每個(gè) APP 使用 Tomcat JDBCRealm 進(jìn)行認(rèn)證 (Authentication)，但使用 Spring Security 進(jìn)行授權(quán)。兩者基于相同的用戶信息數(shù)據(jù)庫(kù)。
在 Tomcat 中打開(kāi) SSO -- 這個(gè)很重要，否則訪問(wèn)同一個(gè)域中其它 webapp 時(shí)，不會(huì)帶上 Cookie，也就無(wú)法認(rèn)證了
在每個(gè) webapp 中，配置 Web.xml 使用 Tomcat 進(jìn)行認(rèn)證 -- 如果用 Spring 進(jìn)行認(rèn)證，則 Tomcat 的 SSO 不起作用
在每個(gè) webapp 中，配置 spring，使用 J2eePreAuthenticatedProcessingFilter，進(jìn)行權(quán)限控制 (Authorization)
spring.xml 中的配置
<bean id="encoder" class="org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder">
<constructor-arg name="strength" value="11" />
</bean>
<bean id="forbiddenEntryPoint" class="org.springframework.security.web.authentication.Http403ForbiddenEntryPoint"/>
<security:http auto-config="false" use-expressions="true" entry-point-ref="forbiddenEntryPoint">
<security:custom-filter position="PRE_AUTH_FILTER" ref="preAuthFilter"/>
<security:intercept-url pattern="/index/**" access="hasAnyRole('ROLE_SUPER')" />
<security:session-management session-fixation-protection="none"/>
<security:csrf disabled="true"/>
</security:http>
<bean id="preauthAuthProvider" class="org.springframework.security.web.authentication.preauth.PreAuthenticatedAuthenticationProvider">
<property name="throwExceptionWhenTokenRejected" value="true"/>
<property name="preAuthenticatedUserDetailsService">
<bean id="userDetailsServiceWrapper" class="org.springframework.security.core.userdetails.UserDetailsByNameServiceWrapper">
<property name="userDetailsService" ref="nosUserDetailsService" />
</bean>
</property>
</bean>
<bean id="preAuthenticatedProcessingFilterEntryPoint" class="org.springframework.security.web.authentication.Http403ForbiddenEntryPoint"/>
<bean id="webXmlMappableAttributesRetriever" class="org.springframework.security.web.authentication.preauth.j2ee.WebXmlMappableAttributesRetriever"/>
<bean id="simpleAttributes2GrantedAuthoritiesMapper" class="org.springframework.security.core.authority.mapping.SimpleAttributes2GrantedAuthoritiesMapper">
<property name="attributePrefix" value=""/>
</bean>
<bean id="j2eeBasedPreAuthenticatedWebAuthenticationDetailsSource" class="org.springframework.security.web.authentication.preauth.j2ee.J2eeBasedPreAuthenticatedWebAuthenticationDetailsSource">
<property name="mappableRolesRetriever" ref="webXmlMappableAttributesRetriever"/>
<property name="userRoles2GrantedAuthoritiesMapper" ref="simpleAttributes2GrantedAuthoritiesMapper"/>
</bean>
<bean id="preAuthFilter" class="org.springframework.security.web.authentication.preauth.j2ee.J2eePreAuthenticatedProcessingFilter">
<property name="authenticationManager" ref="authenticationManager"/>
<property name="authenticationDetailsSource" ref="j2eeBasedPreAuthenticatedWebAuthenticationDetailsSource"/>
</bean>
<security:authentication-manager alias="authenticationManager">
<security:authentication-provider ref="preauthAuthProvider"/>
</security:authentication-manager>
