Spring Security InMemory + JDBCImpl 설정 방법.

ITWeb/개발일반 2012. 3. 12. 17:22

가장 쉽게 접근할 수 있는 방법에 대해서 기술 합니다.
모든 내용의 기초는 아래 사이트에서 참고하였습니다.
- 없는건 검색했고요.. ㅎㅎ

http://static.springsource.org/spring-security/site/docs/3.1.x/reference/springsecurity-single.html

[spring-security.xml InMemory]

<?xml version="1.0" encoding="UTF-8"?>

<beans:beans xmlns="http://www.springframework.org/schema/security"

xmlns:beans="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"

xsi:schemaLocation="http://www.springframework.org/schema/beans

http://www.springframework.org/schema/beans/spring-beans-3.0.xsd

http://www.springframework.org/schema/security

http://www.springframework.org/schema/security/spring-security-3.1.xsd">

<global-method-security secured-annotations="enabled" />

<intercept-url pattern="/login.html*" access="IS_AUTHENTICATED_ANONYMOUSLY" />

<intercept-url pattern="/welcome.html*" access="IS_AUTHENTICATED_ANONYMOUSLY" />

<intercept-url pattern="/**" access="ROLE_ADMIN" />

<form-login login-page='/login.html' default-target-url='/index.html' always-use-default-target='true' authentication-failure-url="/login.html" />

<remember-me key="daSDAsdaSDsa" />

</http>

<authentication-manager>

<authentication-provider>

<user-service>

</user-service>

</authentication-provider>

</authentication-manager>

[spring-security.xml JDBCImpl Case 1]
- InMemory 코드에서 빨간 부분이 변경 됩니다.

<jdbc-user-service data-source-ref="dataSource"

users-by-username-query="SELECT username, password, enabled FROM users WHERE username=?"

authorities-by-username-query="SELECT u.username, au.authority FROM users u, authorities au WHERE u.username=? AND au.username=u.username"

[spring-security.xml JDBCImpl Case 2]

<?xml version="1.0" encoding="UTF-8"?>

<beans:beans xmlns="http://www.springframework.org/schema/security"

xmlns:beans="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"

xsi:schemaLocation="http://www.springframework.org/schema/beans

http://www.springframework.org/schema/beans/spring-beans-3.0.xsd

http://www.springframework.org/schema/security

http://www.springframework.org/schema/security/spring-security-3.1.xsd">

<global-method-security secured-annotations="enabled" />

<intercept-url pattern="/login.html*" access="IS_AUTHENTICATED_ANONYMOUSLY" />

<intercept-url pattern="/welcome.html*" access="IS_AUTHENTICATED_ANONYMOUSLY" />

<intercept-url pattern="/**" access="ROLE_ADMIN" />

<form-login login-page='/login.html' default-target-url='/index.html' always-use-default-target='true' authentication-failure-url="/login.html" />

<remember-me key="daSDAsdaSDsa" />

</http>

<authentication-manager>

<authentication-provider user-service-ref="userDetailsService" />

</authentication-manager>

<beans:bean id="userDetailsService" class="org.springframework.security.core.userdetails.jdbc.JdbcDaoImpl">

<beans:property name="dataSource" ref="dataSource"/>

</beans:bean>

</beans:beans>

※ 이넘들이 사용하는 Table Schema 는 아래 글 참고 하세요.
- http://jjeong.tistory.com/610

그리고 참고하기 위해서 JdbcDaoImpl.java 코드 올려 봅니다.
이 코드를 보시면 이해 하는데 도움이 될겁니다.

※ 코드를 보시니 이제 감이 오시나요???
그렇습니다.
JdbcImpl.java 와 같은 넘을 biz 요구사항에 맞춰서 작성을 하시면 customized authentication 과 authority 를 구현 하실 수 있습니다. ^^
그래도 잘 모르시겠다구요.
그럼 아래를 참고하세요.
이미 정리 된 문서가 있어서 link 겁니다.

[원본링크]

http://redmine.miracom.co.kr/projects/33/wiki/Spring_Security_%EC%84%A4%EC%A0%95_%EB%B0%A9%EB%B2%95

Spring Security 설정 방법

web.xml에 Spring Security Filter 추가

    <filter>
      <filter-name>springSecurityFilterChain </filter-name>
      <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
    </filter>

    <filter-mapping>
      <filter-name>springSecurityFilterChain </filter-name>
      <url-pattern>/*</url-pattern>
    </filter-mapping>

url-pattern은 보안을 걸고 싶은 url pattern을 설정가능하다.

web.xml에 Spring Context Loader 추가

    <context-param>
        <param-name>contextConfigLocation</param-name>
        <param-value>classpath*:META-INF/config/beans*.xml</param-value>
    </context-param>
    <listener>
        <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
    </listener>

contextConfigLocation은 Spring 설정 파일(application context) 위치를 지정.
```
classpath*:META-INF/config/beans*.xml
```
- classpath의 META-INF/config 폴더의 beans로 시작하는 모든 xml 파일을 의미

classpath에 Spring Security 설정 파일인 beans-security.xml 추가

beans-security.xml

<?xml version="1.0" encoding="UTF-8"?>
<beans:beans xmlns="http://www.springframework.org/schema/security" 
    xmlns:beans="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
    xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
                        http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.0.xsd">

