spring security+mybatis+springMVC构建一个简单的项目

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans" 
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
 xmlns:tx="http://www.springframework.org/schema/tx" 
 xmlns:aop="http://www.springframework.org/schema/aop" xsi:schemaLocation="
http://www.springframework.org/schema/beans 
http://www.springframework.org/schema/beans/spring-beans-3.0.xsd 
http://www.springframework.org/schema/tx 
http://www.springframework.org/schema/tx/spring-tx-3.0.xsd
http://www.springframework.org/schema/aop 
http://www.springframework.org/schema/aop/spring-aop-3.0.xsd
">
 
	<!-- JNDI方式配置数据源 -->
	<!-- <bean id="dataSource" class="org.springframework.jndi.JndiObjectFactoryBean"> <property name="jndiName" value="${jndiName}"></property> </bean> -->
 
	<!-- 配置数据源 -->
	<bean name="dataSource" class="com.alibaba.druid.pool.DruidDataSource" init-method="init" destroy-method="close">
		
		 <!--数据源驱动类可以不用写，Druid默认会自动根据URL识别DriverClass  -->
       <!--  <property name="driverClassName" value="com.mysql.jdbc.Driver"/> -->
		<property name="url" value="${jdbc_url}" />
		<property name="username" value="${jdbc_username}" />
		<property name="password" value="${jdbc_password}" />
       
		<!-- 初始化连接大小 -->
		<property name="initialSize" value="0" />
		<!-- 连接池最大使用连接数量 -->
		<property name="maxActive" value="20" />
		<!-- 连接池最大空闲 -->
		<property name="maxIdle" value="20" />
		<!-- 连接池最小空闲 -->
		<property name="minIdle" value="0" />
		<!-- 获取连接最大等待时间 -->
		<property name="maxWait" value="60000" />
 
		<!-- <property name="poolPreparedStatements" value="true" /> <property name="maxPoolPreparedStatementPerConnectionSize" value="33" /> -->
 
		<property name="validationQuery" value="${validationQuery}" />
		<property name="testOnBorrow" value="false" />
		<property name="testOnReturn" value="false" />
		<property name="testWhileIdle" value="true" />
 
		<!-- 配置间隔多久才进行一次检测，检测需要关闭的空闲连接，单位是毫秒 -->
		<property name="timeBetweenEvictionRunsMillis" value="60000" />
		<!-- 配置一个连接在池中最小生存的时间，单位是毫秒 -->
		<property name="minEvictableIdleTimeMillis" value="25200000" />
 
		<!-- 打开removeAbandoned功能 -->
		<property name="removeAbandoned" value="true" />
		<!-- 1800秒，也就是30分钟 -->
		<property name="removeAbandonedTimeout" value="1800" />
		<!-- 关闭abanded连接时输出错误日志 -->
		<property name="logAbandoned" value="true" />
 
		<!--配置监控统计拦截  监控数据库 -->
		<!-- <property name="filters" value="stat" /> -->
		<property name="filters" value="mergeStat" />
	</bean>
 
	<!--  配置SqlsessionFactoryBean myBatis文件-->
	<bean id="sqlSessionFactory" class="org.mybatis.spring.SqlSessionFactoryBean">
		<property name="dataSource" ref="dataSource" />
		<!-- 自动扫描entity目录, 省掉Configuration.xml里的手工配置 -->
		<property name="mapperLocations" value="classpath:sy/mapping/*.xml" />
	</bean>
 
	<bean class="org.mybatis.spring.mapper.MapperScannerConfigurer">
		<property name="basePackage" value="sy.dao" />
		<property name="sqlSessionFactoryBeanName" value="sqlSessionFactory" />
	</bean>
 
	<!-- 配置事务管理器 -->
	<bean id="transactionManager" class="org.springframework.jdbc.datasource.DataSourceTransactionManager">
		<property name="dataSource" ref="dataSource" />
	</bean>
 
	<!-- 注解方式配置事物 -->
	<!-- <tx:annotation-driven transaction-manager="transactionManager" /> -->
 
	<!-- 拦截器方式配置事物 -->
	<tx:advice id="transactionAdvice" transaction-manager="transactionManager">
		<tx:attributes>
			<tx:method name="add*" propagation="REQUIRED" />
			<tx:method name="append*" propagation="REQUIRED" />
			<tx:method name="insert*" propagation="REQUIRED" />
			<tx:method name="save*" propagation="REQUIRED" />
			<tx:method name="update*" propagation="REQUIRED" />
			<tx:method name="modify*" propagation="REQUIRED" />
			<tx:method name="edit*" propagation="REQUIRED" />
			<tx:method name="delete*" propagation="REQUIRED" />
			<tx:method name="remove*" propagation="REQUIRED" />
			<tx:method name="repair" propagation="REQUIRED" />
			<tx:method name="delAndRepair" propagation="REQUIRED" />
 
