SpringSecurity开发基于表单认证

自定义用户认证逻辑

1.处理用户信息获取逻辑：         UserDetailsService

2.处理用户校验逻辑： UserDetails

3.处理密码加密解密： PasswordEncoder

测试调用某接口

默认开启springsecurity校验

spring.datasource.driver-class-name = com.mysql.jdbc.Driver
spring.datasource.url= jdbc:mysql://127.0.0.1:3306/imooc-demo?useUnicode=yes&characterEncoding=UTF-8&useSSL=false
spring.datasource.username = root
spring.datasource.password = root

#关闭集群的session管理
spring.session.store-type = none

#security.basic.enabled = false

server.port = 8060

配置SpringSecurity拦截器

PasswordEncoder：注入SpringSecurity密码加密类

@Configuration
public class BrowserSecurityConfig extends WebSecurityConfigurerAdapter {

	@Bean
	public PasswordEncoder passwordEncoder(){
		return  new BCryptPasswordEncoder();
	}

	@Override
	protected void configure(HttpSecurity http) throws Exception {

		//表单登录
		http.formLogin()
//		http.httpBasic()
			.and()//合并后面的操作
			.authorizeRequests()//下面这些都是授权的配置
			.anyRequest()//任何请求
			.authenticated();//都需要身份认证
		
	}

}

处理获取用户信息

SpringSecurity登录会进入此Service，改接口实现了springsecurity登录的时候需要的所有信息，通过实现lodUserByUsername自己实现获取用户的过程

@Component
public class MyUserDetailsService  implements UserDetailsService {

    private Logger logger = LoggerFactory.getLogger(this.getClass());

    @Autowired
    private PasswordEncoder passwordEncoder;

    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        //TODO 根据用户名查找用户信息
        logger.info("用户名" + username);
        //根据用户名查找用户信息
        //根据查找到的用户信息判断用户是否被冻结
        //不一定非得使用springsecurity的User类，可以自己定义业务层面的user类实现UserDetails，后面的是否过期，是否有效，自定义实现
//        return new User(username,
//                "123456",
//                true,true,true,true,
//                AuthorityUtils.commaSeparatedStringToAuthorityList("admin"));
        return new User(username,
                passwordEncoder.encode("123456"),
                true,true,true,true,
                AuthorityUtils.commaSeparatedStringToAuthorityList("admin"));
    }

}

return new User(username,
                passwordEncoder.encode("123456"),
                true,true,true,true,
                AuthorityUtils.commaSeparatedStringToAuthorityList("admin"));

passwordEncoder.encode("123456")，这里应该在注册账号时候使用，用于密码加密，同一个密码每次加密结果会不同

也可以通过自定义方式实现UserDetails返回值

UserDetails:

public interface UserDetails extends Serializable {
	// ~ Methods
	// ========================================================================================================

	/**
	 * Returns the authorities granted to the user. Cannot return <code>null</code>.
	 *
	 * @return the authorities, sorted by natural key (never <code>null</code>)
	 */
	Collection<? extends GrantedAuthority> getAuthorities();

	/**
	 * Returns the password used to authenticate the user.
	 *
	 * @return the password
	 */
	String getPassword();

	/**
	 * Returns the username used to authenticate the user. Cannot return <code>null</code>
	 * .
	 *
	 * @return the username (never <code>null</code>)
	 */
	String getUsername();

	/**
	 * Indicates whether the user's account has expired. An expired account cannot be
	 * authenticated.
	 *
	 * @return <code>true</code> if the user's account is valid (ie non-expired),
	 * <code>false</code> if no longer valid (ie expired)
	 */
	boolean isAccountNonExpired();

	/**
	 * Indicates whether the user is locked or unlocked. A locked user cannot be
	 * authenticated.
	 *
	 * @return <code>true</code> if the user is not locked, <code>false</code> otherwise
	 */
	boolean isAccountNonLocked();

	/**
	 * Indicates whether the user's credentials (password) has expired. Expired
	 * credentials prevent authentication.
	 *
	 * @return <code>true</code> if the user's credentials are valid (ie non-expired),
	 * <code>false</code> if no longer valid (ie expired)
	 */
	boolean isCredentialsNonExpired();

	/**
	 * Indicates whether the user is enabled or disabled. A disabled user cannot be
	 * authenticated.
	 *
	 * @return <code>true</code> if the user is enabled, <code>false</code> otherwise
	 */
	boolean isEnabled();
}

getAuthorities:用户权限集合

getPassword：密码

getUsername：用户名

isAccountNonExpired：账户是否过期，需要自己实现怎么判断，如果业务中没有这个概念永远返回true

isCredentialsNonExpired:密码是否过期

isAccountNonLocked：账户是不是锁定了（实际业务中是否有意义需要自己衡量，可以代表该账户是否被冻结）

isEnabled：表示用户是否被删除了，相当于业务中逻辑删除