEncoder.encodePassword(password, null);

		}

		if(!password.equalsIgnoreCase(user.getPassword())){

			token.setErrCode("2");

			return null;

		}

		if( token.isEnablePasscard() &amp;&amp; usePassCard ){//token中激活密码卡且系统使用密码卡

			int position1=((token.getRow1()-1)*7)+token.getColumn1();

			int position2=((token.getRow2()-1)*7)+token.getColumn2();

			//System.out.println( "---pos:"+position1+"---"+position2 );

			if(user.getPassCardId()==null){

				token.setErrCode("10");

				return null;

			}

			PassCard passcard=this.passCardDao.findById(user.getPassCardId(), false);

			if(passcard==null||passcard.getStatus()==PassCardHelper.STATUS_CANCEL ){

				token.setErrCode("10");

				return null;

			}

			if(passcard.getConfusedContent()==null || passcard.getConfusedContent().length()&lt;7*7*32 ){

				token.setErrCode("10");

				return null;

			}

			String content=passcard.getConfusedContent();

			int perLen=content.length()/49;

			String str1=content.substring((position1-1)*perLen, position1*perLen);

			String str2=content.substring((position2-1)*perLen, position2*perLen);

			String inputStr1=token.getCard1();

			String inputStr2=token.getCard2();

			if(this.passwordEncoder!=null){

				inputStr1 = md5.getMD5ofStr(md5.getMD5ofStr(inputStr1));

				inputStr2 = md5.getMD5ofStr(md5.getMD5ofStr(inputStr2));

			}

			if((!str1.equalsIgnoreCase(inputStr1))||(!str2.equalsIgnoreCase(inputStr2))){

				token.setErrCode("10");

				return null;

			}

		}

		user.setLastIp(token.getIp());

		user.setLastLogin(new Date());

		this.getDao().saveOrUpdate(user);

		user.setAuthenticated(true);

		/*

		 * 导入一次角色权限，并且把权限set到User中，用于spring验证用户权限(getAuthorities方法)

		 */

		List&lt;UserRole&gt; userRoles=(List&lt;UserRole&gt;)this.getDao().executeQueryList("UserRole.listRoleByUserID", QueryCmdType.QUERY_NAME, -1, -1, user.getId());

		Set&lt;GrantedAuthority&gt; accesses=new HashSet&lt;GrantedAuthority&gt;();

		for(UserRole ur:userRoles){

			accesses.add(ur.getRole());

		}

		user.getOrg().getOrgName();

		if(user.getOrg().getCertTypes()!=null) user.getOrg().getCertTypes().size();//延迟载入一下

		user.setAccesses(accesses);

		return user;

	}

	return null;

}</pre><br></div>

   重写supports(Class<? extends Object> authentication)方法，authentication要



/**
* 如果此处验证不通过，是不会执行authentication方法的
*/
@Override
public boolean supports(Class<? extends Object> authentication) {
return authentication.equals(PassCardAuthenticationToken.class);
}


/**

	 * 如果此处验证不通过，是不会执行authentication方法的

	 */

	@Override

	public boolean supports(Class<? extends Object> authentication) {

		return authentication.equals(PassCardAuthenticationToken.class);

	}
4.定义filter，实现AbstractAuthenticationProcessingFilter的attemptAuthentication方法，用于获取在登录页面传递过来的参数，spring默认只获取userName(j_username)，password(j_username)，而且实现UserDetailsService时只传递username






