Applying Spring Security for HTTP Basic Authentication of Apache CXF

在這裡記錄如何利用Spring Security設定HTTP Basic Authentication來保護Apache CXF RESTful Service。這裡不討論AuthenticationProvider的實作細節。

Spring XML

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xmlns:context="http://www.springframework.org/schema/context" xmlns:jaxrs="http://cxf.apache.org/jaxrs"
    xmlns:security="http://www.springframework.org/schema/security"
    xsi:schemaLocation="http://cxf.apache.org/configuration/security http://cxf.apache.org/schemas/configuration/security.xsd
        http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security.xsd
        http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
        http://cxf.apache.org/jaxrs http://cxf.apache.org/schemas/jaxrs.xsd
        http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd">

    <import resource="spring-cornerstone-logic-core.xml" />

    <context:annotation-config />
    <context:component-scan base-package="com.gss.gmo.cao.cornerstone.logic.web" />

    <!-- Spring Security -->
    <security:http auto-config="false" pattern="/services/rest/**" use-expressions="true">
        <security:http-basic />
        <security:intercept-url pattern="/services/rest/maintain*/**" access="hasRole('MAINTENANCE')" />
        <security:intercept-url pattern="/services/rest/**" access="hasRole('LOOKUP')" />
        <security:intercept-url pattern="/**" access="authenticated" />
    </security:http>

    <security:authentication-manager alias="authenticationManager">
        <security:authentication-provider ref="daoAuthenticationProvider" />
    </security:authentication-manager>

    <!-- Apache CXF -->
    <jaxrs:server id="rest" address="/rest">
        <jaxrs:serviceBeans>
            <ref bean="helloWorld" />
            <ref bean="maintainUnitService" />
            <ref bean="roleGroupService" />
            <ref bean="userService" />
            <ref bean="unitService" />
        </jaxrs:serviceBeans>
        <jaxrs:providers>
            <bean class="com.gss.gmo.cao.restserver.provider.GsonMessageBodyProvider" />
            <bean class="com.gss.gmo.cao.restserver.provider.ThrowableMapper" />
            <bean class="com.gss.gmo.cao.restserver.provider.ExceptionMapper" />
            <bean class="com.gss.gmo.cao.restserver.provider.RuntimeExceptionMapper" />
            <bean class="com.gss.gmo.cao.restserver.provider.ValidationExceptionMapper" />
            <bean class="com.gss.gmo.cao.restserver.provider.StaleStateExceptionMapper" />
        </jaxrs:providers>
    </jaxrs:server>

    <!-- Hibernate Validator -->
    <bean id="validator" class="org.springframework.validation.beanvalidation.LocalValidatorFactoryBean" />
    <bean class="org.springframework.validation.beanvalidation.MethodValidationPostProcessor" />

</beans>