Thursday July 31, 2008

Acegisecurity Memo-9, Login Password with PasswordEncoder(SHA,MD5...)

一堆事，雜事、正事、亂七八糟的事，不爽的事 = =，摸了許久....hmm.....繼續分享 acegi 的心得吧..

Table of Content
摘要 PasswordEncoder 設定方式 Sample Download Reference

摘要

一般在設計權限的系統，在儲存使用者的密碼時，通常都會是存加密過後的密碼字串，而不是直接存原始的密碼進儲存庫，所以在使用者 key in 密碼登入時，我們要做的比對，應該是先把使用者 key in 的密碼加密過後，再和儲存庫中的資料做比對，才會正確的判斷。
很幸運的， acegi 已經考慮到這一段，也幫我們做好了，我們只要設定要使用的 PasswordEncoder 傳給 AuthenticationProvider 即可，acegi 會自動加密後再比對判斷。

PasswordEncoder

class	說明
org.acegisecurity.providers.encoding.PlaintextPasswordEncoder	如果 AuthenticationProvider 有傳入 SaltSource，則此加密就是原 password + "{" + aSaltSource.toString() + "}"，若無 SaltSource，則即原 password。
org.acegisecurity.providers.ldap.authenticator.LdapShaPasswordEncoder	一般 LDAP 內建的加密方式，有{SHA}, {SSHA} 二種。
org.acegisecurity.providers.encoding.Md5PasswordEncoder	MD5 加密演算法。
org.acegisecurity.providers.encoding.ShaPasswordEncoder	SHA 加密演算法，建構子可傳入 key 長度，預設是 SHA-1 演算法。
org.acegisecurity.providers.encoding.MessageDigestPasswordEncoder	Md5PasswordEncoder 和 ShaPasswordEncoder 的父類別，但可以直接使用，不過必須在建構子傳入演算法名稱。

設定方式

在設定 AuthenticationProvider 時，傳入選擇的 PasswordEncoder 實例進 passwordEncoder 參數。

<bean id="authenticationProvider"
	class="org.acegisecurity.providers.dao.DaoAuthenticationProvider">
	<property name="userDetailsService">		
		<ref bean="inMemoryDaoImpl" />
	</property>
	<property name="passwordEncoder">
		<bean class="org.acegisecurity.providers.encoding.ShaPasswordEncoder"/>
	</property>
</bean>

Sample

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xmlns:aop="http://www.springframework.org/schema/aop"
    xmlns:tx="http://www.springframework.org/schema/tx"
    xsi:schemaLocation="
    http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-2.0.xsd
    http://www.springframework.org/schema/tx http://www.springframework.org/schema/tx/spring-tx-2.0.xsd
    http://www.springframework.org/schema/aop http://www.springframework.org/schema/aop/spring-aop-2.0.xsd">

	<bean id="authenticationProvider"
		class="org.acegisecurity.providers.dao.DaoAuthenticationProvider">
		<property name="userDetailsService">		
			<ref bean="inMemoryDaoImpl" />
		</property>
		<property name="passwordEncoder">
			<bean class="org.acegisecurity.providers.encoding.ShaPasswordEncoder"/>
		</property>		
	</bean>		
	<bean id="inMemoryDaoImpl" class="org.acegisecurity.userdetails.memory.InMemoryDaoImpl">
		<property name="userMap">
		<!--
				admin=1234,ROLE_admin,ROLE_USER,ROLE_other
				piaoyi=1234,ROLE_admin,ROLE_USER,ROLE_other
				readonly=readonly,ROLE_USER,ROLE_readonly
				密碼加密 SHA-1 後如下
		-->
			<value>
				admin=7110eda4d09e062aa5e4a390b0a572ac0d2c0220,ROLE_admin,ROLE_USER,ROLE_other
				piaoyi=7110eda4d09e062aa5e4a390b0a572ac0d2c0220,ROLE_admin,ROLE_USER,ROLE_other
				readonly=9a27718297218c3757c365d357d13f49d0fa3065,ROLE_USER,ROLE_readonly
			</value>
		</property>
	</bean>	
</beans>

Download

Download [AcegisecurityMemo9.zip]
Contains:
- acegi-authentication-passwordEncoder.xml

Reference

http://www.acegisecurity.org/
http://forum.springframework.org/forumdisplay.php?f=33

Navigation:

Index: Acegisecurity Memo, Table of Contents
Previous: Acegisecurity Memo-8, Login Page & Logout URL
Next:

Posted at 2008-07-31 01:29 by Piaoyi Kao in Acegisecurity | Permalink | Comments[4]

Thursday July 03, 2008

Acegisecurity Memo, Table of Contents

Acegisecurity Contents
Memo-1, Overview Memo-2, web.xml 設定方式 Memo-3, Spring application context 基本設定 Memo-4, Non-SSO Authentication 設定 Memo-5, In-Memory Authertication 設定 Memo-6, In-DB Authertication 設定 Memo-7, In-LDAP Authertication 設定 Memo-8, Login Page & Logout URL Memo-9, Login Password with PasswordEncoder(SHA,MD5...) (TODO)Memo-10, Signon with SSL (TODO)Memo-11, Get current login user & roles (TODO)Memo-12, Signon from multiple source(db,ldap,sso) at the same time (TODO)Memo-13, Authorization - Secure Your Web Page with Taglib (TODO)Memo-14, In-Memory(XML) Authorization - Secure Domain Object with AOP Alliance (TODO)Memo-14, In-DB Authorization - Secure Domain Object with AOP Alliance (TODO)Memo-15, Remember Me Service