			<tx:method name="get*" propagation="SUPPORTS" />
			<tx:method name="find*" propagation="SUPPORTS" />
			<tx:method name="load*" propagation="SUPPORTS" />
			<tx:method name="search*" propagation="SUPPORTS" />
			<tx:method name="datagrid*" propagation="SUPPORTS" />
 
			<tx:method name="*" propagation="SUPPORTS" />
		</tx:attributes>
	</tx:advice>
	
	<aop:config>
		<aop:pointcut id="transactionPointcut" expression="execution(* sy.service..*Impl.*(..))" />
		<aop:advisor pointcut-ref="transactionPointcut" advice-ref="transactionAdvice" />
	</aop:config>
 
 
	<!-- 配置druid监控spring jdbc -->
	<bean id="druid-stat-interceptor" class="com.alibaba.druid.support.spring.stat.DruidStatInterceptor">
	</bean>
	<bean id="druid-stat-pointcut" class="org.springframework.aop.support.JdkRegexpMethodPointcut" scope="prototype">
		<property name="patterns">
			<list>
				<value>sy.service.*</value>
			</list>
		</property>
	</bean>
	<aop:config>
		<aop:advisor advice-ref="druid-stat-interceptor" pointcut-ref="druid-stat-pointcut" />
	</aop:config>
 
</beans>

package sy.controller;

import org.apache.log4j.Logger;  
import org.springframework.stereotype.Controller;  
import org.springframework.ui.ModelMap;  
import org.springframework.web.bind.annotation.RequestMapping;  
import org.springframework.web.bind.annotation.RequestMethod;  
import org.springframework.web.bind.annotation.RequestParam;  
  
@Controller  
@RequestMapping("auth")  
public class LoginLogoutController {  
  
    protected static Logger logger = Logger.getLogger("controller");  
  
    /** 
     * 指向登录页面 
     */  
    @RequestMapping(value = "/login", method = RequestMethod.GET)  
    public String getLoginPage(  
            @RequestParam(value = "error", required = false) boolean error,  
            ModelMap model) {  
  
        logger.debug("Received request to show login page");  
  
        if (error == true) {  
            // Assign an error message  
            model.put("error",  
                    "You have entered an invalid username or password!");  
        } else {  
            model.put("error", "");  
        }  
        return "loginpage";  
  
    }  
  
    /** 
     * 指定无访问额权限页面 
     *  
     * @return 
     */  
    @RequestMapping(value = "/denied", method = RequestMethod.GET)  
    public String getDeniedPage() {  
  
        logger.debug("Received request to show denied page");  
  
        return "deniedpage";  
  
    }  
}  

package sy.controller;
import org.apache.log4j.Logger;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.stereotype.Controller;  
import org.springframework.web.bind.annotation.RequestMapping;  
import org.springframework.web.bind.annotation.RequestMethod;
 
import sy.model.User;
import sy.service.UserServiceI;  
  
@Controller  
@RequestMapping("/main")  
public class MainController {  
    protected static Logger logger = Logger.getLogger("controller");  
  
    private UserServiceI sevice;
    
    @Autowired
    public void setSevice(UserServiceI sevice) {
		this.sevice = sevice;
	}
 
	/** 
     * 跳转到commonpage页面 
     *  
     * @return 
     */  
    @RequestMapping(value = "/common", method = RequestMethod.GET)  
    public String getCommonPage() {  
  //这里是为spring security在方法级别的控制而准备的，getUserByPrimary方法，需要RELE_ADMIN权限
    	User user = sevice.getUserByPrimaryKey(1);
    	System.err.println("---------"+user.getUsername());
        logger.debug("Received request to show common page");  
        return "commonpage";  
    }  
  
    /** 
     * 跳转到adminpage页面 
     *  
     * @return 
     */  
    @RequestMapping(value = "/admin", method = RequestMethod.GET)  
    public String getAadminPage() {  
        logger.debug("Received request to show admin page");  
        return "adminpage";  
  
    }  
  
}  

package sy.security;
 
import java.util.Collection;
 
