package me.arganzheng.study.auth.interceptor;

import java.util.Arrays;
import java.util.Date;

import javax.servlet.http.Cookie;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import org.apache.log4j.Logger;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.web.servlet.handler.HandlerInterceptorAdapter;

import me.arganzheng.study.auth.common.WebUser;
import me.arganzheng.study.auth.constants.Constants;
import me.arganzheng.study.auth.exception.InvalidCookieException;
import me.arganzheng.study.auth.model.user.User;
import me.arganzheng.study.auth.service.user.UserService;
import me.arganzheng.study.auth.util.HttpServletRequestTool;
import me.arganzheng.study.auth.util.LoginUtils;

/**
 * <pre>
 * 身份认证拦截器。包括身份认证和设置WebUser。
 * 
 * 注意：授权不在这里处理。@see {@link AuthorizationInterceptor}
 * </pre>
 * 
 * @author zhengzhibin
 * 
 */
public class TokenBasedAuthInterceptor extends HandlerInterceptorAdapter {

	private static final Logger logger = Logger.getLogger(TokenBasedAuthInterceptor.class);

	@Autowired
	private WebUser webUser;

	@Autowired
	private UserService userService;

	@Value(value = "secretKey")
	private String secretKey;

	public boolean preHandle(HttpServletRequest request, HttpServletResponse response,
			Object handler) throws Exception {
		// Authenticaltion
		User user = authentication(request, response);
		if (user == null) {
			webUser.setLoggedIn(false);
		} else if (!user.isValid()) {
			webUser.setLoggedIn(false);
			webUser.setValid(false);
		} else {
			webUser.setLoggedIn(true);
			webUser.setValid(true);
			webUser.setUsername(user.getUsername());
			webUser.setRole(user.getRole());
			webUser.setClientIp(HttpServletRequestTool.getClientIp(request));
			webUser.setLanguage(user.getLanguage());
			// put the webUser to request so that view can access it!
			request.setAttribute("webUser", webUser);
		}
		return true;
	}

	protected String extractTicketCookie(HttpServletRequest request) {
		Cookie[] cookies = request.getCookies();

		if ((cookies == null) || (cookies.length == 0)) {
			return null;
		}

		for (Cookie cookie : cookies) {
			if (Constants.TOKEN_COOKIES.equals(cookie.getName())) {
				return cookie.getValue();
			}
		}

		return null;
	}

	/**
	 * Template implementation which locates the Spring Security cookie, decodes
	 * it into a delimited array of tokens and submits it to subclasses for
	 * processing via the <tt>processAutoLoginCookie</tt> method.
	 * <p>
	 * The returned username is then used to load the UserDetails object for the
	 * user, which in turn is used to create a valid authentication token.
	 */
	public final User authentication(HttpServletRequest request, HttpServletResponse response) {
		String ticketCookie = extractTicketCookie(request);

		if (ticketCookie == null) {
			return null;
		}

		logger.debug("ticket cookie detected");

		if (ticketCookie.length() == 0) {
			logger.debug("Cookie was empty");
			LoginUtils.cancelCookie(request, response);
			return null;
		}

		User user = null;

		try {
			String[] cookieTokens = LoginUtils.decodeCookie(ticketCookie);
			user = processAutoLoginCookie(cookieTokens, request, response);

			logger.debug("ticket cookie accepted");
			return user.isEnabled() ? user : null;
		} catch (RuntimeException e) {
			logger.error(e.getMessage(), e);
		}

		LoginUtils.cancelCookie(request, response);
		return null;
	}

	protected User processAutoLoginCookie(String[] cookieTokens, HttpServletRequest request,
			HttpServletResponse response) {

		if (cookieTokens.length != 3) {
			throw new InvalidCookieException("Cookie token did not contain 3"
					+ " tokens, but contained '" + Arrays.asList(cookieTokens) + "'");
		}

		long tokenExpiryTime;

		try {
			tokenExpiryTime = new Long(cookieTokens[1]).longValue();
		} catch (NumberFormatException nfe) {
			throw new InvalidCookieException(
					"Cookie token[1] did not contain a valid number (contained '" + cookieTokens[1]
							+ "')");
		}

		if (isTokenExpired(tokenExpiryTime)) {
			throw new InvalidCookieException("Cookie token[1] has expired (expired on '"
					+ new Date(tokenExpiryTime) + "'; current time is '" + new Date() + "')");
		}

		// Check the user exists.
		// Defer lookup until after expiry time checked, to possibly avoid
		// expensive database call.
		User user = userService.getByUsername(cookieTokens[0]);

