狠狠撸

??? ???? ?? ??
(? ?????? ??)
?? ?????, ???, 2014-07-09

??
● ??? ????? ?? ??? ?? ?? ?
?
○ ?? ?? ?????? ??? ??!

?? ?? 3??
● ?? ??(Principal)
○ ??? ??? ???? ???
● ??(Authenticate)
○ ?? ???? ???? ???? ??
○ ????? ???/??? ???? ??? ??
● ??(Authorize)
○ ?? ???? ?? ??(URL, ?? ?)? ??(??)
? ??? ??? ???? ?

??? ????? ?? 3??? ??
?? ??
??
??
Authentication
Authentication
Manager
Security
Interceptor

Authentication? SecurityContext
● Authentication? ??
○ ?? ?? ?? ??? ?? ??
○ ?? ??? ?, ?? ??? ?? ??
● SecurityContext
○ Authentication? ??
○ ??? ????? ?? ???? ??
Authentication ??? ?? ? SecurityContext??
? ??

SecurityContextHolder
● SecurityContext? ??
○ ??: ?????? SecurityContext? ??
● ???? SecurityContext ?? ??
Authentication auth = someMethodForGettingAuth(req, resp);
try {
SecurityContextHolder.getContext().setAuthentication(auth);
chain.doFilter(request, response); // ?? ???? ?? SecurityContext ??
} finally {
SecurityContextHolder.clearContext();
}
??? ????? ??? ?? ?? ??

??, Authentication? ?? ???
● Authentication? ?? ???
○ String getName(): ???? ??
○ Object getCredential(): ?? ? (???? ?)
○ Object getPrincipal(): ?? ?? ??
○ boolean isAuthenticated(): ?????? ??
○ Collection<GrantedAuthority) getAuthorities(): ??
???? ?? ??(GrantedAuthority)

AuthenticationManager
● ??? ???
public interface AuthenticationManager {
Authentication authenticate(Authentication authentication)
throws AuthenticationException;
}
● ??? ???? ?? ??? ?? ?? Authentication ?? ??
○ ??? ????? ??? Authentication ??? SecurityContext?
?? ? ?? ??? ???? ?? ??? ??
● ?? ??? AuthenticationException? ????

(Abstract)SecurityInterceptor
● ??? ??
○ ?? ?? FilterSecurityInterceptor ?? ??
○ AccessDecisionManager? ?? ?? ??
public interface AccessDecisionManager {
void decide(Authentication authentication, // ???
Object object, // ?? ??
Collection<ConfigAttribute> configAttributes) // ?? ??
throws AccessDeniedException, InsufficientAuthenticationException;
boolean supports(ConfigAttribute attribute);
boolean supports(Class<?> clazz);
}
● ???? ??? ?? ?? ????, ?? ??? ?? ?? ??? ??

? ?????? ?? ??
● ?? ?? ??? ??? ?? ??
FilterChainProxy
?? ?? ??
?? ??
?? ?? ??? ??
- Authentication ?? ??
- ?? ?? ??
- ?? ?? ??
<sec:http use-expressions="true">
<sec:intercept-url pattern="/admin/**"
access="hasAuthority('ROLE_ADMIN')" />
<sec:intercept-url pattern="/manager/**"
access="hasRole('ROLE_MANAGER')" />
<sec:intercept-url pattern="/member/**"
access="isAuthenticated()" />
<sec:intercept-url pattern="/**"
access="permitAll"/>
<sec:form-login />
<sec:logout />
</sec:http>
??
??
??? ??? ??? ??
(springSecurityFilterChain)

? ??? FilterChainProxy ??
<filter>
<filter-name>
springSecurityFilterChain
</filter-name>
<filter-class>
o...filter.DelegatingFilterProxy
</filter-class>
</filter>
<filter-mapping>
<filter-name>springSecurityFilterChain</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
FilterChainProxy
?? ?? ??
DelegatingFilterProxy

?? ?? ??
?? ?? ??? ?? ?? ??
SecurityContextPersistenceFilter
LogoutFilter
UsernamePasswordAuthenticationFilter
DefaultLoginPageGeneratingFilter
AnonymousAuthenticationFilter
ExceptionTranslationFilter
FilterSecurityInterceptor?? ?? ??
??? ??
??? ? ??
?? ?? ??
???? ?? ??
Authentication ?? ● ?? ??? ???? ?
?
● ??? ?? ??? ??
?? ?? ??? ???
? ?
?? ??? ??

?? ?? ?? ? ??, ?? ?
?? ?? ??
LogoutFilter
FilterSecurityInterceptor
1. ??
Access
Decision
Manager 2. ?? ??
??
4. ??? ??
Authentication
EntryPoint
5. ?? ?
? ?? ?
?
<sec:form-login
login-page="/user/loginform"
/>

?? ?? ?? ? ??, ?? ??
?? ?? ??
LogoutFilter
1. ??
Access
Decision
Manager 3. ?? ??
??
4. ??? ??
AccessDenied
Handler
5. ?? ??
?? ??
<sec:access-denied-handler
error-page="/accessDenied"/>
SecurityContext
Repository
2. ??? SecurityContext?
??

?? ??? ? ??
?? ?? ??
LogoutFilter
1. /spring_security_login ?
? ??
2. ??? ?
?? ??

?? ?? ?? ?? (???)
?? ?? ??
LogoutFilter
1. ?? ??
Authentication
Manager
2. ?? ??
SecurityContext
3. Authentication ??
Authentication
SuccessHandler
4. ?? ???
SecurityContext
Repository
5. SecurityContext ??
<sec:form-login
login-processing-url="/user/login"
username-parameter="userid"
password-parameter="password"
default-target-url="/index"
/>

?? ?? ?? ?? (???)
?? ?? ??
LogoutFilter
1. ?? ??
Authentication
Manager
2. ?? ??
Authentication
FailureHandler
3. ?? ???
<sec:form-login
...
authentication-failure-url="/user/loginform?error=true"
/>

???? ?? ?? ??
?? ?? ??
LogoutFilter
1. ?? ??
??
LogoutSuccess
Handler
3. ???? ?
??
LogoutHandler
2. ???? ?
?
<sec:logout logout-url="/user/logout"
logout-success-url=”/”
/>

AuthenticationManager ??1
<sec:authentication-manager>
<sec:authentication-provider>
...
</sec:authentication-provider>
</sec:authentication-manager>
??? ?? ????? ?? ??
AuthenticationProvider? ??

AuthenticationManager ??2
<sec:user-service>
<sec:user name="bkchoi" password="1234"
authorities="ROLE_USER" />
</sec:user-service>
<sec:jdbc-user-service
data-source-ref="dataSource"
id="jdbcUserService" />

??? ?? ??
<sec:authentication-manager >

<sec:authentication-provider ref="customAuthenticationProvider" />

<sec:authentication-provider
user-service-ref="customUserDetailsService" />
</sec:authentication-manager>

&
AccessDecisionManager

<sec:intercept-url pattern="/user/loginform" access="permitAll" />
<sec:intercept-url pattern="/user/login" access="permitAll" />
<sec:intercept-url pattern="/admin/usermanager/**"
access="hasAuthority('USER_MANAGER')" />
...
</sec:http>

AccessDecisionManager
...
</sec:http>

狠狠撸

??????? ???????? ???? ????

Recommended

More Related Content

What's hot (20)

Similar to ??????? ???????? ???? ???? (20)

More from beom kyun choi (20)

??????? ???????? ???? ????