1.引入springsecurity的启动依赖
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-security</artifactId>
</dependency>
2.增加配置类
@Configuration
@EnableWebSecurity
public class DemoSecurity extends WebSecurityConfigurerAdapter {
@Autowired
private UserService userService;
@Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
//配置用户数据从数据库中读取,密码使用NoOpPasswordEncoder类加密处理(明文密码),
//如果数据库里的密码字段使用了md5等加密,这里就要用相应的加密类处理
auth.userDetailsService(userService).passwordEncoder(NoOpPasswordEncoder.getInstance());
}
@Override
protected void configure(HttpSecurity http) throws Exception {
http.authorizeRequests()
.antMatchers("/css/**").permitAll()//配置不进行权限校验的url
.antMatchers("/tologin").permitAll()
.antMatchers("/mylogin").permitAll()
.antMatchers("/**").authenticated()//配置拦截校验所有请求(这里会自动放开前面配置的不进行校验的url)
.and().formLogin()//登录相关配置
.loginPage("/tologin")//登录页面
.loginProcessingUrl("/mylogin")//登录表单提交的url,这里配置什么值,表单的action中就填写这个url
.usernameParameter("myusername")//登录表单提交的用户名参数名称
.passwordParameter("mypassword")//登录表单提交的密码参数名称
.successHandler(authenticationSuccessHandler())//登录成功后,跳转的主页
.failureHandler(authenticationFailureHandler())//登录失败处理
.and().logout()//登出相关配置
.logoutRequestMatcher(new AntPathRequestMatcher("/mylogout", "GET")).logoutSuccessUrl("/tologin")
.and().exceptionHandling()//校验异常相关配置
.accessDeniedPage("/mycontroller/401");//登录成功后访问没有权限的资源
}
public AuthenticationFailureHandler authenticationFailureHandler() {
return new AuthenticationFailureHandler() {
@Override
public void onAuthenticationFailure(HttpServletRequest request, HttpServletResponse response, AuthenticationException exception) throws IOException, ServletException {
request.setAttribute("msg","用户名或密码错误!");//返回错误信息
request.getRequestDispatcher("/tologin").forward(request,response);//转发的到登录界面
}
};
}
public AuthenticationSuccessHandler authenticationSuccessHandler() {
return new AuthenticationSuccessHandler() {
@Override
public void onAuthenticationSuccess(HttpServletRequest request, HttpServletResponse response, Authentication authentication) throws IOException, ServletException {
request.getRequestDispatcher("/mycontroller/test?msg=1234").forward(request,response);//登录成功后转发至首页
}
};
}
}
3.从数据库获取权限信息,userservice要实现org.springframework.security.core.userdetails.UserDetailsService接口
@Service
public class UserService implements UserDetailsService {
@Autowired
private UserDao userDao;
@Override
public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
User user = userDao.selectUserAndRoles(username);
if (user == null) {
return new User();
}
return user;
}
}
4.User实体要实现org.springframework.security.core.userdetails.UserDetails接口
public class User implements Serializable, UserDetails {
private Integer id;
private Integer age;
private String password;
private String username;
private Integer ctryId;
private List<Role> roles;
//用户权限数据
@Override
public Collection<? extends GrantedAuthority> getAuthorities() {
return roles;
}
//账号没有过期
@Override
public boolean isAccountNonExpired() {
return true;
}
//账号没有锁定
@Override
public boolean isAccountNonLocked() { return true; }
//证书没有过期
@Override
public boolean isCredentialsNonExpired() { return true; }
//客户有效
@Override
public boolean isEnabled() {
return true;
}
}
5.Role实体要实现org.springframework.security.core.GrantedAuthority接口
public class Role implements GrantedAuthority {
private int id;
private String roleName;
//角色名称
@Override
public String getAuthority() {
return this.roleName;
}
}
6.thmeleaf中使用springsecurity的标签
引入依赖
<dependency>
<groupId>org.thymeleaf.extras</groupId>
<artifactId>thymeleaf-extras-springsecurity4</artifactId>
<version>3.0.2.RELEASE</version>
</dependency>
页面添加命名空间
<html lang="en" xmlns:th="http://www.thymeleaf.org"
xmlns:sec="http://www.thymeleaf.org/thymeleaf-extras-springsecurity4">
注意:在使用hasRole判断权限时,例如hasRole('admin') ,数据库中的角色名称必须是ROLE_admin。因为springsecurity在实现hasRole方法时,会自动在admin前增加ROLE_前缀