Spring Security 3.1: Hello World

DOMANDA:

Come faccio a installare Spring Security 3.1 e lanciare un'applicazione funzionante in 5 minuti?

RISPOSTA:

Niente paura: ecco un tutorial veloce che fa al caso vostro.
Scaricate e scompattate nelle directory che preferite:


Spring Security 3.1
Apache commons logging 1.1.1 
AOP Alliance API 1.0 (binary jar)

CGLIB
JSTL 1.2

A questo punto creiamo un Progetto Web Dinamico di nome "HelloSecurity".

Il progetto dovrà apparire così:

Schema del progetto HelloSecurity con a destra il dettaglio delle librerie. 

Scriviamo prima i files di configurazione.

Dispatcher-servlet.xml:

<beans xmlns="http://www.springframework.org/schema/beans"
xmlns:context="http://www.springframework.org/schema/context"
xmlns:security="http://www.springframework.org/schema/security"
xmlns:p="http://www.springframework.org/schema/p"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="
  http://www.springframework.org/schema/beans    
  http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
  http://www.springframework.org/schema/context
  http://www.springframework.org/schema/context/spring-context-3.0.xsd
  http://www.springframework.org/schema/security
http://www.springframework.org/schema/security/spring-security-3.1.xsd">

<security:global-method-security pre-post-annotations="enabled" />

<context:component-scan base-package="hello.security.controller" />

<bean id="viewResolver"
  class="org.springframework.web.servlet.view.InternalResourceViewResolver"
  p:prefix="/jsp/" p:suffix=".jsp" />
</beans>

Adesso vediamo spring-security.xml:

<?xml version="1.0" encoding="UTF-8"?>
<beans:beans xmlns="http://www.springframework.org/schema/security"
  xmlns:beans="http://www.springframework.org/schema/beans"
  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  xmlns:context="http://www.springframework.org/schema/context"
  xsi:schemaLocation="http://www.springframework.org/schema/beans
  http://www.springframework.org/schema/beans/spring-beans-3.1.xsd
  http://www.springframework.org/schema/context
  http://www.springframework.org/schema/context/spring-context.xsd
  http://www.springframework.org/schema/security
  http://www.springframework.org/schema/security/spring-security-3.1.xsd">


<http auto-config="true" use-expressions="true">
    <intercept-url pattern="/jsp/admin/*" access="hasRole('admin')"  />
    <intercept-url pattern="/jsp/*" access="isAuthenticated()"  />
     
    <form-login />
    <logout />
    <remember-me />
</http>


    <authentication-manager>
   <authentication-provider>
       <user-service>
<user name="giuseppe" password="totti" authorities="admin, user"/>
<user name="fabrizio" password="ciao" authorities="autore, user"/>
<user name ="massimo" password ="12031983" authorities ="user"/>
       </user-service>
   </authentication-provider>
    </authentication-manager>
</beans:beans>

Ed infine web.xml:

<?xml version="1.0" encoding="UTF-8"?>
<web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns="http://java.sun.com/xml/ns/javaee"
xmlns:web="http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd"
xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd"
id="WebApp_ID" version="3.0">


  <display-name>HelloSecurity</display-name>
  
  <context-param>
    <param-name>contextConfigLocation</param-name>
       <param-value>
         /WEB-INF/spring-security.xml
     </param-value>
</context-param>


<filter>
    <filter-name>springSecurityFilterChain</filter-name>
     <filter-class>
       org.springframework.web.filter.DelegatingFilterProxy
    </filter-class>
</filter>
<filter-mapping>
    <filter-name>springSecurityFilterChain</filter-name>
    <url-pattern>/*</url-pattern>
</filter-mapping> 
  
  <listener>
        <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
    </listener>


    <listener>
      <listener-class>org.springframework.security.web.session.HttpSessionEventPublisher</listener-class>
    </listener>  
  
  <servlet>
    <servlet-name>dispatcher</servlet-name>
    <servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
    <load-on-startup>1</load-on-startup>
  </servlet>
  <servlet-mapping>
    <servlet-name>dispatcher</servlet-name>
    <url-pattern>*.htm</url-pattern>
  </servlet-mapping>
  
  <welcome-file-list>
    <welcome-file>index.jsp</welcome-file>
  </welcome-file-list>
</web-app>

Adesso possiamo cominciare a scrivere codice. Vediamo HelloController.java:

package hello.security.controller;

import org.springframework.security.access.prepost.PreAuthorize;
import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.RequestMapping;

@Controller
public class HelloController {

@RequestMapping("/menu.htm")
@PreAuthorize("hasRole('autore')")
public String provaPreAuthorize(){
return "autore";
}
}

Passiamo alle pagine web. Creiamo menu.jsp:

<%@ page language="java" contentType="text/html; charset=ISO-8859-1" pageEncoding="ISO-8859-1"%>
<%@ page import="org.springframework.security.core.context.SecurityContextHolder"%>
<%@ taglib prefix="sec" uri="http://www.springframework.org/security/tags" %>

<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
<title>Menu</title>
</head>
<body>

Benvenuto <b><%=SecurityContextHolder.getContext().getAuthentication().getName()%></b>,
questa è la tua pagina principale.

Menu: <br />

<br /> <a href="../index.jsp">Torna all'indice</a><br />

<sec:authorize access="isAuthenticated()">
<a href="../j_spring_security_logout">Logout</a><br />
</sec:authorize>
    
    <sec:authorize access="hasRole('admin')">
<a href="admin/adminMenu.jsp">Amministrazione</a><br />
</sec:authorize>

<br /><a href="../menu.htm">Autore (Controller)</a>
</body>
</html>

Passiamo alla pagina adminMenu.jsp:

<%@ page language="java" contentType="text/html; charset=ISO-8859-1" pageEncoding="ISO-8859-1"%>
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">

<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
<title>Menu Admin</title>
</head>
<body>


Questa pagina e' accessibile soltanto da amministratori.<br />
<br /><a href="../../index.jsp">Torna all'indice</a><br />


</body>
</html>

Concludendo con autore.jsp:

<%@ page language="java" contentType="text/html; charset=ISO-8859-1" pageEncoding="ISO-8859-1"%>
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">

<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
<title>Autore</title>
</head>
<body>



Questa e' la pagina di un autore!<br />
E l'hai raggiunta usando un controller con @PreAuthorize!<br />
<br />
<br /><a href="index.jsp">Torna all'indice</a><br />


</body>
</html>

Adesso possiamo dedicarci alla pagina di default e finire l'opera: index.jsp

<%@ page language="java" contentType="text/html; charset=ISO-8859-1" pageEncoding="ISO-8859-1"%>
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">

<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
<title>Pagina Iniziale</title>
</head>
<body>


Benvenuto. Accedi al
<a href="jsp/menu.jsp">menu</a>


</body>
</html>