Acegi configuration (2)

In the applicationContext-acegi-security.xml 1. FILTERCHAINFilterChainProxy will call these filters in order to enable these filters to enjoy Springioc functionality, which defines that the url is converted to lowercase before comparison, PATTERN_TYPE_APACHE_ANT defines the use of

In applicationContext-acegi-security.xml 1. filter chain FilterChainProxy calls these filters in order to enable these filters to use Spring ioc functions. CONVERT_URL_TO_LOWERCASE_BEFORE_COMPARISON defines that the url is converted to lowercase before comparison, and PATTERN_TYPE_APACHE_ANT defines the use of

1. filter chain in applicationContext-acegi-security.xml

FilterChainProxy calls these filters in order to enable these filters to use Spring ioc functions. CONVERT_URL_TO_LOWERCASE_BEFORE_COMPARISON defines that the url is converted to lowercase before comparison, and PATTERN_TYPE_APACHE_ANT defines the matching mode using Apache ant.

    
 
  
        
  
   
            
   
    
                CONVERT_URL_TO_LOWERCASE_BEFORE_COMPARISON
    
                PATTERN_TYPE_APACHE_ANT
    
               /**=httpSessionContextIntegrationFilter,authenticationProcessingFilter,
    
basicProcessingFilter,rememberMeProcessingFilter,anonymousProcessingFilter,
    
 exceptionTranslationFilter,filterInvocationInterceptor
    
            
   
   
        
  
  
    
 

2. Basic Authentication

1)AuthenticationManager
It is used for certification management. It delegates the verification function to multiple Providers and traverses Providers to obtain identity authentication from different sources, if a Provider can successfully confirm the identity of the current user, the authenticate () method returns a complete Authentication object containing the user authorization information. Otherwise, an AuthenticationException is thrown.
Acegi provides different AuthenticationProvider implementations, such:
DaoAuthenticationProvider reads user information from the database to verify identity
AnonymousAuthenticationProvider anonymous user Identity Authentication
RememberMeAuthenticationProvider has stored the user information in the cookie for identity authentication.
AuthByAdapterProvider authenticates the identity using the container's Adapter
CasAuthenticationProvider authenticates the identity based on the Yale Center authentication service for single-point Login
JaasAuthenticationProvider obtains user information from the JASS login configuration to authenticate the identity
RemoteAuthenticationProvider authenticates the user identity based on the remote service
RunAsImplAuthenticationProvider authenticates users whose identities have been replaced by the manager.
X509AuthenticationProvider obtains user information from X509 authentication to authenticate the identity
TestingAuthenticationProvider used for unit testing

Each authenticator authenticates the certification information specified by himself. For example, DaoAuthenticationProvider authenticates only the authentication information UsernamePasswordAuthenticationToken.

2)DaoAuthenticationProvider
Perform simple database-based authentication. DaoAuthenticationProvider obtains and matches the account and password in the database. If the Authentication succeeds, an Authentication object containing authorization information is returned when the user identity is used. Otherwise, Authentication fails and an AuthenticatiionException is thrown.

3)PasswordEncoder
Use the encryptor to encrypt the plaintext entered by the user. Acegi provides three Encryptors:
PlaintextPasswordEncoder-default, not encrypted, return plaintext.
ShaPasswordEncoder-SHA Encryption
Md5PasswordEncoder-Message Digest (MD5) Encryption

4)JdbcDaoImpl
Used to obtain user information in data. Acegi provides the user and authorized table structure, but you can also implement it by yourself. Get your (User ID, password, status information) through the SQL statement usersByUsernameQuery; get your (User ID, authorization information) through the SQL statement authoritiesByUsernameQuery)

 
 
  
        
  
  
        
  
   
            
   
    select loginid,passwd,1 from users where loginid = ?
   
   
        
  
  
        
  
   
            
   
    select u.loginid,p.name from users u,roles r,permissions p,user_role ur,role_permis rp where u.id=ur.user_id and r.id=ur.role_id and p.id=rp.permis_id and
    
                r.id=rp.role_id and p.status='1' and u.loginid=?
   