import java.io.IOException;
import java.util.Date;
import javax.servlet.ServletException;
import javax.servlet.http.Cookie;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;
import org.apache.log4j.Logger;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.AuthenticationException;
import org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter;
import org.springframework.util.StringUtils;
import cn.edu.jszg.cert.user.UserLog;
import cn.edu.jszg.cert.user.UserLogService;
import cn.edu.jszg.cert.web.WebApplicationConfiguration;
import cn.edu.jszg.cert.web.controller.portal.auth.RemoteDataValidator;
import com.google.code.kaptcha.servlet.KaptchaServlet;
public class PasscardAuthenticationProcessingFilter extends
AbstractAuthenticationProcessingFilter {
private String successPage = "/home/admin/index";
private String failurePage = "/public/adminLoginEntry";
private boolean forward = false;
private boolean useVerifyCode=true;
private String certLoginUrl;
static Logger logger = Logger.getLogger(PasscardAuthenticationProcessingFilter.class);
private WebApplicationConfiguration config;
private UserLogService userLogService;
public void setConfig(WebApplicationConfiguration config) {
this.config = config;
}
/**
* 实现AbstractAuthenticationProcessingFilter的有参构造
* 没记错的话，相当于该filter的访问路径
*/
protected PasscardAuthenticationProcessingFilter() {
super("/adminLoginCheck");
}
public void setUseVerifyCode(boolean useVerifyCode) {
this.useVerifyCode = useVerifyCode;
}
public void setUserLogService(UserLogService userLogService) {
this.userLogService = userLogService;
}
public boolean validate(HttpServletRequest request) {
String userId = request.getParameter("username");
String md2 = request.getParameter("m");
String l = request.getParameter("l");
if (userId == null || md2 == null || l == null) {
return false;
}
long longTime = Long.parseLong(l);
if (longTime < new Date().getTime()) {
return false;
}
try {
String md1 = RemoteDataValidator.genExamMd5Digest(userId, longTime);
if (md1.equals(md2))
return true;
} catch (Exception e) {
//e.printStackTrace();
}
return false;
}
/**
* 可以通过request获取页面传递过来的参数，并且set到相应的token中
*/
@Override
public Authentication attemptAuthentication(HttpServletRequest request,
HttpServletResponse response) throws AuthenticationException,
IOException, ServletException {
//      logger.warn("-----------------start证书登录用户----------");
HttpSession s = request.getSession(true);
PassCardAuthenticationToken token = new PassCardAuthenticationToken();
String verifyCode = request.getParameter("verifyCode");
String userID = request.getParameter("username");
//....此处省略获取参数，并且验证、赋值的逻辑
Authentication auth = null;
try {
//此处调用getAuthenticationManager的authenticate方法，当supports方法返回true时执行authenticate方法
auth = this.getAuthenticationManager().authenticate(token);
//此处为登录成功后，相应的处理逻辑
if (auth == null || !auth.isAuthenticated()) {
s.setAttribute("__login_error", token.getErrCode());
} else  {
s.removeAttribute("__login_error");
s.removeAttribute("__login_username");
s.removeAttribute("__cert_userid");
if( token.isEnablePasscard()) {
s.removeAttribute("__passcard_row1");
s.removeAttribute("__passcard_row2");
s.removeAttribute("__passcard_column1");
s.removeAttribute("__passcard_column2");
}
}
} catch (AuthenticationException e) {
s.setAttribute("__login_error", token.getErrCode());
throw e;
}
return auth;
}
public void setSuccessPage(String successPage) {
this.successPage = successPage;
}
public void setFailurePage(String failurePage) {
this.failurePage = failurePage;
}
public void setForward(boolean forward) {
this.forward = forward;
}
public void setCertLoginUrl(String certLoginUrl) {
this.certLoginUrl = certLoginUrl;
}
@Override
public void afterPropertiesSet() {
super.afterPropertiesSet();
/*
*该处理器实现了AuthenticationSuccessHandler, AuthenticationFailureHandler
*用于处理登录成功或者失败后，跳转的界面
*/
AuthenticationResultHandler handler = new AuthenticationResultHandler();
handler.setForward(forward);
handler.setLoginFailurePage(failurePage);
handler.setLoginSuccessPage(successPage);
handler.setCertLoginUrl(certLoginUrl);
//设置父类中的处理器
this.setAuthenticationSuccessHandler(handler);
this.setAuthenticationFailureHandler(handler);
}
}


import java.io.IOException;

import java.util.Date;

import javax.servlet.ServletException;


import javax.servlet.http.Cookie;


import javax.servlet.http.HttpServletRequest;


import javax.servlet.http.HttpServletResponse;


import javax.servlet.http.HttpSession;

import org.apache.log4j.Logger;


import org.springframework.security.core.Authentication;


import org.springframework.security.core.AuthenticationException;


import org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter;


import org.springframework.util.StringUtils;

import cn.edu.jszg.cert.user.UserLog;


import cn.edu.jszg.cert.user.UserLogService;


import cn.edu.jszg.cert.web.WebApplicationConfiguration;


import cn.edu.jszg.cert.web.controller.portal.auth.RemoteDataValidator;

import com.google.code.kaptcha.servlet.KaptchaServlet;

public class PasscardAuthenticationProcessingFilter extends


AbstractAuthenticationProcessingFilter {


private String successPage = "/home/admin/index";


private String failurePage = "/public/adminLoginEntry";


private boolean forward = false;


private boolean useVerifyCode=true;


private String certLoginUrl;
static Logger logger = Logger.getLogger(PasscardAuthenticationProcessingFilter.class);

private WebApplicationConfiguration config;

private UserLogService userLogService;	

public void setConfig(WebApplicationConfiguration config) {

	this.config = config;

}

/**

 * 实现AbstractAuthenticationProcessingFilter的有参构造

 * 没记错的话，相当于该filter的访问路径

 */

protected PasscardAuthenticationProcessingFilter() {

	super("/adminLoginCheck");

}

public void setUseVerifyCode(boolean useVerifyCode) {

	this.useVerifyCode = useVerifyCode;

}

public void setUserLogService(UserLogService userLogService) {

	this.userLogService = userLogService;

}

public boolean validate(HttpServletRequest request) {

	String userId = request.getParameter("username");

	String md2 = request.getParameter("m");

	String l = request.getParameter("l");

	if (userId == null || md2 == null || l == null) {

		return false;

