Anyframe Web에서의 인증과 접근 권한 제어에 대해 알아본다.
request를 보낸 클라이언트가 어플리케이션에 등록된 User인지 체크하여 로그인하게 해주는 Authentication과 User 와 어플리케이션 내의 자원 간의 관계를 맺고 관리하는 Authorization 은 어플리케이션 개발 시 항상 고려되는 부분 중의 하나이며 두 부분이 밀접히 관련되어 있다.package com.sds.emp.security.services.impl;
...
public class DBAuthenticationService implements AuthenticationService,
ApplicationContextAware {
...
public Subject authenticate(Credential credential) throws EmpException {
..
String userid = credential.getProperty("userid");
String password = credential.getProperty("password").trim();
try {
conn = dataSource.getConnection();
pstmt = conn.prepareStatement(sqlQuery);
..
pstmt.setString(1, userid);
pstmt.setString(2, password);
rsu = pstmt.executeQuery();
if (rsu.next()) {
userid = rsu.getString(1);
String username = rsu.getString(2);
password = rsu.getString(3);
String grade = rsu.getString(4);
Set principals = new HashSet();
Set credentials = new HashSet();
principals.add(new TypedPrincipal(username, TypedPrincipal.USER));
StringTokenizer tokens = new StringTokenizer(grade, ",");
while (tokens.hasMoreTokens()) {
principals.add(new TypedPrincipal(tokens.nextToken(),
TypedPrincipal.GROUP));
}
subject = new Subject(false, principals, credentials,
credentials);
}
else {
throw new EmpException(messageSource, "error.security.login");
}
}
catch (Exception e) {
if (e instanceof EmpException) throw (EmpException) e;
else throw new EmpException(messageSource,
"error.security.check.userid", e);
}
finally {
..
}
return subject;
}
}
// 중략
<bean id="securityService"
class="com.sds.emp.security.services.impl.DBAuthenticationService">
<property name="dataSource" ref="dataSource"/>
<property name="sqlQuery"
value="SELECT u.USER_ID,u.USER_NAME,u.PASSWORD,u.ENABLED,a.AUTHORITY FROM USERS u, AUTHORITIES a WHERE u.USER_ID=? and u.PASSWORD=? and a.USER_ID = u.USER_ID"/>
</bean>
// 중략
import com.sds.emp.security.services.AuthenticationService;
...
public class LogInAction extends DefaultActionSupport {
public ActionForward process(ActionMapping mapping, ActionForm form,
HttpServletRequest request, HttpServletResponse response)
throws Exception {
try {
Subject subject = new Subject();
HttpSession session = request.getSession();
String userId = (String) PropertyUtils.getSimpleProperty(form, "userId");
String password = (String) PropertyUtils.getSimpleProperty(form, "password");
ApplicationContext ctx = getWebApplicationContext();
AuthenticationService authenticationService
= (AuthenticationService) ctx.getBean("securityService");
Credential c = new Credential();
c.setProperty("userid", userId);
c.setProperty("password", password);
subject = authenticationService.authenticate(c);session.setAttribute("subject", subject);
session.setAttribute("userId", userId);
return mapping.findForward("success");
} catch (Exception e) {
...
}
}
<!-- 회원 목록 조회 -->
<action
input="/home.do"
name="userForm"
path="/empListUser"
type="com.sds.emp.user.web.GetUserListAction"
scope="request"
validate="false"
roles="admin,user">
<forward name="success" path="/sample/user/listUser.jsp" />
</action>
<global-exceptions>
<exception
path="/sample/common/error.jsp"
key="error.common.msg.authentication"
type="anyframe.web.struts.common.util.AuthenticationException"
handler="com.sds.emp.common.EmpExceptionHandler" />
<exception
path="/sample/common/error.jsp"
key="error.common.msg.authorization"
type="anyframe.web.struts.common.util.AuthorizationException"
handler="com.sds.emp.common.EmpExceptionHandler" />
...
</global-exceptions>