Spring Security权限管理小结

# 配置security用户名密码 spring.security.user.password=LIFEILIN spring.security.user.name=LIFEILIN spring.security.user.roles=admin 

@Configuration public class securityConfig extends WebSecurityConfigurerAdapter { //暂且密码不加密 @Bean PasswordEncoder passwordEncoder(){ return NoOpPasswordEncoder.getInstance(); } @Override protected void configure(AuthenticationManagerBuilder auth) throws Exception { auth.inMemoryAuthentication() .withUser("LIFEILIN").password("LIFEILIN").roles("admin")   //第一个 .and() .withUser("123").password("123").roles("user"); //第二个 } }

        //配置HttpSecurity拦截规则 @Override protected void configure(HttpSecurity http) throws Exception { http.authorizeRequests()    //开启配置 .antMatchers("/admin/**").hasRole("admin") .antMatchers("/user/**").hasAnyRole("admin","user") .anyRequest().authenticated()  //其他请求登录后即可访问 .and() .formLogin() .loginProcessingUrl("/doLogin") .permitAll()    //跟登录相关接口直接访问 .and() .csrf().disable(); }

    //配置HttpSecurity拦截规则 @Override protected void configure(HttpSecurity http) throws Exception { http.authorizeRequests()    //开启配置 .antMatchers("/admin/**").hasRole("admin") .antMatchers("/user/**").hasAnyRole("admin", "user") .anyRequest().authenticated()  //其他请求登录后即可访问 .and() .formLogin() .loginProcessingUrl("/doLogin") //                .loginPage("login") //登录页面 //自定义用户名密码 .usernameParameter("uname") .passwordParameter("passwd") //登录成功的处理器（前后端分离） .successHandler(new AuthenticationSuccessHandler() { @Override public void onAuthenticationSuccess(HttpServletRequest req, HttpServletResponse resp, Authentication authentication) throws IOException, ServletException { //authentication为登录成功对象 //登录成功，返回json resp.setContentType("application/json;charset=utf-8"); PrintWriter out = resp.getWriter(); Map map = new HashMap<>(); map.put("status", 200); map.put("msg", authentication.getPrincipal());   //登录成功对象 out.write(new ObjectMapper().writeValueAsString(map));  //将map转为json写出去 out.flush(); out.close(); } }) //登录失败的处理器（前后端分离） .failureHandler(new AuthenticationFailureHandler() { @Override public void onAuthenticationFailure(HttpServletRequest req, HttpServletResponse resp, AuthenticationException e) throws IOException, ServletException { resp.setContentType("application/json;charset=utf-8"); PrintWriter out = resp.getWriter(); Map map = new HashMap<>(); map.put("status", 401); if (e instanceof LockedException){  //账号锁定 map.put("msg","账号被锁定，登录失败"); }else if (e instanceof BadCredentialsException){ map.put("msg","用户名和密码输入错误，登录失败"); }else if (e instanceof DisabledException){ map.put("msg","账号被禁用，登录失败"); }else if (e instanceof AccountExpiredException){ map.put("msg","账户过期，登录失败"); }else if (e instanceof CredentialsExpiredException){ map.put("msg","密码过期，登录失败"); }else { map.put("msg","登录失败"); } out.write(new ObjectMapper().writeValueAsString(map));  //将map转为json写出去 out.flush(); out.close(); } }) .permitAll()    //跟登录相关接口直接访问 .and() //注销登录 .logout() .logoutUrl("/logout") .logoutSuccessHandler(new LogoutSuccessHandler() { @Override public void onLogoutSuccess(HttpServletRequest req, HttpServletResponse resp, Authentication authentication) throws IOException, ServletException { resp.setContentType("application/json;charset=utf-8"); PrintWriter out = resp.getWriter(); Map map = new HashMap<>(); map.put("status", 200); map.put("msg", "注销登录成功");   //注销登录成功 out.write(new ObjectMapper().writeValueAsString(map));  //将map转为json写出去 out.flush(); out.close(); } }) .and() .csrf().disable(); } 

