最近項目需要用到Spring Security的權限控制,故花了點時間簡單的去看了一下其權限控制相關的源碼(版本為4.2)。
spring security是通過AccessDecisionManager進行授權管理的,先來張官方圖鎮樓。
AccessDecisionManager 接口定義了如下方法:
//調用AccessDecisionVoter進行投票(關鍵方法)
void decide(Authentication authentication, Object object,
Collection<ConfigAttribute> configAttributes) throws AccessDeniedException,
InsufficientAuthenticationException;
boolean supports(ConfigAttribute attribute);
boolean supports(Class clazz);
接下來看看它的實現類的具體實現:
public void decide(Authentication authentication, Object object,
Collection<ConfigAttribute> configAttributes) throws AccessDeniedException {
int deny = 0;
for (AccessDecisionVoter voter : getDecisionVoters()) {
//調用AccessDecisionVoter進行vote(我們姑且稱之為投票吧),後面再看vote的源碼。
int result = voter.vote(authentication, object, configAttributes);
if (logger.isDebugEnabled()) {
logger.debug("Voter: " + voter + ", returned: " + result);
}
switch (result) {
case AccessDecisionVoter.ACCESS_GRANTED://值為1
//只要有voter投票為ACCESS_GRANTED,則通過
return;
case AccessDecisionVoter.ACCESS_DENIED://值為-1
deny++;
break;
default:
break;
}
}
if (deny > 0) {
//如果有兩個及以上AccessDecisionVoter(姑且稱之為投票者吧)都投ACCESS_DENIED,則直接就不通過了
throw new AccessDeniedException(messages.getMessage(
"AbstractAccessDecisionManager.accessDenied", "Access is denied"));
}
// To get this far, every AccessDecisionVoter abstained
checkAllowIfAllAbstainDecisions();
}
源碼中,有個Collection configAttributes 參數,ConfigAttribute是什麼? 這個其實是一個很靈活的東西,不同的情況代表不同的語義,比如在使用了角色控制的時候,傳入的則可能是ROLE__XXX之類的,以便ROLE_VOTER使用。具體的後面在細說。
通過以上代碼可直接看到AffirmativeBased的策略:
public void decide(Authentication authentication, Object object,
Collection<ConfigAttribute> attributes) throws AccessDeniedException {
int grant = 0;
int abstain = 0;
List<ConfigAttribute> singleAttributeList = new ArrayList<ConfigAttribute>(1);
singleAttributeList.add(null);
for (ConfigAttribute attribute : attributes) {
singleAttributeList.set(0, attribute);
for (AccessDecisionVoter voter : getDecisionVoters()) {
//配置的投票者進行投票
int result = voter.vote(authentication, object, singleAttributeList);
if (logger.isDebugEnabled()) {
logger.debug("Voter: " + voter + ", returned: " + result);
}
switch (result) {
case AccessDecisionVoter.ACCESS_GRANTED:
grant++;
break;
case AccessDecisionVoter.ACCESS_DENIED:
//只要有投票者投反對票就立馬判為無權訪問
throw new AccessDeniedException(messages.getMessage(
"AbstractAccessDecisionManager.accessDenied",
"Access is denied"));
default:
abstain++;
break;
}
}
}
// To get this far, there were no deny votes
if (grant > 0) {
//如果沒反對票且有通過票,那麼就判為通過
return;
}
// To get this far, every AccessDecisionVoter abstained
checkAllowIfAllAbstainDecisions();
}
由此可見UnanimousBased的策略:
public void decide(Authentication authentication, Object object,
Collection<ConfigAttribute> configAttributes) throws AccessDeniedException {
int grant = 0;
int deny = 0;
int abstain = 0;
for (AccessDecisionVoter voter : getDecisionVoters()) {
//配置的投票者進行投票
int result = voter.vote(authentication, object, configAttributes);
if (logger.isDebugEnabled()) {
logger.debug("Voter: " + voter + ", returned: " + result);
}
switch (result) {
case AccessDecisionVoter.ACCESS_GRANTED:
grant++;
break;
case AccessDecisionVoter.ACCESS_DENIED:
deny++;
break;
default:
abstain++;
break;
}
}
if (grant > deny) {
//通過的票數大於反對的票數則判為通過
return;
}
if (deny > grant) {
//通過的票數小於反對的票數則判為不通過
throw new AccessDeniedException(messages.getMessage(
"AbstractAccessDecisionManager.accessDenied", "Access is denied"));
}
if ((grant == deny) && (grant != 0)) {
//this.allowIfEqualGrantedDeniedDecisions默認為true
//通過的票數和反對的票數相等,則可根據配置allowIfEqualGrantedDeniedDecisions進行判斷是否通過
if (this.allowIfEqualGrantedDeniedDecisions) {
return;
}
else {
throw new AccessDeniedException(messages.getMessage(
"AbstractAccessDecisionManager.accessDenied", "Access is denied"));
}
}
// To get this far, every AccessDecisionVoter abstained
checkAllowIfAllAbstainDecisions();
}
由此可見,ConsensusBased的策略:
到此,應該明白AffirmativeBased、UnanimousBased、ConsensusBased三者的區別了吧,spring security默認使用的是AffirmativeBased, 如果有需要,可配置為其它兩個,也可自己去實現。
##投票者
以上AccessDecisionManager的實現類都只是對權限(投票)進行管理(策略的實現),具體投票(vote)的邏輯是通過調用AccessDecisionVoter的子類(投票者)的vote方法實現的。spring security默認注冊了RoleVoter和AuthenticatedVoter兩個投票者。下面來看看其源碼。
boolean supports(ConfigAttribute attribute);
boolean supports(Class<?> clazz);
//核心方法,此方法由上面介紹的的AccessDecisionManager調用,子類實現此方法進行投票。
int vote(Authentication authentication, S object,
Collection<ConfigAttribute> attributes);
private String rolePrefix = "ROLE_";
//只處理ROLE_開頭的(可通過配置rolePrefix的值進行改變)
public boolean supports(ConfigAttribute attribute) {
if ((attribute.getAttribute() != null)
&& attribute.getAttribute().startsWith(getRolePrefix())) {
return true;
}
else {
return false;
}
}
public int vote(Authentication authentication, Object object,
Collection<ConfigAttribute> attributes) {
if(authentication == null) {
//用戶沒通過認證,則投反對票
return ACCESS_DENIED;
}
int result = ACCESS_ABSTAIN;
//獲取用戶實際的權限
Collection<? extends GrantedAuthority> authorities = extractAuthorities(authentication);
for (ConfigAttribute attribute : attributes) {
if (this.supports(attribute)) {
result = ACCESS_DENIED;
// Attempt to find a matching granted authority
for (GrantedAuthority authority : authorities) {
if (attribute.getAttribute().equals(authority.getAuthority())) {
//權限匹配則投通過票
return ACCESS_GRANTED;
}
}
}
}
//如果處理過,但沒投通過票,則為反對票,如果沒處理過,那麼視為棄權(ACCESS_ABSTAIN)。
return result;
}
很簡單吧,同時,我們還可以通過實現AccessDecisionManager來擴展自己的voter。但是,要實現這個,我們還必須得弄清楚一個東西,那就是Collection attributes這個參數是從哪兒來的,這個是個很關鍵的參數啊。通過一張官方圖能很清晰的看出這個問題來:
接下來,就看看AccessDecisionManager的調用者AbstractSecurityInterceptor。
...
