Форум программистов [Powered by Invision Power Board]

Код


 <bean id="filterSecurityInterceptor" class="org.acegisecurity.intercept.web.FilterSecurityInterceptor">
        <property name="authenticationManager" ref="authenticationManager"/>
        <property name="accessDecisionManager" ref="httpRequestAccessDecisionManager"/>
        <property name="objectDefinitionSource" ref="definitionSource"/>
    </bean>

<bean id="httpRequestAccessDecisionManager" class="org.acegisecurity.vote.AffirmativeBased">
        <property name="allowIfAllAbstainDecisions" value="false"/>
        <property name="decisionVoters">
            <list>
                <ref local="myVoter"/>
                <ref local="roleVoter"/>
            </list>
        </property>
    </bean>

<bean id="myVoter" class="org.demo.MyVoter"/>

Код


public class MyVoter implements AccessDecisionVoter{
  public boolean supports(ConfigAttribute attribute) {
        return true;
    }

    public boolean supports(Class clazz) {
        return true;
    }

    public int vote(Authentication authentication, Object object, ConfigAttributeDefinition config) {

        if (...)
        return ACCESS_GRANTED;
        else
        return ACCESS_ABSTAIN;
    }
}

Код


public class MyAuthenticationProvider implements AuthenticationProvider {

    private LdapAuthenticationProvider ldapAuthenticationProvider;

    @Autowired
    private RoleManagerService roleManagerService;

    private Long authenticationCheckRightId;

    protected MessageSourceAccessor messages = SpringSecurityMessageSource.getAccessor();

    public Authentication authenticate(Authentication authentication) throws AuthenticationException {
        authentication = ldapAuthenticationProvider.authenticate(authentication);
        GrantedAuthority[] authorities = authentication.getAuthorities();
        if (authorities == null) {
            throw new UsernameNotFoundException(
                    messages.getMessage("JdbcDaoImpl.noAuthority",
                            new Object[]{authentication.getPrincipal()}, "User {0} has no GrantedAuthority"), authentication.getPrincipal());
        }

        String roleCode = authorities[0].getAuthority();

        if (roleManagerService.hasPrincipalRight(authenticationCheckRightId, roleCode)) {
            return authentication;
        }
        authentication.setAuthenticated(false);
        throw new DisabledException(messages.getMessage("AbstractUserDetailsAuthenticationProvider.locked", "User account is locked"));
    }

    public boolean supports(Class authentication) {
        return ldapAuthenticationProvider.supports(authentication);
    }

    public void setAuthenticationCheckRightId(Long authenticationCheckRightId) {
        this.authenticationCheckRightId = authenticationCheckRightId;
    }

    public void setLdapAuthenticationProvider(LdapAuthenticationProvider ldapAuthenticationProvider) {
        this.ldapAuthenticationProvider = ldapAuthenticationProvider;
    }
}

Код


 <beans:bean id="myAuthenticationProvider" class="mypackage.spring.security.MyAuthenticationProvider">
        <custom-authentication-provider/>
        <beans:property name="authenticationCheckRightId" value="1"/>
        <beans:property name="ldapAuthenticationProvider" ref="_ldapAuthenticationProvider"/>
    </beans:bean>

    <ldap-server url="${ldap.url}/${ldap.base.dn}" manager-dn="${ldap.login}" manager-password="${ldap.pwd}"/>

    <ldap-authentication-provider group-search-base="${ldap.roles.dir}" group-search-filter="${ldap.member.filter}"/>

    <ldap-user-service id="userService" user-search-filter="(uid={0})" user-search-base="${ldap.users.dir}"/>