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.userdetails.UserDetails;
 
public class UserLoginDetails implements UserDetails{
 
 
	private static final long serialVersionUID = 1L;
	private String username;
	private String password;
	private boolean enabled;
	private Collection<? extends GrantedAuthority> authorities;
	
	public String getUsername() {
		return username;
	}
 
	public void setUsername(String username) {
		this.username = username;
	}
 
 
	public String getPassword() {
		return password;
	}
 
 
	public void setPassword(String password) {
		this.password = password;
	}
 
 
 
	public void setEnabled(boolean enabled) {
		this.enabled = enabled;
	}
 
	public Collection<? extends GrantedAuthority> getAuthorities() {
		return authorities;
	}
 
 
	public void setAuthorities(Collection<? extends GrantedAuthority> authorities) {
		this.authorities = authorities;
	}
 
	public boolean isAccountNonExpired() {
		return enabled;
	}
 
	public boolean isAccountNonLocked() {
		return enabled;
	}
 
	public boolean isCredentialsNonExpired() {
		return enabled;
	}
 
	public boolean isEnabled() {
		return enabled;
	}
 
}

package sy.service;
 
 
import sy.model.User;
import javax.annotation.security.RolesAllowed;
public interface UserServiceI {
 
	
    User getUserByUserName(String username);
 
    //spring security方法级别的控制，使用该方法需要的权限 
    @RolesAllowed("ROLE_ADMIN")
	User getUserByPrimaryKey(Integer id);
}

package sy.service;
 
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.stereotype.Service;
 
import sy.dao.UserMapper;
import sy.model.User;
 
@Service("userService")
public class UserServiceImpl implements UserServiceI {
 
	private UserMapper userMapper;
 
	public UserMapper getUserMapper() {
		return userMapper;
	}
 
	@Autowired
	public void setUserMapper(UserMapper userMapper) {
		this.userMapper = userMapper;
	}
 
	public User getUserByUserName(String username) {
		
		System.err.println("find by name !");
		return userMapper.selectByUserName(username);
	}
 
	public User getUserByPrimaryKey(Integer id) {
		return userMapper.selectByPrimaryKey(id);
	}
 
	
 
}

package sy.service;
 
import java.security.Principal;
import java.util.Set;
import javax.annotation.Resource;
import java.util.HashSet;
import org.springframework.security.authentication.jaas.AuthorityGranter;
import sy.model.User;
 
public class AuthorityGranterImpl implements AuthorityGranter{
 
	@Resource
	private UserServiceI serviceI;
	
	public Set<String> grant(Principal principal) {
		String name =  principal.getName();
		System.err.println("DefaultAuthorutyGranter Principal : "+name);
		
		User user = serviceI.getUserByUserName(name);
		
		String [] roles = user.getRole().split(",");
		Set<String> authoritys = new HashSet<String>();
		for(String role:roles){
			authoritys.add(role);			
		}
		
		//return Collections.singleton("ROLE_USER");
		return authoritys;
	}
 
}

package sy.service;
 
import java.io.IOException;
import java.sql.Connection;
import java.sql.DriverManager;
import java.sql.PreparedStatement;
import java.sql.ResultSet;
import java.sql.SQLException;
import java.util.Map;
 
import javax.security.auth.Subject;
import javax.security.auth.callback.Callback;
import javax.security.auth.callback.CallbackHandler;
import javax.security.auth.callback.NameCallback;
import javax.security.auth.callback.PasswordCallback;
import javax.security.auth.callback.UnsupportedCallbackException;
import javax.security.auth.login.LoginException;
import javax.security.auth.spi.LoginModule;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
 
public class LoginModuleImpl  implements LoginModule {
 
	private Subject subject;
	private CallbackHandler callbackHandler;
	private String username;
	private String password;
	private Map sharedState;
	private Map options;
 
	private String url;
	private String driver;
	private String db_username;
	private String db_password;
 
	public void initialize(Subject subject, CallbackHandler callbackHandler, Map<String, ?> sharedState,
			Map<String, ?> options) {
		this.subject = subject;
		this.callbackHandler = callbackHandler;
		this.sharedState = sharedState;
		this.options = options;
 
		url = (String) options.get("url");
		driver = (String) options.get("driver");
		db_username = (String) options.get("db_username");
		db_password = (String) options.get("db_password");
 
		/**
		 * 页面上的username 和password 由NameCallBack 和PasswordCallBack两个去获取
		 * 有callbackHandler去回调，然后再把他们获取出来
		 */
		try {
			//TextInputCallback textInputCallback = new TextInputCallback("prompt");
			NameCallback nameCallback = new NameCallback("prompt");
			PasswordCallback passwordCallback = new PasswordCallback("prompt", false);
			callbackHandler.handle(new Callback[] { nameCallback, passwordCallback });
 
			username = nameCallback.getName();
			password = new String(passwordCallback.getPassword());
 
		} catch (IOException e) {
			e.printStackTrace();
		} catch (UnsupportedCallbackException e) {
			e.printStackTrace();
		}
 
	}
 
	public boolean login() throws LoginException {
		// 1.Query and compare
		// 2.用户名和密码对比正确 返回true，错误返回false
		System.out.println("driver " + driver);
		System.out.println("url " + url);
		System.out.println("db_username " + db_username);
		System.out.println("db_password " + db_password);
 