    <global-method-security pre-post-annotations="enabled"/>

    <http auto-config="true" use-expressions="true">
        <http-basic/>

        <intercept-url pattern="/index.jsp" access="permitAll" />
        <intercept-url pattern="/login.jsp" access="permitAll" />
        <intercept-url pattern="/timeout.jsp" access="permitAll" />
        <intercept-url pattern="/authenticationFail.jsp" access="permitAll" />
        <intercept-url pattern="/*" access="isAuthenticated()" />
        <intercept-url pattern="/admin/**" access="hasRole('ROLE_ADMIN')" />
        <intercept-url pattern="/public/**" access="permitAll" />

        <logout />

    </http>

    <!-- Memory User Service -->
    <authentication-manager> 
        <authentication-provider> 
            <user-service> 
                <user name="s3im" password="miracom" authorities="ROLE_ADMIN, ROLE_USER, ROLE_TELLER" /> 
                <user name="myjung" password="miracom" authorities="ROLE_USER,ROLE_TELLER"/> 
            </user-service>
        </authentication-provider>
    </authentication-manager> 

    <!-- DB User Service -->
    <!-- 
    <authentication-manager alias="authenticationManager">
        <authentication-provider user-service-ref="userService"/>
    </authentication-manager>

    <beans:bean id="userService" 
        class="com.mesplus.server.security.authentication.MesplusUserService">
        <beans:property name="userDao" ref="meplusUserDAO" />
    </beans:bean>
    -->
</beans:beans>

url 패턴 별로 인증 및 권한 설정
- intercept-url의 pattern을 이용해서 URL 패턴 별로 인증 및 권한을 설정
  - access 속성의 권한설정은 다음과 같은 것을 할 수 있음
    - permitAll은 모든 사람에게 접근가능
    - isAuthenticated()은 인증(로그인)한 사람만 접근가능
    - hasRole(~)은 지정된 role을 가지고 있는 사람만 접근가능
      - 여러개의 role에 허용할 경우 ,로 구분

사용자 추가 (설정파일 - 메모리)

bean-security.xml의 다음 부분에 user 추가

    <!-- Memory User Service -->
    <authentication-manager> 
        <authentication-provider> 
            <user-service> 
                <user name="s3im" password="miracom" authorities="ROLE_ADMIN, ROLE_USER, ROLE_TELLER" /> 
                <user name="myjung" password="miracom" authorities="ROLE_USER,ROLE_TELLER"/> 
            </user-service>
        </authentication-provider>
    </authentication-manager>

user-service 태그 안에 user 태그를 수정, 추가, 삭제하여 user 관리
- name은 아이디
- password는 암호
- authorities는 역할, 두개 이상 있으면 ,로 구분

사용자 추가 (DB 모델 기반)

bean-security.xml의 다음 부분에 user 추가

    <!-- DB User Service -->
    <authentication-manager alias="authenticationManager">
        <authentication-provider user-service-ref="userService"/>
    </authentication-manager>

    <beans:bean id="userService" 
        class="com.mesplus.server.security.authentication.MesplusUserService">
        <beans:property name="userDao" ref="meplusUserDAO" />
    </beans:bean>

    <beans:bean id="meplusUserDAO" 
        class="com.mesplus.server.security.user.dao.impl.MesplusUserDaoHibernateImpl">
        <beans:property name="sessionFactory" ref="sessionFactory"/>
    </beans:bean>

authentication manager에 유저 정보를 제공하는 user service는 org.springframework.security.core.userdetails.UserDetailsService 인터페이스를 구현해야함.

MESPlusUserService.java 작성

public class MesplusUserService implements UserDetailsService{
    private Log log;
    public MesplusUserService(){
        log = LogFactory.getLog(this.getClass().getSimpleName());
    }
    @Autowired
    private MesplusUserDao userDao;
    @Override
    public UserDetails loadUserByUsername(String username)
            throws UsernameNotFoundException, DataAccessException {
        try {
            UserDetails userDetails = userDao.findByUsername(username);
            if(userDetails == null){
                StringBuilder logMsg = (new StringBuilder("Username(")).append(username).append(") not found!");
                log.debug(logMsg.toString());
                throw new UsernameNotFoundException(logMsg.toString());
            }
            return userDetails;
        } catch (Exception e) {
            StringBuilder logMsg = (new StringBuilder("Username(")).append(username).append(") access exception!");
            log.debug(logMsg.toString(), e);
            throw new UsernameNotFoundException(logMsg.toString(), e);
        }
    }
    public MesplusUserDao getUserDao() {
        return userDao;
    }
    public void setUserDao(MesplusUserDao userDao) {
        this.userDao = userDao;
    }
}

REST용 추가 설정

web.xml에 HTTP Hidden Method Filter 추가

    <filter>
        <filter-name>HttpMethodFilter</filter-name>
        <filter-class>org.springframework.web.filter.HiddenHttpMethodFilter</filter-class>
    </filter>
    <filter-mapping>
        <filter-name>HttpMethodFilter</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>

jjeong

Spring Security InMemory + JDBCImpl 설정 방법.

Spring Security 설정 방법

REST용 추가 설정

티스토리툴바