@Configuration public class MultiHttpSecurityConfig { //暂且密码不加密 @Bean PasswordEncoder passwordEncoder() { return NoOpPasswordEncoder.getInstance(); } //配置用户名和密码 @Autowired protected void configure(AuthenticationManagerBuilder auth) throws Exception { auth.inMemoryAuthentication() .withUser("LIFEILIN").password("LIFEILIN").roles("admin")   //第一个 .and() .withUser("123").password("123").roles("user"); //第二个 } @Configuration @Order(1) public static class AdminSecurityConfig extends WebSecurityConfigurerAdapter { @Override protected void configure(HttpSecurity http) throws Exception { http.antMatcher("/admin/**").authorizeRequests().anyRequest().hasRole("admin"); //admin角色访问 } } @Configuration public static class OtherSecurityConfig extends WebSecurityConfigurerAdapter { @Override protected void configure(HttpSecurity http) throws Exception { http.authorizeRequests().anyRequest().authenticated() .and() .formLogin() .loginProcessingUrl("/doLogin") .permitAll() .and() .csrf().disable(); } } } 

@Test void contextLoads() { for (int i=0;i<10;i++){ BCryptPasswordEncoder encoder = new BCryptPasswordEncoder(); System.out.println(encoder.encode("123")); } } 

@Autowired MethodService methodService; @GetMapping("/hello1") public String hello1(){ return methodService.admin(); } @GetMapping("/hello2") public String hello2(){ return methodService.user(); } @GetMapping("/hello3") public String hello3(){ return methodService.hello(); } 

@Service public class MethodService { @PreAuthorize("hasRole('admin')") public String admin() {  //需要admin角色才能访问 return "hello admin"; } @Secured("ROLE_user") public String user(){   //需要user角色才能访问 return "hello user"; } @PreAuthorize("hasAnyRole('admin','user')") //admin,user两种权限 public String hello(){ return "hello hello"; } } 

# 应用名称 spring.application.name=SpringBoot_11_security # 应用服务 WEB 访问端口 server.port=8080 #下面这些内容是为了让MyBatis映射 # 指定Mybatis的Mapper文件 mybatis.mapper-locations=classpath:mappers/*xml # 指定Mybatis的实体目录 mybatis.type-aliases-package=com.example.mybatis.entity # 数据库驱动： spring.datasource.driver-class-name=com.mysql.cj.jdbc.Driver # 数据源名称 spring.datasource.name=defaultDataSource # 数据库连接地址 spring.datasource.url=jdbc:mysql://localhost:3306/【数据库名称】?serverTimezone=UTC spring.datasource.type=com.alibaba.druid.pool.DruidDataSource # 数据库用户名&密码： spring.datasource.username=root spring.datasource.password=【数据库密码】

package com.example.bean; import org.springframework.security.core.GrantedAuthority; import org.springframework.security.core.authority.SimpleGrantedAuthority; import org.springframework.security.core.userdetails.UserDetails; import java.util.ArrayList; import java.util.Collection; import java.util.List; /** * @author 李飞林 * @ClassName User * @mail 1961785612@qq.com * @Description TODO * @date 2022/8/4 21:46 */ public class User implements UserDetails { private Integer id; private String username; private String password; private Boolean enabled; private Boolean locked; private List roles; public List getRoles() { return roles; } public void setRoles(List roles) { this.roles = roles; } public void setId(Integer id) { this.id = id; } public void setUsername(String username) { this.username = username; } public void setPassword(String password) { this.password = password; } public void setEnabled(Boolean enabled) { this.enabled = enabled; } public void setLocked(Boolean locked) { this.locked = locked; } public Integer getId() { return id; } @Override public String getUsername() { return username; } @Override public boolean isAccountNonExpired() {  //账号是否未过期 return true; } @Override public boolean isAccountNonLocked() {   //账号是否未锁定 return !locked; } @Override public boolean isCredentialsNonExpired() { return true; } @Override public boolean isEnabled() {    //是否可用 return enabled; } @Override public Collection getAuthorities() { List authorities=new ArrayList<>(); for (Role role:roles){ authorities.add(new SimpleGrantedAuthority("ROLE_"+role.getName()));//角色认证以ROLE_开始 } return authorities;    //返回用户所有角色 } @Override public String getPassword() { return password; } } 