   
        
  
  

 

5)UserCache & resourceCache
The permission information corresponding to the cached user and resource. Every time a protected resource is requested, daoAuthenticationProvider is called to obtain user authorization information. If you get the information from the database every time, it is very costly. for users and resources that are not often changed, it is best to cache the relevant authorization information. (For details, see section 2.6.3 resource permission definition extension)
UserCache provides two implementation methods: NullUserCache and EhCacheBasedUserCache. NullUserCache actually does not cache any data. EhCacheBasedUserCache uses Ehcache to implement the easing function.

6)BasicProcessingFilter
It is used to process authentication information of HTTP headers, such as retrieving user information from the HTTP headers of Spring remote protocol (such as Hessian and Burlap) or common browsers such as IE and Navigator, transfer them to the authentication manager assembled through the authenticationManager attribute. If the Authentication succeeds, an Authentication object will be put into the session. Otherwise, if the Authentication fails, the control will be transferred to the Authentication entry point (assembled through the authenticationEntryPoint attribute)

7)BasicProcessingFilterEntryPoint
Send an HTTP401 (unauthorized) message to your browser, prompting you to log on.
Handle the HTTP-based authorization process. When an exception occurs during the verification process, the "direction" function is usually implemented, and the error information is added to the response.

8)AuthenticationProcessingFilterEntryPoint
When an AccessDeniedException is thrown, the user is redirected to the logon interface. The attribute loginFormUrl is configured with a login form URL. When a user needs to log on, authenticationProcessingFilterEntryPoint redirects the user to this URL

 
 
  
        
  
   
            
   
    /security/login.jsp
   
   
        
  
  
        
  
  

 

2.2.3 HTTP security request

1)HttpSessionContextIntegrationFilter
HttpSessionContextIntegrationFilter obtains the Authentication object from the Session before each request. After the request is complete, the Authentication object is saved to the Session for use in the next request. This filter must be used before other Acegi filters, it can span multiple requests.

2)HttpRequestAccessDecisionManager
The voting mechanism determines whether a resource (URL or method) can be accessed ). If the value of allowIfAllAbstainDecisions is false, if one or more decisionVoters votes, the authorization is passed. Optional decision-making mechanisms include ConsensusBased and UnanimousBased.

3)RoleVoter
Only permissions starting with the value set by rolePrefix can be used for voting, such as AUTH _, ROLE _

4)Predictiontranslationfilter
The exception conversion filter mainly processes AccessDeniedException and AuthenticationException, and finds a proper "destination" for each exception"

5)AuthenticationProcessingFilter
Similar to servlet spec, which processes login requests. When Authentication is successful, AuthenticationProcessingFilter places an Authentication object in the session and redirects to the logon success page.
AuthenticationFailureUrl defines the page to be redirected when logon fails.
DefaultTargetUrl defines the page to be switched upon successful login
FilterProcessesUrl defines the login request page
RememberMeServices is used to add cookie information after successful verification

    
 
  
        
  
  
        
  
   
            
   
    /security/login.jsp?login_error=1
   
   
        
  
  
        
  
   
            
   
    /admin/index.jsp
   
   
        
  
  
        
  
   
            
   
    /j_acegi_security_check
   
   
        
  
  
        
  
  
    
 

6)FilterInvocationInterceptor
Check the user permission information set in objectDefinitionSource before turning to the url. First, objectDefinitionSource defines the attribute information required to access the URL (the attribute information here is only a flag, telling accessDecisionManager which voters to vote ). AuthenticationManager then uses its own provider to verify the user's authentication information. Finally, some voters call their own voter to vote based on the attributes required by the user's authentication and access url, and decide whether to allow access.

7)FilterDefinitionSource(For details, see section 2.6.3 resource permission definition extension)
Customize DBFilterInvocationDefinitionSource to read protection resource and required access permission information from the database and cache

2.2.4 method call Security Control

(For details, see section 2.6.3 resource permission definition extension)

1) methodSecurityInterceptor
Intercept the method and check the user permission information.
2) methodDefinitionSource
Custom MethodDefinitionSource read permission from cache

3. Jcaptcha Verification Code

Using http://jcaptcha.sourceforge.net as a general verification code solution, please refer to the examples in SpringSide, or online:
Http://www.coachthrasher.com/page/blog? Entry = jcaptcha_with_appfuse.