从数据库或属性中获取 Spring Security 拦截 url [英] Get Spring Security intercept urls from database or properties

问题描述

希望这超级简单，存在，而且我正在俯瞰我眼皮底下的东西.我知道我可以通过注释限制访问:

Hopefully this is super simple, exists, and I'm overlooking something right under my nose. I know that I can restrict access via annotations:

@Secured({"ROLE_ADMIN"})

或通过配置:

<security:intercept-url pattern="/**" access="ROLE_USER, ROLE_ADMIN, ROLE_SUPER_USER" />

我更喜欢从数据库中获取身份验证规则，例如:

I would prefer to obtain authentication rules from a database, something like:

<security:intercept-url provider="authProvider"/>

<bean id="authProvider" class="AuthProviderImpl">
    <property name="userDetailsService" ref="userDetailsService"/>
</bean>

最坏的情况，必须有一种方法可以通过属性文件进行填充，对吗?...

Worst case scenario, there has to be a way to populate via a properties file right?...

/admin/**=ROLE_ADMIN
/**=ROLE_USER

<security:intercept-url props="classpath:urls.properties"/>

等

请告诉我这个存在，否则我的大脑会爆炸！！！Grails spring-security 插件随附开箱即用，所以我知道它必须存在.请不要让我的大脑爆炸！！！

Please tell me this exists or my brain will explode!!! The Grails spring-security plugin ships with this out of the box so I know this has to exist. Please don't let my brain explode!!!

想通了...

您必须提供自定义的org.springframework.security.intercept.web.FilterSecurityInterceptor 并提供objectDefinitionSource:

You have to provide a custom org.springframework.security.intercept.web.FilterSecurityInterceptor and provide the objectDefinitionSource:

<bean id="filterSecurityInterceptor" class="org.springframework.security.intercept.web.FilterSecurityInterceptor">
    <security:custom-filter before="FILTER_SECURITY_INTERCEPTOR" />
    <property name="authenticationManager" ref="authenticationManager" />
    <property name="accessDecisionManager" ref="accessDecisionManager" />
    <property name="objectDefinitionSource">
        <value>
            CONVERT_URL_TO_LOWERCASE_BEFORE_COMPARISON
            PATTERN_TYPE_APACHE_ANT
            /**login.html=IS_AUTHENTICATED_ANONYMOUSLY
            /user/**=ROLE_ADMIN
        </value>
    </property>
</bean>

我想我将使用 FactoryBean:

And I think I'm going to use a FactoryBean:

public class RequestMappingFactoryBean implements FactoryBean {

    private final static String EOL = System.getProperty("line.separator");

    public Object getObject() throws Exception {
        StringBuffer sb = new StringBuffer();
        sb.append("CONVERT_URL_TO_LOWERCASE_BEFORE_COMPARISON");
        sb.append(EOL);
        sb.append("PATTERN_TYPE_APACHE_ANT");
        sb.append(EOL);
        sb.append("/**login.html=IS_AUTHENTICATED_ANONYMOUSLY");
        sb.append(EOL);
        sb.append("/user/**=ROLE_ADMIN");
        return sb.toString();
    }

    @SuppressWarnings("unchecked")
    public Class getObjectType() {
        return String.class;
    }

    public boolean isSingleton() {
        return true;
    }

}

传递给它一个 DAO 等

Pass it a DAO, etc.

<bean id="filterSecurityInterceptor" class="org.springframework.security.intercept.web.FilterSecurityInterceptor">
    <security:custom-filter before="FILTER_SECURITY_INTERCEPTOR" />
    <property name="authenticationManager" ref="authenticationManager" />
    <property name="accessDecisionManager" ref="accessDecisionManager" />
    <property name="objectDefinitionSource" ref="requestMappings" />
</bean>

<bean id="requestMappings" class="RequestMappingFactoryBean" />

推荐答案

已经有一段时间了，但您可以创建一个 Voter 对象来帮助决定是否允许访问 URL.Voter 对象可以从数据库或文件中加载数据，或者只是随机返回 Allow、Deny 或 Abstain.

It's been a while, but you can create a Voter object which helps decide whether to allow access to a URL. The Voter object can load data from the database, or a file, or just randomly return Allow, Deny, or Abstain.

这篇关于从数据库或属性中获取 Spring Security 拦截 url的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！