package com.example.bean; /** * @author 李飞林 * @ClassName Role * @mail 1961785612@qq.com * @Description TODO * @date 2022/8/4 21:49 */ public class Role { private Integer id; private String name; private String nameZh; public Integer getId() { return id; } public void setId(Integer id) { this.id = id; } public String getName() { return name; } public void setName(String name) { this.name = name; } public String getNameZh() { return nameZh; } public void setNameZh(String nameZh) { this.nameZh = nameZh; } } 

package com.example.mapper; import com.example.bean.Role; import com.example.bean.User; import org.apache.ibatis.annotations.Mapper; import java.util.List; /** * @author 李飞林 * @ClassName UserMapper * @mail 1961785612@qq.com * @Description TODO * @date 2022/8/4 22:01 */ @Mapper public interface UserMapper { User loadUserByUsername(String username); List getUserRolesById(Integer id); } 

   select * from user where username = #{username};  select * from role where id in (select rid from user_role where uid = #{id}) 

package com.example.service; import com.example.bean.User; import com.example.mapper.UserMapper; import org.springframework.beans.factory.annotation.Autowired; import org.springframework.security.core.userdetails.UserDetails; import org.springframework.security.core.userdetails.UserDetailsService; import org.springframework.security.core.userdetails.UsernameNotFoundException; import org.springframework.stereotype.Service; /** * @author 李飞林 * @ClassName UserService * @mail 1961785612@qq.com * @Description TODO * @date 2022/8/4 22:01 */ @Service public class UserService implements UserDetailsService { @Autowired UserMapper userMapper; @Override public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException { User user = userMapper.loadUserByUsername(username); if (user == null) { throw new UsernameNotFoundException("用户不存在"); } user.setRoles(userMapper.getUserRolesById(user.getId())); return user; } } 

package com.example.config; import com.example.service.UserService; import org.springframework.beans.factory.annotation.Autowired; import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Configuration; import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder; import org.springframework.security.config.annotation.web.builders.HttpSecurity; import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter; import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder; import org.springframework.security.crypto.password.PasswordEncoder; /** * @author 李飞林 * @ClassName SecurityConfig * @mail 1961785612@qq.com * @Description TODO * @date 2022/8/4 22:35 */ @Configuration public class SecurityConfig extends WebSecurityConfigurerAdapter { @Autowired UserService userService; @Override protected void configure(AuthenticationManagerBuilder auth) throws Exception { auth.userDetailsService(userService); } @Bean PasswordEncoder passwordEncoder() { return new BCryptPasswordEncoder(); } @Override protected void configure(HttpSecurity http) throws Exception { http.authorizeRequests() .antMatchers("/dba/**").hasRole("dba") .antMatchers("/admin/**").hasRole("admin") .antMatchers("/user/**").hasRole("user") .anyRequest().authenticated()//其他可访问 .and() .formLogin() .permitAll() .and() .csrf().disable(); } } 

package com.example.controller; import org.springframework.web.bind.annotation.GetMapping; import org.springframework.web.bind.annotation.RestController; /** * @author 李飞林 * @ClassName HelloController * @mail 1961785612@qq.com * @Description TODO * @date 2022/8/4 22:40 */ @RestController public class HelloController { @GetMapping("/hello") public String hello() { return "hello security"; } @GetMapping("/dba/hello") public String dba() { return "hello dba"; } @GetMapping("/admin/hello") public String admin() { return "hello admin"; } @GetMapping("/user/hello") public String user() { return "hello user"; } } 

//角色继承 @Bean RoleHierarchy roleHierarchy() { RoleHierarchyImpl roleHierarchy = new RoleHierarchyImpl(); String hierarchy = "ROLE_dba > ROLE_admin > ROLE_user"; //dba > admin > user roleHierarchy.setHierarchy(hierarchy); return roleHierarchy; } 

@Override public Collection getAuthorities() { List authorities=new ArrayList<>(); for (Role role : roles) { authorities.add(new SimpleGrantedAuthority(role.getName())); } return authorities; } 