		System.out.println("user " + username);
		System.out.println("password " + password);
 
		String dpwd = "";
		// String dtype = "";
 
		boolean flag = false;
 
		// 校验用户
		/*String sql = "select tp.name, tps.secretcode, tc.type from tperson tp "
				+ "inner join tcorp tc on tp.corpid = tc.objid "
				+ "inner join tpersonpsw tps on tp.objid = tps.objid where tp.name = ?";*/
 
		String sql = "select * from sec_user where username = ?";
		// 1.注册驱动
		// 2.获得连接
		Connection conn = null;
		PreparedStatement ps = null;
		ResultSet rs = null;
		try {
			Class.forName(driver);
			conn = DriverManager.getConnection(url, db_username, db_password);
			// 3.创建statement
			ps = conn.prepareStatement(sql);
			ps.setString(1, username);
			// 4.执行sql语句返回结果
			rs = ps.executeQuery();
 
			while (rs != null && rs.next()) {
				dpwd = rs.getString("password");
				flag = true;
			}
		} catch (SQLException e) {
			e.printStackTrace();
		} catch (ClassNotFoundException e) {
			e.printStackTrace();
		} finally {
			try {
				if (conn != null) {
					conn.close();
				}
				if (ps != null) {
					ps.close();
				}
				if (rs != null) {
					rs.close();
				}
			} catch (SQLException e) {
				e.printStackTrace();
			}
		}
		
		if(flag == false){throw new LoginException("User is not exist !");
		}
 
		if (dpwd.equals(password)) {
			UsernamePasswordAuthenticationToken authenticationToken = new UsernamePasswordAuthenticationToken(username,
					password);
			subject.getPrincipals().add(authenticationToken);
			return true;
		} else {
			throw new LoginException("Username is not match the password ! ");
		}
	}
	
	public boolean commit() throws LoginException {
		return true;
	}
 
	public boolean abort() throws LoginException {
		return true;
	}
 
	public boolean logout() throws LoginException {
		return true;
	}
 
}

JAASTest {
    sy.service.LoginModuleImpl required
    driver="com.mysql.jdbc.Driver"  
    url="jdbc:mysql://localhost:3306/sy"  
    db_username="root"  
    db_password="1234"  
    debug="true";  
};

    <%@ taglib uri="http://java.sun.com/jsp/jstl/core" prefix="c"%>  
    <%@ taglib uri="http://www.springframework.org/tags/form" prefix="form"%>  
    <%@ taglib uri="http://www.springframework.org/tags" prefix="spring"%>  
      
    <%@ page language="java" contentType="text/html; charset=UTF-8"  
        pageEncoding="UTF-8"%>  
    <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">  
    <html>  
    <head>  
    <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">  
    <title>Insert title here</title>  
    </head>  
    <body>  
      
        <h1>Login</h1>  
      
        <div id="login-error">${error}</div>  
      
        <form action="../j_spring_security_check" method="post">  
      
            <p>  
                <label for="j_username">Username</label> <input id="j_username"  
                    name="j_username" type="text" />  
            </p>  
      
            <p>  
                <label for="j_password">Password</label> <input id="j_password"  
                    name="j_password" type="password" />  
            </p>  
      
            <input type="submit" value="Login" />  
      
        </form>  
      
    </body>  
    </html>  

    <%@ page language="java" contentType="text/html; charset=UTF-8"  
        pageEncoding="UTF-8"%>  
    <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">  
    <html>  
    <head>  
    <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">  
    <title>Insert title here</title>  
    </head>  
    <body>  
        <h1>你的权限不够!</h1>  
        <p>只有拥有Admin权限才能访问!</p>  
        <a href="/mybatis_security_session/auth/login">退出登录</a>  
    </body>  
    </html>  

    <%@ page language="java" contentType="text/html; charset=UTF-8"  
        pageEncoding="UTF-8"%>  
    <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">  
    <html>  
    <head>  
    <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">  
    <title>Insert title here</title>  
    </head>  
    <body>  
        <h1>Common Page</h1>  
        <p>每个人都能访问的页面.</p>  
        <a href="/mybatis_security_session/main/admin"> Go AdminPage </a>  
        <br />  
        <a href="/mybatis_security_session/auth/login">退出登录</a>  
      
    </body>  
    </html>  

    <%@ page language="java" contentType="text/html; charset=UTF-8"  
        pageEncoding="UTF-8"%>  
    <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">  
    <html>  
    <head>  
    <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">  
    <title>Insert title here</title>  
    </head>  
    <body>  
        <h1>Admin Page</h1>  
        <p>管理员页面</p>  
        <a href="/mybatis_security_session/auth/login">退出登录</a>  
    </body>  
    </html>