		// Check signature of token matches remaining details.
		// Must do this after user lookup, as we need the DAO-derived password.
		// If efficiency was a major issue, just add in a UserCache
		// implementation,
		// but recall that this method is usually only called once per
		// HttpSession - if the token is valid,
		// it will cause SecurityContextHolder population, whilst if invalid,
		// will cause the cookie to be cancelled.
		String expectedTokenSignature = LoginUtils.makeTokenSignature(tokenExpiryTime,
				user.getUsername(), user.getPassword(), secretKey);

		if (!expectedTokenSignature.equals(cookieTokens[2])) {
			throw new InvalidCookieException("Cookie token[2] contained signature '"
					+ cookieTokens[2] + "' but expected '" + expectedTokenSignature + "'");
		}

		return user;
	}

	protected boolean isTokenExpired(long tokenExpiryTime) {
		return tokenExpiryTime < System.currentTimeMillis();
	}

}

package me.arganzheng.study.auth.util;

import java.security.MessageDigest;
import java.security.NoSuchAlgorithmException;
import java.util.Date;

import javax.servlet.http.Cookie;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import org.apache.commons.codec.binary.Base64;
import org.apache.commons.codec.binary.Hex;
import org.apache.log4j.Logger;
import org.springframework.util.StringUtils;

import me.arganzheng.study.auth.constants.Constants;
import me.arganzheng.study.auth.exception.InvalidCookieException;
import me.arganzheng.study.auth.model.user.User;

public class LoginUtils {

	private static final Logger logger = Logger.getLogger(LoginUtils.class);

	private static final String DELIMITER = ":";

	public static void loginSuccess(HttpServletRequest request, HttpServletResponse response,
			User user, String secretKey) {

		String username = user.getUsername();
		String password = user.getPassword();

		// If unable to find a username and password, just abort as
		// TokenBasedRememberMeServices is
		// unable to construct a valid token in this case.
		if (!StringUtils.hasLength(username) || !StringUtils.hasLength(password)) {
			return;
		}

		int tokenLifetime = Constants.TWO_WEEKS_S;
		long expiryTime = System.currentTimeMillis();
		// SEC-949
		expiryTime += 1000L * (tokenLifetime < 0 ? Constants.TWO_WEEKS_S : tokenLifetime);

		String signatureValue = makeTokenSignature(expiryTime, username, password, secretKey);

		setCookie(new String[] { username, Long.toString(expiryTime), signatureValue },
				tokenLifetime, request, response);

		if (logger.isDebugEnabled()) {
			logger.debug("Added ticke cookie for user '" + username + "', expiry: '"
					+ new Date(expiryTime) + "'");
		}
	}

	public static void loginFail(HttpServletRequest request, HttpServletResponse response) {
		logger.debug("Interactive login attempt was unsuccessful.");
		cancelCookie(request, response);
	}

	public static String makeTokenSignature(long tokenExpiryTime, String username, String password,
			String secretKey) {
		String data = username + ":" + tokenExpiryTime + ":" + password + ":" + secretKey;

		MessageDigest digest;
		try {
			digest = MessageDigest.getInstance("MD5");
		} catch (NoSuchAlgorithmException e) {
			throw new IllegalStateException("No MD5 algorithm available!");
		}

		return new String(Hex.encodeHex(digest.digest(data.getBytes())));
	}

	/**
	 * Sets a "cancel cookie" (with maxAge = 0) on the response to disable
	 * persistent logins.
	 */
	public static void cancelCookie(HttpServletRequest request, HttpServletResponse response) {
		logger.debug("Cancelling cookie");
		Cookie cookie = new Cookie(Constants.TOKEN_COOKIES, null);
		cookie.setMaxAge(0);
		cookie.setPath(getCookiePath(request));

		response.addCookie(cookie);
	}

	/**
	 * Sets the cookie on the response. By default a secure cookie will be used
	 * if the connection is secure. You can set the {@code useSecureCookie}
	 * property to {@code false} to override this. If you set it to {@code true}
	 * , the cookie will always be flagged as secure. If Servlet 3.0 is used,
	 * the cookie will be marked as HttpOnly.
	 * 
	 * @param tokens the tokens which will be encoded to make the cookie value.
	 * @param maxAge the value passed to {@link Cookie#setMaxAge(int)}
	 * @param request the request
	 * @param response the response to add the cookie to.
	 */
	public static void setCookie(String[] tokens, int maxAge, HttpServletRequest request,
			HttpServletResponse response) {
		String cookieValue = encodeCookie(tokens);
		Cookie cookie = new Cookie(Constants.TOKEN_COOKIES, cookieValue);
		cookie.setMaxAge(maxAge);
		cookie.setPath(getCookiePath(request));
		cookie.setSecure(request.isSecure());

