1.配置文件
修改仙姑吗的pom.xml,添加依赖
<!-- spring-security --> <dependency> <groupId>org.springframework.security</groupId> <artifactId>spring-security-web</artifactId> </dependency> <dependency> <groupId>org.springframework.security</groupId> <artifactId>spring-security-config</artifactId> </dependency> |
修改web.xml 加入以下配置
<!-- 配置Spring加载文件--> <context-param> <param-name>contextConfigLocation</param-name> <param-value>classpath:applicationContext*.xml</param-value> </context-param> <!-- 配置Spring的核心监听器 --> <listener> <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class> </listener> <!-- 配置SpringSecurity委派过滤器 --> <filter> <filter-name>springSecurityFilterChain</filter-name> <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class> </filter> <filter-mapping> <filter-name>springSecurityFilterChain</filter-name> <url-pattern>/*</url-pattern> </filter-mapping> |
在项目/src/main/resources/目录下创建applicationContext-security.xm
<?xml version="1.0" encoding="utf-8"?> <beans xmlns="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:security="http://www.springframework.org/schema/security" xmlns:dubbo="http://code.alibabatech.com/schema/dubbo" xmlns:context="http://www.springframework.org/schema/context" xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security.xsd http://code.alibabatech.com/schema/dubbo http://code.alibabatech.com/schema/dubbo/dubbo.xsd http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd"> <!--########## 配置请求URL拦截规则 ##########--> <!-- 配置哪些请求URL不被拦截 --> <security:http pattern="/*.html" security="none"/> <security:http pattern="/css/**" security="none"/> <security:http pattern="/img/**" security="none"/> <security:http pattern="/js/**" security="none"/> <security:http pattern="/plugins/**" security="none"/> <security:http pattern="/seller/save" security="none"/> <!-- 配置哪些请求URL需要拦截 --> <security:http use-expressions="false"> <!-- 配置剩余的请求地址都需要ROLE_SELLER角色或权限才可以访问 --> <security:intercept-url pattern="/**" access="ROLE_SELLER"/> <!-- 配置开启表单登录 --> <security:form-login login-page="/shoplogin.html" default-target-url="/admin/index.html" always-use-default-target="true" authentication-failure-url="/shoplogin.html"/> <!-- 配置跨站请求伪造不可用--> <security:csrf disabled="true"/> <!-- 配置头部分,指定框架页策略(iframe子窗口也可以访问)--> <security:headers> <security:frame-options policy="SAMEORIGIN"/> </security:headers> <!-- 配置退出登录 --> <security:logout logout-url="/logout"/> </security:http> <!-- 配置认证管理器 --> <security:authentication-manager> <!-- 配置认证提供者 --> <security:authentication-provider user-service-ref="userDetailsService"/> </security:authentication-manager> <!-- ############## 配置dubbo服务消费者 ############## --> <!-- 配置当前应用的名称 --> <dubbo:application name="pinyougou-shop-web"/> <!-- 配置zookeeper作为注册中心,发现服务地址 --> <dubbo:registry address="zookeeper://192.168.12.131:2181"/> <!-- 配置引用单个服务,产生服务接口代理对象 --> <dubbo:reference id="sellerService" interface="com.pinyougou.sellergoods.service.SellerService"/> <!-- 配置自定义的认证服务 --> <bean id="userDetailsService" class="com.pinyougou.shop.service.UserDetailsServiceImpl"> <property name="sellerService" ref="sellerService"/> </bean> </beans> |
创建UserDetailsServiceImpl.java,实现 UserDetailsService 接口
import org.springframework.security.core.GrantedAuthority; import org.springframework.security.core.authority.SimpleGrantedAuthority;import org.springframework.security.core.userdetails.User; import org.springframework.security.core.userdetails.UserDetails; import org.springframework.security.core.userdetails.UserDetailsService; import org.springframework.security.core.userdetails.UsernameNotFoundException; import java.util.ArrayList; import java.util.List; /** * 用户认证服务类 * @author lee.siu.wah * @version1.0 * <p>File Created at 2018-01-02<p> */ public class UserDetailsServiceImpl implements UserDetailsService { @Override publicUserDetails loadUserByUsername(String username) // username由前端页面传来 throws UsernameNotFoundException { /** 创建List集合封装角色或权限*/ List<GrantedAuthority> grantedAuths = new ArrayList<>(); /** 添加角色*/ grantedAuths.add(new SimpleGrantedAuthority("ROLE_SELLER")); /** 返回用户信息对象 */ return new User(username,"123456", grantedAuths); } } |
说明:经过上述配置,用户在输入密码123456时就会通过(用户名随意)