2

我正在使用 spring MVC 并想检查用户的试用期是否已过期。

我正在使用以下方法使用 Spring Security 获取用户详细信息

  public User getUserDetail() {
    Authentication auth = SecurityContextHolder.getContext()
            .getAuthentication();   
    Object principal = auth.getPrincipal();
        if(principal instanceof User){
            User user = (User) principal;               
            return user;
        }
        return null;
}

用户对象包含他第一次登录的日期。

我正在使用以下代码检查用户订阅

   UserBean userLoggedIn = (UserBean) userService.getUserDetail();

    Date dt =  userLoggedIn.getUserCreationDate();

    DateTime userCreated =  new DateTime(dt).plusDays(TRIAL_PERIOD);

    DateTime currentDateTime = new DateTime();


    if(currentDateTime.compareTo(userCreated) > 0 && userLoggedIn.getPackageType() == 0){
        return new ModelAndView("pricing","user",userLoggedIn);
    }

现在我的问题是我不想在每个控制器中重复编写上面的代码。那么有什么常见的地方可以让我检查用户试用期是否到期并将他重定向到定价页面。

我有 CustomUserDetail 类，我在其中从数据库访问用户详细信息并将其放入 spring 安全会话中。所以我认为这应该是检查用户试用期是否到期的最佳地点，但我不知道如何将用户从此类重定向到定价页面。

我的 CustomUserDetail 类是

  @Service
  @Transactional(readOnly = true)
 public class CustomUserDetailsService implements UserDetailsService {

static final Logger logger = Logger.getLogger(CustomUserDetailsService.class);


@Resource(name="userService")
private UserService userService;

/* (non-Javadoc)
 * @see org.springframework.security.core.userdetails.UserDetailsService#loadUserByUsername(java.lang.String)
 */
@Override
public UserDetails loadUserByUsername(String email)
        throws UsernameNotFoundException, DataAccessException {
        try {

            boolean enabled = true;
            boolean accountNonExpired = true;
            boolean credentialsNonExpired = true;
            boolean accountNonLocked = true;

            UserBean domainUser = userService.getUserByName(email);     

            domainUser.isEnabled();
            domainUser.isAccountNonExpired();
            domainUser.isCredentialsNonExpired();
            domainUser.isAccountNonLocked();


    //Collection<? extends GrantedAuthority> roles =  getAuthorities((long) domainUser.getRoleId());

    return domainUser;


    } catch (Exception e) {
        logger.error("Invalid Login.",e);
        throw new RuntimeException(e);
    }
}

- -更新 - -

我的 spring-security.xml 是

    <form-login login-page="/login.htm" 
                authentication-failure-url="/loginfailed.htm"
                authentication-failure-handler-ref="exceptionMapper"
                default-target-url="/index.htm" 
                always-use-default-target="true"/>

    <access-denied-handler error-page="/logout.htm"/>

    <logout invalidate-session="true" 
        logout-url="/logout.htm"
        success-handler-ref="userController"/>
 <remember-me user-service-ref="customUserDetailsService" key="89dqj219dn910lsAc12" use-secure-cookie="true"  token-validity-seconds="466560000"/>
 <session-management session-authentication-strategy-ref="sas"/>
</http>

<authentication-manager>
        <authentication-provider user-service-ref="customUserDetailsService">
                <password-encoder ref="customEnocdePassword" >
                    <salt-source user-property="email"/>
                </password-encoder>
        </authentication-provider>
</authentication-manager>   
<beans:bean id="customEnocdePassword" class="com.mycom.myproj.utility.CustomEnocdePassword" />

<beans:bean id="exceptionMapper" class="org.springframework.security.web.authentication.ExceptionMappingAuthenticationFailureHandler" >
<beans:property name="exceptionMappings">
    <beans:map>
        <beans:entry key="your.package.TrialPeriodExpiredException" value="/pricing"/>
    </beans:map>
</beans:property>
</beans:bean>

<beans:bean id="sas"
  class="org.springframework.security.web.authentication.session.ConcurrentSessionControlStrategy">
<beans:constructor-arg name="sessionRegistry" ref="sessionRegistry" />
<beans:property name="maximumSessions" value="3" />