//上面說過默認是AffirmativeBased,可配置
private AccessDecisionManager accessDecisionManager;
...
protected InterceptorStatusToken beforeInvocation(Object object) {
...
//抽象方法,子類實現,但由此也可看出ConfigAttribute是由SecurityMetadataSource(實際上,默認是DefaultFilterInvocationSecurityMetadataSource)獲取。
Collection<ConfigAttribute> attributes = this.obtainSecurityMetadataSource()
.getAttributes(object);
...
//獲取當前認證過的用戶信息
Authentication authenticated = authenticateIfRequired();
try {
//調用AccessDecisionManager
this.accessDecisionManager.decide(authenticated, object, attributes);
}
catch (AccessDeniedException accessDeniedException) {
publishEvent(new AuthorizationFailureEvent(object, attributes, authenticated,
accessDeniedException));
throw accessDeniedException;
}
...
}
public abstract SecurityMetadataSource obtainSecurityMetadataSource();
以上方法都是由AbstractSecurityInterceptor的子類(默認是FilterSecurityInterceptor)調用,那就再看看吧:
...
//SecurityMetadataSource的實現類,由此可��,可通過外部配置。這也說明我們可以通過自定義SecurityMetadataSource的實現類來擴展出自己實際需要的ConfigAttribute
private FilterInvocationSecurityMetadataSource securityMetadataSource;
...
//入口
public void doFilter(ServletRequest request, ServletResponse response,
FilterChain chain) throws IOException, ServletException {
FilterInvocation fi = new FilterInvocation(request, response, chain);
//關鍵方法
invoke(fi);
}
public void invoke(FilterInvocation fi) throws IOException, ServletException {
if ((fi.getRequest() != null)
&& (fi.getRequest().getAttribute(FILTER_APPLIED) != null)
&& observeOncePerRequest) {
// filter already applied to this request and user wants us to observe
// once-per-request handling, so don't re-do security checking
fi.getChain().doFilter(fi.getRequest(), fi.getResponse());
}
else {
// first time this request being called, so perform security checking
if (fi.getRequest() != null) {
fi.getRequest().setAttribute(FILTER_APPLIED, Boolean.TRUE);
}
//在這兒調用了父類(AbstractSecurityInterceptor)的方法, 也就調用了accessDecisionManager
InterceptorStatusToken token = super.beforeInvocation(fi);
try {
fi.getChain().doFilter(fi.getRequest(), fi.getResponse());
}
finally {
super.finallyInvocation(token);
}
//完了再執行(父類的方法),一前一後,AOP無處不在啊
super.afterInvocation(token, null);
}
}
好啦,到此應該對於Spring Security的權限管理比較清楚了。看完這個,不知你是否能擴展出一套適合自己需求的權限需求來呢,如果還不太清楚,那也沒關系,下篇就實戰一下 http://www.linuxidc.com/Linux/2016-12/138096.htm,根據它來開發一套自己的權限體系。
更多Spring Security相關教程見以下內容:
Spring Security 學習筆記 http://www.linuxidc.com/Linux/2016-10/135820.htm
Spring Security3.1高級詳細開發指南 PDF http://www.linuxidc.com/Linux/2016-05/131482.htm
Spring Security 學習之數據庫認證 http://www.linuxidc.com/Linux/2014-02/97407.htm
Spring Security 學習之LDAP認證 http://www.linuxidc.com/Linux/2014-02/97406.htm
Spring Security 學習之OpenID認證 http://www.linuxidc.com/Linux/2014-02/97405.htm
Spring Security 學習之X.509認證 http://www.linuxidc.com/Linux/2014-02/97404.htm
Spring Security 學習之HTTP基本認證和HTTP摘要認證 http://www.linuxidc.com/Linux/2014-02/97403.htm
Spring Security 學習之HTTP表單驗證 http://www.linuxidc.com/Linux/2014-02/97402.htm
Spring Security異常之You must provide a configuration attribute http://www.linuxidc.com/Linux/2015-02/113364.htm
Spring Security 的詳細介紹:請點這裡
Spring Security 的下載地址:請點這裡