프링향의 기록

php -> java + spring 마이그레이션중 Interceptor 방식으로 구현하였으나 마이그레이션 하는 김에… spring security 적용…

로그인 정상적으로 되나… 서버 재시작(세션 초기화) 하였음에도 세션 체크가 되지 않아.. 없었던일로…

나중을 위해 정리…

내 생각으론..

web.xml 에 들어오는 url-pattern 에 의해 security-context.xml 에 정의한

UserDetailsService.java 와 CustomAuthenticationProvider.java

로 각 사용자 정보를 비교하여 인증정보를 저장하여 컨트롤 하는 것으로 보여짐..

UserDetailsService.java 에서는 사용자이름(이름 또는 아이디와 같은 고유값)

을 통해 조회된 정보를 CustomAuthenticationProvider.java의

Authentication authentication 객체에 담아 넘겨줌.

넘겨준 데이터를 통해 패스워드 일치, 권한등을 추가적으로 작업…

web.xml에 추가

<filter-name>springSecurityFilterChain</filter-name>
<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class> //filter 처리을 spring security로 위임하는것
</filter>
<filter-mapping>
<filter-name>springSecurityFilterChain</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>

<context-param>
 <param-name>contextConfigLocation</param-name>
 <param-value>/WEB-INF/spring/security-context.xml</param-value>
</context-param>

2. pom.xml 추가

<dependency>
 <groupId>org.springframework.security</groupId>
 <artifactId>spring-security-core</artifactId>
<version>4.1.3.RELEASE</version>
</dependency>

<dependency>
 <groupId>org.springframework.security</groupId>
 <artifactId>spring-security-taglibs</artifactId>
 <version>4.1.3.RELEASE</version>
</dependency>

<dependency>
 <groupId>org.springframework.security</groupId>
 <artifactId>spring-security-config</artifactId>
 <version>4.1.3.RELEASE</version>
</dependency>

3. security-context.xml 추가

<?xml version="1.0" encoding="UTF-8"?>
<beans:beans
xmlns="http://www.springframework.org/schema/security"
xmlns:beans="http://www.springframework.org/schema/beans"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://www.springframework.org/schema/beans
http://www.springframework.org/schema/beans/spring-beans-4.3.xsd
http://www.springframework.org/schema/security
http://www.springframework.org/schema/security/spring-security-4.1.xsd">

<!-- expressions을 추가해야 hasRole,permitAll등의 다양한 옵션들을 쓸수 있음 -->
<http auto-config="true" use-expressions="true">
<form-login username-parameter="userId" password-parameter="userPw"
login-page="/index.do" login-processing-url="/login/login.do"
default-target-url="/user/myPage.do" authentication-failure-url="/index.do" />

<!-- 관리자만 들어갈수있음 -->
<intercept-url pattern="/admin/**" access="hasAuthority('ROLE_ADMIN')" /> 
<!-- 인증한사람만 들어갈수있음 -->
<intercept-url pattern="/user/**" access="isAuthenticated()" />
<!-- 누구나 다들어갈수 있음 -->
<intercept-url pattern="/**" access="permitAll" />


<!-- CSRF 보안 관련 처리 -->
<csrf/>

<!-- 사용시 로그인 페이지에서 form 에 추가  -->

<input type="hidden" name="${_csrf.parameterName}" value="${_csrf.token}" />
</http>


<beans:bean id="customAuthenticationProvider" class="com.ers.service.CustomAuthenticationProvider" />
<beans:bean id="userDetailService" class="com.ers.service.UserDetailService" />

<authentication-manager alias="authenticationManager">
<authentication-provider ref="customAuthenticationProvider"/>

<authentication-provider user-service-ref="userDetailService">
<!-- <password-encoder ref="passwordEncoder" /> -->
</authentication-provider>
</authentication-manager>
</beans:beans>

4. 사용자정보 조회할 UserDetailService.java 구현

package com.ers.service;

import java.util.ArrayList;
import java.util.List;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.authority.SimpleGrantedAuthority;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.core.userdetails.UsernameNotFoundException;
import org.springframework.stereotype.Service;

import com.ers.mapper.LoginMapper;
import com.ers.model.LoginInfoVO;
import com.ers.model.UserDetailVO;

@Service
public class UserDetailService implements UserDetailsService{

@Autowired
private LoginMapper loginMapper;

@Override
public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
LoginInfoVO loginInfoVO = loginMapper.getUserInfo(username);

if(loginInfoVO == null) {
throw new UsernameNotFoundException("사용자 정보를 조회 할 수 없습니다.");
}
ArrayList<GrantedAuthority> authorities = new ArrayList<GrantedAuthority>();
if("ADM".equals(loginInfoVO.getUserType())) {
authorities.add(new SimpleGrantedAuthority("ROLE_ADMIN"));
}else {
authorities.add(new SimpleGrantedAuthority("ROLE_USER"));
}