Acegisecurity Contents

Memo-1, Overview
Memo-2, web.xml 設定方式
Memo-3, Spring application context 基本設定
Memo-4, Non-SSO Authentication 設定
Memo-5, In-Memory Authertication 設定
Memo-6, In-DB Authertication 設定
Memo-7, In-LDAP Authertication 設定
Memo-8, Login Page & Logout URL
Memo-9, Login Password with PasswordEncoder(SHA,MD5...)
(TODO)Memo-10, Signon with SSL
(TODO)Memo-11, Get current login user & roles
(TODO)Memo-12, Signon from multiple source(db,ldap,sso) at the same time
(TODO)Memo-13, Authorization - Secure Your Web Page with Taglib
(TODO)Memo-14, In-Memory(XML) Authorization - Secure Domain Object with AOP Alliance
(TODO)Memo-14, In-DB Authorization - Secure Domain Object with AOP Alliance
(TODO)Memo-15, Remember Me Service

Navigation:

Next: Acegisecurity Memo-1, Overview

Posted at 2008-07-03 16:53 by Piaoyi Kao in Acegisecurity | Permalink | Comments[1]

Tuesday May 27, 2008

Acegisecurity Memo-8, Login Page & Logout URL

Table of Content
新增 Login Page (login.jsp) Acegi Logout URL Download Reference

新增 Login Page (login.jsp)

在完成之前介紹的設定後，再來即要新增一個登入頁面。
登入頁面，最重要的，即 login url, login id, login password，而 Acegi 內有固定的 login url 與 login id 和 login password 的 parameter name。

Name	值	說明
login url	/contextPath/j_acegi_security_check	使用者輸入帳號密碼且按確定後，會處理認證的 URL 記得要加上 contextPath
login id name	j_username 或用 AuthenticationProcessingFilter.ACEGI_SECURITY_FORM_USERNAME_KEY	帳號的 key，即 Server 要用來取出 parameter 用的 key
login password name	j_password 或用 AuthenticationProcessingFilter.ACEGI_SECURITY_FORM_PASSWORD_KEY	密碼的 key，即 Server 要用來取出 parameter 用的 key
登入錯誤的 Exception	AbstractProcessingFilter.ACEGI_SECURITY_LAST_EXCEPTION_KEY	從 Session 的 Attribute 中，可以取得登入錯誤的 AuthenticationException。

login.jsp

<%@ page pageEncoding = "UTF-8"%>
<%@ taglib uri="http://java.sun.com/jsp/jstl/core" prefix="c"%>
<%@ taglib uri="http://java.sun.com/jsf/html" prefix="h"%>
<%@ taglib uri="http://java.sun.com/jsf/core" prefix="f"%>
<%@page import="org.acegisecurity.AuthenticationException"%>
<%@page import="org.acegisecurity.ui.AbstractProcessingFilter"%>
<%@page import="org.acegisecurity.ui.webapp.AuthenticationProcessingFilter"%>

<html>
 <head>
  <title>會員登入</title>
 </head>
 <body>	
  <c:if test="${param.error==1}">
      <font color="red">
        Your login attempt was not successful, try again.<BR><BR>
        Reason: 
<%=((AuthenticationException)session.getAttribute(AbstractProcessingFilter.ACEGI_SECURITY_LAST_EXCEPTION_KEY)).getMessage()%>
      </font>
  </c:if>		
  <form action = "<c:url value="/j_acegi_security_check"/>" method = "POST">
    <table border="1">
      <tr>
        <td>帳號</td>
        <td>
         <input type="text" name="<%=AuthenticationProcessingFilter.ACEGI_SECURITY_FORM_USERNAME_KEY%>" size = "20">
        </td>
      </tr>
      <tr>
        <td>密碼</td>
        <td>
         <input type="password" name="<%=AuthenticationProcessingFilter.ACEGI_SECURITY_FORM_PASSWORD_KEY %>" size="20"/>
        </td>
      </tr>
      <!-- 
      <tr>
        <td colspan="2" align="center"><input type="checkbox" name="_acegi_security_remember_me">Remember Me</td>
      </tr>
      -->
      <tr>
        <td colspan="2" align="center"><input type = "submit" value = "登入"/></td>
      </tr>
    </table>
  </form>
 </body>
</html>

Logout URL (登出網址)

登入後，通常會在網頁的某個地方，提供一個登出的按鈕來讓使用者登出。我發現 acegi 的文件中，並沒有提到登出的網址是什麼，不過還是給我從 source 找到了，

Acegi 登出的網址為

/contextPath/j_acegi_logout

//use taglib
<c:url value="/j_acegi_logout"/>

Download

Download [AcegisecurityMemo8.zip]
Contains:
- login.jsp

Reference

http://www.acegisecurity.org/
http://forum.springframework.org/forumdisplay.php?f=33

Navigation:

Index: Acegisecurity Memo, Table of Contents
Previous: Acegisecurity Memo-7, In-LDAP Authertication 設定
Next: Acegisecurity Memo-9, Login Password with PasswordEncoder(SHA,MD5...)

Posted at 2008-05-27 17:12 by Piaoyi Kao in Acegisecurity | Permalink | Comments[4]

piaoyi's blog - 站在煩惱裡仰望幸福

Thursday July 31, 2008

一堆事，雜事、正事、亂七八糟的事，不爽的事 = =，摸了許久....hmm.....繼續分享 acegi 的心得吧..

摘要

PasswordEncoder

設定方式

Sample

Download

Reference

Navigation:

Thursday July 03, 2008

Navigation:

Tuesday May 27, 2008

新增 Login Page (login.jsp)

Logout URL (登出網址)

Download

Reference

Navigation:

navigation

links

feeds

referers