		response.addCookie(cookie);
	}

	/**
	 * Decodes the cookie and splits it into a set of token strings using the
	 * ":" delimiter.
	 * 
	 * @param cookieValue the value obtained from the submitted cookie
	 * @return the array of tokens.
	 * @throws InvalidCookieException if the cookie was not base64 encoded.
	 */
	public static String[] decodeCookie(String cookieValue) {
		for (int j = 0; j < cookieValue.length() % 4; j++) {
			cookieValue = cookieValue + "=";
		}

		if (!Base64.isBase64(cookieValue.getBytes())) {
			throw new RuntimeException("Cookie token was not Base64 encoded; value was '"
					+ cookieValue + "'");
		}

		String cookieAsPlainText = new String(Base64.decodeBase64(cookieValue));

		String[] tokens = StringUtils.delimitedListToStringArray(cookieAsPlainText, DELIMITER);

		if ((tokens[0].equalsIgnoreCase("http") || tokens[0].equalsIgnoreCase("https"))
				&& tokens[1].startsWith("//")) {
			// Assume we've accidentally split a URL (OpenID identifier)
			String[] newTokens = new String[tokens.length - 1];
			newTokens[0] = tokens[0] + ":" + tokens[1];
			System.arraycopy(tokens, 2, newTokens, 1, newTokens.length - 1);
			tokens = newTokens;
		}

		return tokens;
	}

	/**
	 * Inverse operation of decodeCookie.
	 * 
	 * @param cookieTokens the tokens to be encoded.
	 * @return base64 encoding of the tokens concatenated with the ":"
	 *         delimiter.
	 */
	public static String encodeCookie(String[] cookieTokens) {
		StringBuilder sb = new StringBuilder();
		for (int i = 0; i < cookieTokens.length; i++) {
			sb.append(cookieTokens[i]);

			if (i < cookieTokens.length - 1) {
				sb.append(DELIMITER);
			}
		}

		String value = sb.toString();

		sb = new StringBuilder(Base64.encodeBase64String(value.getBytes()));

		while (sb.charAt(sb.length() - 1) == '=') {
			sb.deleteCharAt(sb.length() - 1);
		}

		return sb.toString();
	}

	public static String getCookiePath(HttpServletRequest request) {
		String contextPath = request.getContextPath();
		return contextPath.length() > 0 ? contextPath : "/";
	}

	public static void logout(HttpServletRequest request, HttpServletResponse response) {
		LoginUtils.cancelCookie(request, response);
	}
}

package me.arganzheng.study.auth.interceptor;

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import org.apache.commons.lang.ArrayUtils;
import org.apache.commons.lang.StringUtils;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.core.annotation.AnnotationUtils;
import org.springframework.web.method.HandlerMethod;
import org.springframework.web.servlet.handler.HandlerInterceptorAdapter;

import me.arganzheng.study.auth.annotation.RequiredLogin;
import me.arganzheng.study.auth.common.WebUser;
import me.arganzheng.study.auth.constants.Role;
import me.arganzheng.study.auth.exception.NotAllowException;
import me.arganzheng.study.auth.exception.UserInvalidException;
import me.arganzheng.study.auth.exception.UserNotLoggedInException;
import me.arganzheng.study.auth.util.HttpServletRequestTool;

/**
 * 授权拦截器。注意身份认证不在这里，@see {@link TokenBasedAuthInterceptor}
 * 
 * @author zhengzhibin
 * 
 */
public class AuthorizationInterceptor extends HandlerInterceptorAdapter {

	@Autowired
	private WebUser webUser;

	@Override
	public boolean preHandle(HttpServletRequest request, HttpServletResponse response,
			Object handler) throws Exception {
		boolean requiredLoginAndAuth = false;
		if (handler instanceof HandlerMethod) {
			HandlerMethod method = (HandlerMethod) handler;

