SpringBoot集成Spring Security（开启菜单权限验证）

 

• pom.xml

        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-security</artifactId>
        </dependency>

• 创建User及UserService

创建User类，该类实现了UserDetails接口

@Data
public class User implements UserDetails {
    private Long id;
    private String name;
    private String phone;
    private String telephone;
    private String address;
    private boolean enabled;// 账号是否启用
    private String username;
    private String password;
    private String remark;
    private List<Role> roles;
    private String userface;

    @Override
    public Collection<? extends GrantedAuthority> getAuthorities() {
        List<GrantedAuthority> authorities = new ArrayList<>();
        if (roles != null){
            for (Role role : roles) {
                authorities.add(new SimpleGrantedAuthority(role.getName()));
            }
        }
        return authorities;
    }

    @Override
    public boolean isAccountNonExpired() {
        return true;
    }

    @Override
    public boolean isAccountNonLocked() {
        return true;
    }

    @Override
    public boolean isCredentialsNonExpired() {
        return true;
    }

    @Override
    public boolean isEnabled() {
        return enabled;
    }

}

UserDetails中有一个方法叫做getAuthorities，该方法用来获取当前用户所具有的角色，但是User中有一个roles属性用来描

述当前用户的角色，因此getAuthorities方法的实现如上，直接从roles中获取当前用户所具有的角色，构造

SimpleGrantedAuthority然后返回即可

创建好User之后，需要创建UserService，用来执行登录等操作，UserService需要实现UserDetailsService接口

@Service
public class UserService implements UserDetailsService {

    @Autowired
    UserMapper userMapper;

    @Override
    public UserDetails loadUserByUsername(String s) throws UsernameNotFoundException {
        User user = userMapper.loadUserByUsername(s);
        if (user == null) {
            throw new UsernameNotFoundException("用户名不对");
        }
        return user;
    }
}

这里实现了UserDetailsService接口中的loadUserByUsername方法，在执行登录的过程中，这个方法将根据用户名去查找用户，

如果用户不存在，则抛出UsernameNotFoundException异常，否则直接将查到的User返回 

• 自定义FilterInvocationSecurityMetadataSource

FilterInvocationSecurityMetadataSource有一个默认的实现类DefaultFilterInvocationSecurityMetadataSource，该类的主要功能

就是通过当前的请求地址，获取该地址需要的用户角色。可以自己也定义一个FilterInvocationSecurityMetadataSource实现同样

功能

@Component
public class CustomMetadataSource implements FilterInvocationSecurityMetadataSource {
    //注入MenuService，MenuService的作用是用来查询数据库中url pattern和role的对应关系
    @Autowired
    MenuService menuService;
    AntPathMatcher antPathMatcher = new AntPat