- -更新 - -

现在我所做的是

 <beans:bean id="authenticationProvider" class="org.springframework.security.authentication.dao.DaoAuthenticationProvider">
    <beans:property name="userDetailsService" ref="customUserDetailsService"/>
    <beans:property name="passwordEncoder" ref="customEnocdePassword"/>
    <beans:property name="preAuthenticationChecks" ref="expirationChecker"/>
</beans:bean>

<authentication-manager>
    <authentication-provider user-service-ref="authenticationProvider">
        <password-encoder ref="customEnocdePassword" >
               <salt-source user-property="email"/>
        </password-encoder>
    </authentication-provider>
</authentication-manager>

<!-- <authentication-manager>
        <authentication-provider user-service-ref="customUserDetailsService">
                <password-encoder ref="customEnocdePassword" >
                    <salt-source user-property="email"/>
                </password-encoder>
        </authentication-provider>
</authentication-manager> -->
<beans:bean id="expirationChecker" class="com.mycom.myproj.utility.UserTrialPeriodExpirationChecker" />
<beans:bean id="customEnocdePassword" class="com.mycom.myproj.utility.CustomEnocdePassword" />

现在我得到以下错误

 "Cannot convert value of type [org.springframework.security.authentication.dao.DaoAuthenticationProvider]
to required type [org.springframework.security.core.userdetails.UserDetailsService] 
for property 'userDetailsService': no matching editors or conversion strategy found"
4

1 回答 1

3

您可以在对用户进行身份验证之前验证到期日期的自定义UserDetailsChecker设置DaoAuthenticationProvider。

配置中的<authentication-provider>元素会生成一个DaoAuthenticationProvider，但该元素上没有允许您设置其属性的preAuthenticationChecks属性。为了解决命名空间配置的这个限制，您必须回退到将该提供程序定义为普通 bean：

<bean id="authenticationProvider" class="org.springframework.security.authentication.dao.DaoAuthenticationProvider">
    <property name="userDetailsService" ref="customUserDetailsService"/>
    <property name="passwordEncoder" ref="customEnocdePassword"/>
    <property name="preAuthenticationChecks" ref="expirationChecker"/>
</bean>

并通过配置中的 id 引用它<authentication-manager>：

<security:authentication-manager>
    <security:authentication-provider ref="authenticationProvider"/>
</security:authentication-manager>

上面引用的expirationCheckerbean 必须实现UserDetailsChecker一个接收对象的回调接口UserDetails，如果用户的试用期已过期，您可以在其中抛出特定异常：

public class UserTrialPeriodExpirationChecker implements UserDetailsChecker {
    @Override
    public void check(UserDetails user) {
        if( /* whatever way you check expiration */ ) {
            throw new TrialPeriodExpiredException();
        }

        if (!user.isAccountNonLocked()) {
            throw new LockedException("User account is locked");
        }

        if (!user.isEnabled()) {
            throw new DisabledException("User is disabled");
        }

        if (!user.isAccountNonExpired()) {
            throw new AccountExpiredException("User account has expired");
        }
    }
}

请注意，最后三个检查与过期检查无关，但您必须在此处拥有它们，因为默认实现（即AbstractUserDetailsAuthenticationProvider.DefaultPreAuthenticationChecks）现在已被此类覆盖。由于默认实现是私有内部类，您不能简单地扩展它，而是需要从那里复制代码以防止锁定/禁用/等。用户从登录。

一切就绪后，配置一个ExceptionMappingAuthenticationFailureHandler将您映射TrialPeriodExpiredException到用户应该登陆的定价页面的 URL。

<form-login authentication-failure-handler-ref="exceptionMapper" ... />

...

<bean id="exceptionMapper" class="org.springframework.security.web.authentication.ExceptionMappingAuthenticationFailureHandler" >
    <property name="exceptionMappings">
        <map>
            <entry key="your.package.TrialPeriodExpiredException" value="/pricing"/>
        </map>
    </property>
</bean>
于 2013-03-04T16:46:06.620 回答