			RequiredLogin requiredLoginAnnotation = AnnotationUtils.findAnnotation(
					method.getMethod(), RequiredLogin.class);
			if (requiredLoginAnnotation == null) { // get type-level annatation
				requiredLoginAnnotation = AnnotationUtils.findAnnotation(method.getBeanType(),
						RequiredLogin.class);
			}

			if (requiredLoginAnnotation != null) {
				requiredLoginAndAuth = true;
			}

			// no annotation auth requirement, check the url pattern
			String uri = HttpServletRequestTool.getRequestURIExcludeContextPath(request);
			// 这里简单使用url区分，粒度比较大。
			if (uri.startsWith("/admin/") || uri.startsWith("/my/") || uri.startsWith("/security/")
					|| uri.startsWith("/private/")) {
				requiredLoginAndAuth = true;
			}

			if (requiredLoginAndAuth) {// 需要登录和授权控制
				if (!webUser.isLoggedIn()) {// 无权限，转到权限申请页面
					throw new UserNotLoggedInException("Login required!");
				} else if (!webUser.isValid()) {
					throw new UserInvalidException("Sorry, you are locked or inactive right now!");
				} else {
					// STEP_2: Authorization
					Role[] roles = requiredLoginAnnotation.role();
					if (hasAuth(roles, webUser.getRole())) {
						if (webUser.getRole() == Role.Local
								&& StringUtils.isNotBlank(webUser.getLanguage())) {
							String language = request.getParameter("language");
							if (language == null) {
								return true;
							} else if (webUser.getLanguage().equalsIgnoreCase(language) == false) {
								throw new NotAllowException(
										"Request resource can only be access by "
												+ ArrayUtils.toString(roles) + " with language "
												+ language);
							}
						}
						return true;
					} else {
						throw new NotAllowException("Request resource can only be access by "
								+ ArrayUtils.toString(roles));
					}
				}
			}
		}

		return true;
	}

	private boolean hasAuth(Role[] requiredRoles, Role role) {
		if (requiredRoles == null || role == Role.Admin) {
			return true;
		}

		boolean adminRequired = false;
		for (Role r : requiredRoles) {
			if (role == r) {
				return true;
			}
			if (r == Role.Admin) {
				adminRequired = true;
			}
		}
		if (adminRequired == false && role == Role.User) {
			return true;
		}
		return false;
	}
}

@Controller
@RequestMapping("/my")
public class MyController{

    @LoginRequired(role = { Role.ADMIN, Role.USER })
    public void doXXX(){
      xxx
    }
}

def requires_roles(*roles):
def wrapper(f):
    @wraps(f)
    def wrapped(*args, **kwargs):
        if get_current_user_role() not in roles:
            return error_response()
        return f(*args, **kwargs)
    return wrapped
return wrapper

@app.route('/user')
@required_roles('admin', 'user')
def user_page(self):
    return "You've got permission to access this page."    

<!-- Stateless RESTful service using Basic authentication -->
<http pattern="/restful/**" create-session="stateless">
  <intercept-url pattern='/**' access='ROLE_REMOTE' />
  <http-basic />
</http>

<!-- Empty filter chain for the login page -->
<http pattern="/login.htm*" security="none"/>

<!-- Additional filter chain for normal users, matching all other requests -->
<http>
  <intercept-url pattern='/**' access='ROLE_USER' />
  <form-login login-page='/login.htm' default-target-url="/home.htm"/>
  <logout />
</http>

<bean id="filterInvocationInterceptor"
      class="org.springframework.security.web.access.intercept.FilterSecurityInterceptor">
  <property name="authenticationManager" ref="authenticationManager"/>
  <property name="accessDecisionManager" ref="accessDecisionManager"/>
  <property name="runAsManager" ref="runAsManager"/>
  <property name="securityMetadataSource">
    <security:filter-security-metadata-source path-type="regex">
      <security:intercept-url pattern="\A/secure/super/.*\Z" access="ROLE_WE_DONT_HAVE"/>
      <security:intercept-url pattern="\A/secure/.*\" access="ROLE_SUPERVISOR,ROLE_TELLER"/>
    </security:filter-security-metadata-source>
  </property>
</bean>

<http use-expressions="true">
    <intercept-url pattern="/admin*"
        access="hasRole('admin') and hasIpAddress('192.168.1.0/24')"/>
    ...
</http>	

public interface BankService {

  @Secured("IS_AUTHENTICATED_ANONYMOUSLY")
  public Account readAccount(Long id);

  @Secured("IS_AUTHENTICATED_ANONYMOUSLY")
  public Account[] findAccounts();

  @Secured("ROLE_TELLER")
  public Account post(Account account, double amount);
}

@PreAuthorize("#contact.name == authentication.name")
public void doSomething(Contact contact);	

import org.springframework.security.web.bind.annotation.AuthenticationPrincipal;

// ...

@RequestMapping("/messages/inbox")
public ModelAndView findMessagesForUser() {
    Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
    CustomUser custom = (CustomUser) authentication == null ? null : authentication.getPrincipal();

    // .. find messags for this user and return them ...
}

@RequestMapping("/messages/inbox")
public ModelAndView findMessagesForUser(@AuthenticationPrincipal CustomUser customUser) {

    // .. find messags for this user and return them ...
}