问题描述
当我在页面中放入类似这样的标签时:
用户和管理员仍会在运行时显示?
xmlns:sec ="http://www.springframework.org/security/tags"
spring-security-taglibs-3.2.3.RELEASE
我有2个文件夹(管理员和用户)
还要使用use-expressions ="true"
进行测试没有结果!
我用mysql
表(用户和用户角色)...
When I put some tags like this within my page:
user and admin will display at runtime anyway?
xmlns:sec="http://www.springframework.org/security/tags"
spring-security-taglibs-3.2.3.RELEASE
I have 2 folders(Admin and User)
Also test with use-expressions="true"
Did not the result!
I used mysql
table(users and user_roles) ...
<sec:authorize access="ROLE_ADMIN">
<div> test Admin</div>
</sec:authorize>
<sec:authorize access="ROLE_USER">
<div> test User</div>
</sec:authorize>
or
<sec:authorize access="hasRole('ROLE_ADMIN')" >
<h:outputText value="Admin"/>
</sec:authorize>
<sec:authorize access="hasRole('ROLE_USER')" >
<h:outputText value="User"/>
</sec:authorize>
Security.xml
Security.xml
<http auto-config="true" use-expressions="true" >
<intercept-url pattern="/Admin/*" access="hasRole('ROLE_ADMIN')" />
<intercept-url pattern="/user/*" access="hasRole('ROLE_USER')"/>
...
</http>
谢谢!
推荐答案
要使用Spring Security Facelets标记库,您需要创建一个.taglib.xml文件并将其注册到web.xml中.
To use the Spring Security Facelets Tag Library you'll need to create a .taglib.xml file and register it in web.xml.
使用以下内容创建文件/WEB-INF/springsecurity.taglib.xml:
Create the file /WEB-INF/springsecurity.taglib.xml with the following content:
<?xml version="1.0"?>
<!DOCTYPE facelet-taglib PUBLIC
"-//Sun Microsystems, Inc.//DTD Facelet Taglib 1.0//EN"
"http://java.sun.com/dtd/facelet-taglib_1_0.dtd">
<facelet-taglib>
<namespace>http://www.springframework.org/security/tags</namespace>
<tag>
<tag-name>authorize</tag-name>
<handler-class>org.springframework.faces.security.FaceletsAuthorizeTagHandler</handler-class>
</tag>
<function>
<function-name>areAllGranted</function-name>
<function-class>org.springframework.faces.security.FaceletsAuthorizeTagUtils</function-class>
<function-signature>boolean areAllGranted(java.lang.String)</function-signature>
</function>
<function>
<function-name>areAnyGranted</function-name>
<function-class>org.springframework.faces.security.FaceletsAuthorizeTagUtils</function-class>
<function-signature>boolean areAnyGranted(java.lang.String)</function-signature>
</function>
<function>
<function-name>areNotGranted</function-name>
<function-class>org.springframework.faces.security.FaceletsAuthorizeTagUtils</function-class>
<function-signature>boolean areNotGranted(java.lang.String)</function-signature>
</function>
<function>
<function-name>isAllowed</function-name>
<function-class>org.springframework.faces.security.FaceletsAuthorizeTagUtils</function-class>
<function-signature>boolean isAllowed(java.lang.String, java.lang.String)</function-signature>
</function>
</facelet-taglib>
接下来,在web.xml中注册上述文件taglib:
Next, register the above file taglib in web.xml:
<context-param>
<param-name>javax.faces.FACELETS_LIBRARIES</param-name>
<param-value>/WEB-INF/springsecurity.taglib.xml</param-value>
</context-param>
现在您可以在视图中使用标签库了.您可以使用authorize标签有条件地包括嵌套内容:
Now you are ready to use the tag library in your views. You can use the authorize tag to include nested content conditionally:
<!DOCTYPE composition PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<ui:composition xmlns="http://www.w3.org/1999/xhtml"
xmlns:ui="http://java.sun.com/jsf/facelets"
xmlns:h="http://java.sun.com/jsf/html"
xmlns:sec="http://www.springframework.org/security/tags">
<sec:authorize ifAllGranted="ROLE_FOO, ROLE_BAR">
Lorem ipsum dolor sit amet
</sec:authorize>
<sec:authorize ifNotGranted="ROLE_FOO, ROLE_BAR">
Lorem ipsum dolor sit amet
</sec:authorize>
<sec:authorize ifAnyGranted="ROLE_FOO, ROLE_BAR">
Lorem ipsum dolor sit amet
</sec:authorize>
</ui:composition>
您还可以在任何JSF组件的rendered或其他属性中使用几种EL函数之一:
You can also use one of several EL functions in the rendered or other attribute of any JSF component:
<!DOCTYPE composition PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<ui:composition xmlns="http://www.w3.org/1999/xhtml"
xmlns:ui="http://java.sun.com/jsf/facelets"
xmlns:h="http://java.sun.com/jsf/html"
xmlns:sec="http://www.springframework.org/security/tags">
<!-- Rendered only if user has all of the listed roles -->
<h:outputText value="Lorem ipsum dolor sit amet" rendered="#{sec:areAllGranted('ROLE_FOO, ROLE_BAR')}"/>
<!-- Rendered only if user does not have any of the listed roles -->
<h:outputText value="Lorem ipsum dolor sit amet" rendered="#{sec:areNotGranted('ROLE_FOO, ROLE_BAR')}"/>
<!-- Rendered only if user has any of the listed roles -->
<h:outputText value="Lorem ipsum dolor sit amet" rendered="#{sec:areAnyGranted('ROLE_FOO, ROLE_BAR')}"/>
<!-- Rendered only if user has access to given HTTP method/URL as defined in Spring Security configuration -->
<h:outputText value="Lorem ipsum dolor sit amet" rendered="#{sec:isAllowed('/secured/foo', 'POST')}"/>
</ui:composition>
经过测试:
<dependency>
<groupId>org.springframework.security</groupId>
<artifactId>spring-security-taglibs</artifactId>
<version>3.2.3.RELEASE</version>
</dependency>
这篇关于sec:authorize在Spring Security 3.2和jsf中不起作用的文章就介绍到这了,希望我们推荐的答案对大家有所帮助,也希望大家多多支持!