Pelo que li sobre os frameworks de segurança, vi que o mais recomendado é o Spring Security.Mas no meu caso que não uso Spring no projeto, ele continua sendo o mais recomendado?É mais facil colocar Spring no projeto ou u…

O Spring security nada mais é do que o acegi, com a diferença que agora é um produto SpringSource I24. Tu ja testou?

Eu sei… Não testei porque não consegui arrumar as configurações dos xml’s =/ Mas só perguntei pq li em algum lugar que se a aplicação não usava Spring dava uma trabalheira, e queria saber se compensava…

Framework de Segurança

Consegui configurar o ACEGI, usando isso no web.xml

<!-- 1. Setup two parameters:          -->
<!--    a) Acegi's configuration file  -->
<!--    b) Loggin configuration file   -->
   <context-param>
	<param-name>contextConfigLocation</param-name>
	<param-value>
		/WEB-INF/applicationContext.xml
	</param-value>
   </context-param>
   
   <context-param>
	<param-name>log4jConfigLocation</param-name>
	<param-value>/WEB-INF/classes/log4j.properties</param-value>
   </context-param>


<!-- 2. Setup the Acegi Filter Chain Proxy -->   
   <filter>
        <filter-name>Acegi Filter Chain Proxy</filter-name>
        <filter-class>net.sf.acegisecurity.util.FilterToBeanProxy</filter-class>
        <init-param>
            <param-name>targetClass</param-name>
            <param-value>net.sf.acegisecurity.util.FilterChainProxy</param-value>
        </init-param>
   </filter>

    <filter-mapping>
      <filter-name>Acegi Filter Chain Proxy</filter-name>
      <url-pattern>/*</url-pattern>
    </filter-mapping>

<!-- 3. Setup three listeners -->
<!--    a) Setup a listener to connect spring with the web context -->
    <listener>
	<listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
    </listener>

<!--	b) Setup a listener to connect spring with log4J --> 
    <listener>
	<listener-class>org.springframework.web.util.Log4jConfigListener</listener-class>
    </listener>

<!--    c) Setup ACEGI to subscribe to http session events in the web context -->
    <listener>
        <listener-class>net.sf.acegisecurity.ui.session.HttpSessionEventPublisher</listener-class>
    </listener>

E isso, no applicationContext.xml

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE beans PUBLIC "-//SPRING//DTD BEAN//EN" "http://www.springframework.org/dtd/spring-beans.dtd">

<beans>

   <bean id="filterChainProxy" class="net.sf.acegisecurity.util.FilterChainProxy">
      <property name="filterInvocationDefinitionSource">
         <value>
	    CONVERT_URL_TO_LOWERCASE_BEFORE_COMPARISON
	    PATTERN_TYPE_APACHE_ANT
	    /**=httpSessionContextIntegrationFilter, authenticationProcessingFilter, anonymousProcessingFilter, securityEnforcementFilter
         </value>
      </property>
    </bean>


  <!-- The first item in the Chain: httpSessionContextIntegrationFilter -->
  <bean id="httpSessionContextIntegrationFilter" class="net.sf.acegisecurity.context.HttpSessionContextIntegrationFilter">
      <property name="context">
	      <value>net.sf.acegisecurity.context.security.SecureContextImpl</value>
      </property>
  </bean>

  
  <!-- the second item in the chain: authenticationProcessingFilter -->
   <bean id="authenticationProcessingFilter" class="net.sf.acegisecurity.ui.webapp.AuthenticationProcessingFilter">
      <property name="authenticationManager"><ref bean="authenticationManager"/></property>
      <property name="authenticationFailureUrl"><value>/login.jsf</value></property>
      <property name="defaultTargetUrl"><value>/template.jsf</value></property>
      <property name="alwaysUseDefaultTargetUrl"><value>true</value></property>
      <property name="filterProcessesUrl"><value>/j_acegi_security_check</value></property>
   </bean>

   <bean id="authenticationManager" class="net.sf.acegisecurity.providers.ProviderManager">
      <property name="providers">
       	<list>
            <ref bean="daoAuthenticationProvider"/>
	    <ref local="anonymousAuthenticationProvider"/>
        </list>
      </property>
   </bean>

   <bean id="daoAuthenticationProvider" class="net.sf.acegisecurity.providers.dao.DaoAuthenticationProvider">
      <property name="authenticationDao">
         <ref local="memoryAuthenticationDao"/>
      </property>
   </bean>
   
   <bean id="memoryAuthenticationDao" class="net.sf.acegisecurity.providers.dao.memory.InMemoryDaoImpl">
      <property name="userMap">
        <value>cauirs=cauirs,ROLE_ADMIN,ROLE_USER</value>
      </property>
   </bean>

   <bean id="anonymousAuthenticationProvider" class="net.sf.acegisecurity.providers.anonymous.AnonymousAuthenticationProvider">
      <property name="key"><value>foobar</value></property>
   </bean>


   <!-- the third item in the chain: anonymousProcessingFilter -->   
   <bean id="anonymousProcessingFilter" class="net.sf.acegisecurity.providers.anonymous.AnonymousProcessingFilter">
      <property name="key"><value>foobar</value></property>
      <property name="userAttribute"><value>anonymousUser,ROLE_ANONYMOUS</value></property>
   </bean>

   <!-- the fourth item in the chain: securityEnforcementFilter -->  
   <bean id="securityEnforcementFilter" class="net.sf.acegisecurity.intercept.web.SecurityEnforcementFilter">
      <property name="filterSecurityInterceptor"><ref local="filterInvocationInterceptor"/></property>
      <property name="authenticationEntryPoint"><ref local="authenticationProcessingFilterEntryPoint"/></property>
   </bean>


   <bean id="filterInvocationInterceptor" class="net.sf.acegisecurity.intercept.web.FilterSecurityInterceptor">
      <property name="authenticationManager"><ref bean="authenticationManager"/></property>
      <property name="accessDecisionManager"><ref local="httpRequestAccessDecisionManager"/></property>
      <property name="objectDefinitionSource">
         <value>
			    CONVERT_URL_TO_LOWERCASE_BEFORE_COMPARISON
			    PATTERN_TYPE_APACHE_ANT
			    /login.jsf*=ROLE_ANONYMOUS,ROLE_USER,ROLE_ADMIN
			    /secured*=ROLE_ADMIN
			    /**=ROLE_USER
         </value>
      </property>
   </bean>

   <!-- authenticationManager defined above -->

   <bean id="httpRequestAccessDecisionManager" class="net.sf.acegisecurity.vote.AffirmativeBased">
      <property name="allowIfAllAbstainDecisions"><value>false</value></property>
      <property name="decisionVoters">
         <list>
            <ref bean="roleVoter"/>
         </list>
      </property>
   </bean>

   <bean id="roleVoter" class="net.sf.acegisecurity.vote.RoleVoter"/>

  <bean id="authenticationProcessingFilterEntryPoint" class="net.sf.acegisecurity.ui.webapp.AuthenticationProcessingFilterEntryPoint">
      <property name="loginFormUrl"><value>/login.jsf</value></property>
      <property name="forceHttps"><value>false</value></property>
  </bean>

   <!-- Done with the chain -->

   <!-- This bean automatically receives AuthenticationEvent messages from DaoAuthenticationProvider -->
   <bean id="loggerListener" class="net.sf.acegisecurity.providers.dao.event.LoggerListener"/>

</beans>

Só que quando tento rodar o SPRING Security(versão mais nova). uso como exemplo a aplicação de teste tutorial, mas não funciona =/

3 Respostas

Topicos relacionados