	}

	long longTime = Long.parseLong(l);

	if (longTime &lt; new Date().getTime()) {

		return false;

	}

	try {

		String md1 = RemoteDataValidator.genExamMd5Digest(userId, longTime);

		if (md1.equals(md2))

			return true;

	} catch (Exception e) {

		//e.printStackTrace();

	}

	return false;

}

/**

 * 可以通过request获取页面传递过来的参数，并且set到相应的token中

 */

@Override

public Authentication attemptAuthentication(HttpServletRequest request,

		HttpServletResponse response) throws AuthenticationException,

		IOException, ServletException {

//		logger.warn("-----------------start证书登录用户----------");


HttpSession s = request.getSession(true);


PassCardAuthenticationToken token = new PassCardAuthenticationToken();
	String verifyCode = request.getParameter("verifyCode");

	String userID = request.getParameter("username");

	//....此处省略获取参数，并且验证、赋值的逻辑

	Authentication auth = null;

	try {

		//此处调用getAuthenticationManager的authenticate方法，当supports方法返回true时执行authenticate方法

		auth = this.getAuthenticationManager().authenticate(token);

		//此处为登录成功后，相应的处理逻辑

		if (auth == null || !auth.isAuthenticated()) {

			s.setAttribute("__login_error", token.getErrCode());

		} else  {

			s.removeAttribute("__login_error");

			s.removeAttribute("__login_username");

			s.removeAttribute("__cert_userid");

			if( token.isEnablePasscard()) {

				s.removeAttribute("__passcard_row1");

				s.removeAttribute("__passcard_row2");

				s.removeAttribute("__passcard_column1");

				s.removeAttribute("__passcard_column2");

			}

		}

	} catch (AuthenticationException e) {

		s.setAttribute("__login_error", token.getErrCode());

		throw e;

	}

	return auth;

}

public void setSuccessPage(String successPage) {

	this.successPage = successPage;

}

public void setFailurePage(String failurePage) {

	this.failurePage = failurePage;

}

public void setForward(boolean forward) {

	this.forward = forward;

}

public void setCertLoginUrl(String certLoginUrl) {

	this.certLoginUrl = certLoginUrl;

}

@Override

public void afterPropertiesSet() {

	super.afterPropertiesSet();

	/*

	*该处理器实现了AuthenticationSuccessHandler, AuthenticationFailureHandler

	*用于处理登录成功或者失败后，跳转的界面

	*/

	AuthenticationResultHandler handler = new AuthenticationResultHandler();

	handler.setForward(forward);

	handler.setLoginFailurePage(failurePage);

	handler.setLoginSuccessPage(successPage);

	handler.setCertLoginUrl(certLoginUrl);

	//设置父类中的处理器

	this.setAuthenticationSuccessHandler(handler);

	this.setAuthenticationFailureHandler(handler);

}

}
最后为spring-security配置文件中的配置，需要添加authentication-provider的引用，和filter的配置




<security:authentication-manager alias="authenticationManager">
<!-- 注意，这里仅仅是系统默认的认证机制，请在正式系统中明确知道其功能再使用 -->
<security:authentication-provider ref="acocunt_defaultAnthentiactionProvider"/>
<security:authentication-provider ref="registrationService"/>
<security:authentication-provider ref="enrollmentService"/>
<security:authentication-provider ref="userService"/>
</security:authentication-manager>
<bean id="passcard_filter" class="cn.edu.jszg.cert.security.PasscardAuthenticationProcessingFilter">
<property name="authenticationManager" ref="authenticationManager"/>
<property name="useVerifyCode" value="true"/>
<property name="failurePage" value="/portal/home/auth/"></property>
<property name="config" ref="webAppConfig"/>
<property name="userLogService" ref="userLogService" />
<property name="certLoginUrl" value="${cert.login.url}"/>
</bean>


<security:authentication-manager alias="authenticationManager">

		<!-- 注意，这里仅仅是系统默认的认证机制，请在正式系统中明确知道其功能再使用 -->

		<security:authentication-provider ref="acocunt_defaultAnthentiactionProvider"/>

		<security:authentication-provider ref="registrationService"/>

		<security:authentication-provider ref="enrollmentService"/>

		<security:authentication-provider ref="userService"/>

	</security:authentication-manager>

	<bean id="passcard_filter" class="cn.edu.jszg.cert.security.PasscardAuthenticationProcessingFilter">

		<property name="authenticationManager" ref="authenticationManager"/>

		<property name="useVerifyCode" value="true"/>

		<property name="failurePage" value="/portal/home/auth/"></property>

		<property name="config" ref="webAppConfig"/>

		<property name="userLogService" ref="userLogService" />

		<property name="certLoginUrl" value="${cert.login.url}"/>

	</bean>
还要在http中添加<security:custom-filter ref="passcard_filter" after="SECURITY_CONTEXT_FILTER"/>

阅读全文