/**
* 스프링 시큐리티 관련 정보
*/
UserDetailVO userDetailVO = new UserDetailVO();
userDetailVO.setUsername(username);
userDetailVO.setPassword(loginInfoVO.getUserPw());
userDetailVO.setEnabled(true);
userDetailVO.setAuthorities(authorities);

/**
* 로그인관련 정보
*/
userDetailVO.setCmpCd(loginInfoVO.getCmpCd());
userDetailVO.setDeptCd(loginInfoVO.getDeptCd());
userDetailVO.setMoSalCd(loginInfoVO.getMoSalCd());
userDetailVO.setUserName(loginInfoVO.getUserName());
userDetailVO.setUserType(loginInfoVO.getUserType());
userDetailVO.setUserId(loginInfoVO.getUserId().toUpperCase());
userDetailVO.setLoginYn("Y");
return userDetailVO;
}
}

5. 사용자정보에 대한 인증정보 (사용자정보 있는 경우 후처리)

package com.ers.service;

import java.util.List;

import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.authentication.AuthenticationProvider;
import org.springframework.security.authentication.BadCredentialsException;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.AuthenticationException;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.authority.SimpleGrantedAuthority;
import org.springframework.security.core.userdetails.UsernameNotFoundException;
import org.springframework.stereotype.Component;

import com.ers.mapper.LoginMapper;
import com.ers.model.LoginInfoVO;
import com.ers.model.UserDetailVO;

@Component
public class CustomAuthenticationProvider implements AuthenticationProvider{

protected Logger logger = LoggerFactory.getLogger(this.getClass());

@Autowired
UserDetailService userDetailService;

@Autowired
private LoginMapper loginMapper;

@Override
public Authentication authenticate(Authentication authentication) throws AuthenticationException {
UsernamePasswordAuthenticationToken authToken = (UsernamePasswordAuthenticationToken) authentication;

UserDetailVO userInfo = (UserDetailVO) userDetailService.loadUserByUsername(authToken.getName()); //UserDetailsService에서 유저정보를 불러온다.

if(userInfo == null) {
throw new UsernameNotFoundException(authToken.getName());
}

LoginInfoVO loginInfoVO = loginMapper.getUserInfo(authToken.getName());
if(!matchPassword(userInfo.getPassword(), authToken.getCredentials())) {
throw new BadCredentialsException("not matching username or password");
}

List<GrantedAuthority> authorities = (List<GrantedAuthority>) userInfo.getAuthorities();
return new UsernamePasswordAuthenticationToken(loginInfoVO.getUserId(), loginInfoVO.getUserPw(), authorities);
}

@Override
public boolean supports(Class<?> authentication) {
return true;
}

private boolean matchPassword(String password, Object credentials) {
return password.equals(credentials);
}
}

0 글이 마음에 드셨다면 하트 꾸욱~

1. pom.xml 추가

<dependency>
<groupId>javax.servlet.jsp</groupId>
<artifactId>jsp-api</artifactId>
<version>2.0</version>
<scope>provided</scope>
</dependency>

2. java 파일 작성

public class Title extends SimpleTagSupport{

private String title;

public void setTitle(String title) {
this.title = title;
}

@Override
public void doTag() throws JspException, IOException {
// TODO Auto-generated method stub
if(title == null) {
title = “”;
}
String str = “<h3>”+title+”</h3>”;
JspWriter out = getJspContext().getOut();
out.println(str);
super.doTag();
}
}

3. tld 작성

/WEB-INF/tlds 폴더 밑으로 작성함

custom.tld

<?xml version=”1.0″ encoding=”UTF-8″?>
<taglib xmlns=”http://java.sun.com/xml/ns/j2ee”
xmlns:xsi=”http://www.w3.org/2001/XMLSchema-instance”
xsi:schemaLocation=”http://java.sun.com/xml/ns/j2ee http://java.sun.com/xml/ns/j2ee/web-jsptaglibrary_2_0.xsd”
version=”2.0″>

<description>User Custom Tag Library</description>
<tlib-version>1.0</tlib-version>
<short-name>custom</short-name>
<tag>
<name>title</name>
<tag-class>com.ers.common.Title</tag-class>
<body-content>scriptless</body-content>
<attribute>
<name>title</name>
<required>true</required>
<rtexprvalue>true</rtexprvalue>
</attribute>
</tag>
</taglib>

4. web.xml 추가

제일 하단에 jsp-config 추가

<jsp-config>
<taglib>
<taglib-uri>/WEB-INF/tlds/custom.tld</taglib-uri>
<taglib-location>/WEB-INF/tlds/custom.tld</taglib-location>
</taglib>
</jsp-config>

5. 사용하기

<%@ taglib prefix=”custom” uri=”/WE<custom:title title=”마이페이지” />

<custom:title title=”마이페이지” />

와 같이 사용 가능..

0 글이 마음에 드셨다면 하트 꾸욱~

카테고리: IT

스프링에서 JSONObject return 하기

Spring security 설정 정리…(스프링시큐리티)

스프링 태그 라이브러리 사용하기

현재 객체가 몇번째 (index) 객체인지 확인하기..