@Service public class UserServiceImpl extends ServiceImpl implements UserService, UserDetailsService { @Autowired UserMapper userMapper; @Override public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException { User user = userMapper.loadUserByUsername(username);	//根据登录字符串获获取用户名 if (user == null) { throw new UsernameNotFoundException("用户不存在"); } else { user.setRoles(userMapper.getRolesById(user.getId()));	//根据用户名的ID查询所具有的角色 } return user; } } 

@Mapper public interface UserMapper extends BaseMapper { User loadUserByUsername(String username); List getRolesById(Integer id); } 

 select * from user where username = #{username}   select * from role where id in (select rid from user_role where uid = #{id}); 

@Configuration public class SecurityConfig extends WebSecurityConfigurerAdapter { @Autowired UserServiceImpl userService; @Bean PasswordEncoder passwordEncoder(){ return new BCryptPasswordEncoder(); } //配置登录 @Override protected void configure(AuthenticationManagerBuilder auth) throws Exception { auth.userDetailsService(userService); } } 

  org.springframework.boot spring-boot-starter-data-redis    org.springframework.boot spring-boot-starter-cache  

## 配置redis #基本属性 spring.redis.host=localhost spring.redis.port=6379 spring.redis.database=0 spring.redis.password= #配置cache名称 spring.cache.cache-names=c1 

@Service @CacheConfig(cacheNames = "c1") public class MenuServiceImpl extends ServiceImpl implements MenuService { @Autowired MenuMapper menuMapper; //可以加缓存 @Cacheable public List getAllMenus() { return menuMapper.getAllMenus(); } } 

@Mapper public interface MenuMapper extends BaseMapper { List getAllMenus(); } 

   SELECT m.id, m.pattern, r.id     AS rid, r.NAME   AS rname, r.nameZh AS rnameZh FROM menu AS m LEFT JOIN menu_role AS mr ON m.id = mr.mid LEFT JOIN role AS r ON mr.rid = r.id   

@Component public class MyFilter implements FilterInvocationSecurityMetadataSource { //路径匹配符 AntPathMatcher pathMatcher = new AntPathMatcher(); @Autowired MenuServiceImpl menuService; @Override public Collection getAttributes(Object object) throws IllegalArgumentException { String requestUrl = ((FilterInvocation) object).getRequestUrl();//获取请求的地址 List allMenus = menuService.getAllMenus();//查询所有菜单 for (Menu menu : allMenus) { if (pathMatcher.match(menu.getPattern(), requestUrl)) { //请求地址与菜单地址匹配上 List roles = menu.getRoles(); //获取匹配成功的地址的角色 String[] rolesStr = new String[roles.size()]; for (int i = 0; i  getAllConfigAttributes() { return null; } @Override public boolean supports(Class clazz) { return true; } } 

@Component public class MyAccessDecisionManager implements AccessDecisionManager { @Override public void decide(Authentication authentication, Object object, Collection configAttributes) throws AccessDeniedException, InsufficientAuthenticationException { //authentication知道有哪些角色，configAttributes知道需要哪些角色 //1、遍历需要的角色 for (ConfigAttribute attribute : configAttributes) { if ("ROLE_login".equals(attribute.getAttribute())){//请求地址都没匹配上，说明是登陆后就可访问的请求地址 if (authentication instanceof AnonymousAuthenticationToken){    //匿名用户（没登陆） throw new AccessDeniedException("非法请求"); }else { return; } } //2、获取所具备的角色 Collection authorities = authentication.getAuthorities(); for (GrantedAuthority authority : authorities) { if (authority.getAuthority().equals(attribute.getAttribute())){//如果具备所需要的角色 return; } } } throw new AccessDeniedException("非法请求"); } @Override public boolean supports(ConfigAttribute attribute) { return true; } @Override public boolean supports(Class clazz) { return true; } } 

@Override protected void configure(HttpSecurity http) throws Exception { http.authorizeRequests() .withObjectPostProcessor(new ObjectPostProcessor() { @Override public  O postProcess(O object) { object.setAccessDecisionManager(myAccessDecisionManager);// object.setSecurityMetadataSource(myFilter);// return object; } }) .and() .formLogin() .permitAll() .and() .csrf().disable(); }