SpringBoot 2.x 集成SpringSecurity(二）之用户授权

最新推荐文章于 2024-09-12 23:23:29 发布

jefry52

最新推荐文章于 2024-09-12 23:23:29 发布

阅读量415

点赞数

分类专栏： SpringBoot 文章标签： spring boot

本文链接：https://blog.csdn.net/jefry52/article/details/106250105

版权

SpringBoot 专栏收录该内容

3 篇文章 0 订阅

订阅专栏

一、基于注解方式用户授权：

JSR-250注解：

主要注解

@DenyAll 拒绝
@RolesAllowed 按角色允许，省略ROLE_前缀
@PermitAll 允许

1、Spring Security默认是关闭的，需要使用注解开启，代码如下：

package com.jefry.security;

import org.mybatis.spring.annotation.MapperScan;
import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;

@SpringBootApplication
@EnableGlobalMethodSecurity(jsr250Enabled = true)
@MapperScan("com.jefry.security.mapper")
public class SecurityApplication {

    public static void main(String[] args) {
        SpringApplication.run(SecurityApplication.class, args);
    }

}

2、在controller给不同用户增加不同的访问权限，代码如下：

package com.jefry.security.controller;

import lombok.extern.slf4j.Slf4j;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RestController;

import javax.annotation.security.RolesAllowed;

@Slf4j
@RestController
public class hello {

    @GetMapping("/demo")
    public String demo() {
        return "Demo";
    }

    @GetMapping("/admin")
    @RolesAllowed("ADMIN")
    public String admin() {
        return "admin";
    }

    @GetMapping("/user")
    @RolesAllowed("USER")
    public String user() {
        return "user";
    }

    @GetMapping("/guest")
    @RolesAllowed("GUEST")
    public String guest() {
        return "guest";
    }
}

3、修改UserDetailService，给用户增加授权：

package com.jefry.security.service;

import com.jefry.security.entity.UserEntity;
import com.jefry.security.mapper.UserMapper;
import lombok.extern.slf4j.Slf4j;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.core.authority.AuthorityUtils;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.core.userdetails.UsernameNotFoundException;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.stereotype.Component;


@Component
@Slf4j
public class UserDetailService implements UserDetailsService {

    @Autowired
    private PasswordEncoder passwordEncoder;

    @Autowired
    private UserService userService;

    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        UserEntity userEntity = userService.loadUsername(username);
        if (userEntity == null) {
            throw new UsernameNotFoundException("账号不存在");
        }
        String password = passwordEncoder.encode(userEntity.getPassword());
        log.info("登录账号：{}，密码：{}", username, password);
        return new User(username, password, AuthorityUtils.commaSeparatedStringToAuthorityList("ROLE_USER"));
    }
}

AuthorityUtils.commaSeparatedStringToAuthorityList("ROLE_USER") 就是给用户授于角色:USER，SpringSecurity的角色都需要统一加上ROLE_前缀。

访问http://127.0.0.1:8080/user 可以正常访问，/demo也可以正常访问，其它不可以；需要注意下账号授于的角色必须与RolesAllowed里的一致，不然不可以访问的，可以同时授多个角色如：RolesAllowed({"ADMIN","USER"})。

securedEnabled注解：

主要注解