配置spring.security框架

于 2020-03-13 22:42:22 发布
阅读量421 收藏
点赞数
分类专栏： security SSM 文章标签： java spring
版权声明：本文为博主原创文章，遵循 CC 4.0 BY-SA 版权协议，转载请附上原文出处链接和本声明。
本文链接：https://blog.csdn.net/luluke_lucky/article/details/104850472
版权

1、在pom.xml中进行jar包导入
在标签里先规定版本号，这里采用了5.0.1版本

  <!--spring.security的版本号-->
    <spring.security.version>5.0.1.RELEASE</spring.security.version>

然后再导入jar包

 <!--spring.security的jar包-->
    <dependency>
      <groupId>org.springframework.security</groupId>
      <artifactId>spring-security-web</artifactId>
      <version>${spring.security.version}</version>
    </dependency>
    <dependency>
      <groupId>org.springframework.security</groupId>
      <artifactId>spring-security-config</artifactId>
      <version>${spring.security.version}</version>
    </dependency>
    <dependency>
      <groupId>org.springframework.security</groupId>
      <artifactId>spring-security-core</artifactId>
      <version>${spring.security.version}</version>
    </dependency>
    <dependency>
      <groupId>org.springframework.security</groupId>
      <artifactId>spring-security-taglibs</artifactId>
      <version>${spring.security.version}</version>
    </dependency>

2、配置spring-security.xml文件

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
       xmlns:security="http://www.springframework.org/schema/security"
       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
       xsi:schemaLocation="http://www.springframework.org/schema/beans
    http://www.springframework.org/schema/beans/spring-beans.xsd
    http://www.springframework.org/schema/security
    http://www.springframework.org/schema/security/spring-security.xsd
 ">

    <security:global-method-security pre-post-annotations="enabled" jsr250-annotations="enabled"
                                     secured-annotations="enabled"></security:global-method-security>

    <!-- 配置不拦截的资源 -->
    <security:http pattern="/login.jsp" security="none"/>
    <security:http pattern="/failer.jsp" security="none"/>
    <security:http pattern="/css/**" security="none"/>
    <security:http pattern="/img/**" security="none"/>
    <security:http pattern="/plugins/**" security="none"/>
    <security:http pattern="/upLoad/**" security="none"/>
    <!--
    	配置具体的规则
    	auto-config="true"	不用自己编写登录的页面，框架提供默认登录页面
    	use-expressions="false"	是否使用SPEL表达式（没学习过）
    -->
    <security:http auto-config="true" use-expressions="true">
        <!-- 配置具体的拦截的规则 pattern="请求路径的规则" access="访问系统的人，必须有ROLE_USER的角色" -->
        <security:intercept-url pattern="/**" access="hasAnyRole('ROLE_USER','ROLE_ADMIN')"/>

        <security:form-login login-page="/login.jsp"
                             login-processing-url="/login.do"
                             default-target-url="/index.jsp"
                             authentication-failure-url="/failer.jsp"
                             authentication-success-forward-url="/pages/main.jsp"/>

        <!-- 关闭跨域请求 -->
        <security:csrf disabled="true"/>

        <!--退出并跳转到首页-->
        <security:logout invalidate-session="true" logout-url="/logout.do"
                         logout-success-url="/login.jsp"></security:logout>

    </security:http>

    <!-- 切换成数据库中的用户名和密码 -->
    <security:authentication-manager>
        <security:authentication-provider user-service-ref="userService">
            <!-- 配置加密的方式
            <security:password-encoder ref="passwordEncoder"/>　-->
        </security:authentication-provider>
    </security:authentication-manager>

    <!-- 配置加密类 -->
    <bean id="passwordEncoder" class="org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder"/>
    <!-- <bean id="webexpressionHandler" class="org.springframework.security.web.access.expression.DefaultWebSecurityExpressionHandler" />-->
    <!-- 提供了入门的方式，在内存中存入用户名和密码
    <security:authentication-manager>
    	<security:authentication-provider>
    		<security:user-service>
    			<security:user name="admin" password="{noop}admin" authorities="ROLE_USER"/>
    		</security:user-service>
    	</security:authentication-provider>
    </security:authentication-manager>
    -->

</beans>

3、在web.xml中进行相关配置
类加载中要加入spring-security.xml

<!-- 配置加载类路径的配置文件 -->
  <context-param>
    <param-name>contextConfigLocation</param-name>
    <param-value>classpath*:applicationContext.xml,classpath*:spring-security.xml</param-value>
  </context-param>

对拦截的请求进行配置

  <!--  配置Spring-Security的过滤器，会拦截所有的请求  -->
  <!--  在进入服务器Tomcat之后，但在进入servlet之前生效/出生-->
  <filter>
    <filter-name>springSecurityFilterChain</filter-name>
    <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
  </filter>
  <filter-mapping>
    <filter-name>springSecurityFilterChain</filter-name>
    <url-pattern>/*</url-pattern>
  </filter-mapping>

进行简单的一个用户角色权限管理与登录功能的实现演示spring.security框架

数据库表是三个简单的tb_user ,tb_role, tb_user_role（关联表）
1、简单的2个实体类的属性展示，get，set方法自行补全
role类

public class Role {

    private int rid;
    private String rname;
    private String rdesc;
    private int dataFlag;
    private Date createTime;

userInfo类
public class UserInfo {
private int id;
private String username;
private String password;

private List<Role> roleList;

2、dao层
IRoleMapper类

@Repository
public interface IRoleMapper {

    @Select("select * from tb_role where rid in(select rid from tb_user_role where uid =#{uid})")
    List<Role> findRoleByUserId(int uid);
}

UserInfo类

@Repository
public interface UserInfoMapper {
    @Select("select * from tb_user where username=#{username}")
     UserInfo doLogin(String username);

3、service层

UserInfoService接口继承security中的UserDetailsService类
（import org.springframework.security.core.userdetails.UserDetailsService;）
注意：因为security的密码验证是采用加密形式所以我们再将查询到的信息交给User类去处理时要对密码进行加密就是在密码前+"{noop}"进行拼接加密

public interface UserInfoService extends UserDetailsService {


    List<UserInfo> findAll(Integer page,Integer size);
    void addUser(UserInfo userInfo);
    void deUserById(int id);
    UserInfo updSelUserInfoById(int id);
    void updUserInfo(UserInfo userInfo);
    List<UserInfo>findByUsername(String username,Integer page,Integer size);
}

UserInfoServiceImpl实现类重写UserDetailsService类的loadUserByUsername（）方法

package service;


    @Service("userService")
    public class UserInfoServiceImpl implements UserInfoService{
        @Autowired
        private UserInfoMapper userInfoMapper;

        @Autowired
        private IRoleMapper roleMapper;
    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        //根据姓名查到当前登录的用户
        UserInfo userInfo = userInfoMapper.doLogin(username);
       //根据当前登录的用户ID，去查询到所有的角色
        List<Role> roleList=roleMapper.findRoleByUserId(userInfo.getId());

        userInfo.setRoleList(roleList);

        //等到想要的信息之后，就要交给Security去处理了
        User user=new User(userInfo.getUsername(),"{noop}"+userInfo.getPassword(),getAuthority(roleList));

        return user;
    }

    private Collection<? extends GrantedAuthority> getAuthority(List<Role> roleList) {

       List <SimpleGrantedAuthority> list=new ArrayList<>();

        for (Role role:roleList
             ) {
            list.add(new SimpleGrantedAuthority("ROLE_"+role.getRname()));
        }
        return list;
    }
}

4、Controller层
不需要我们自己再进行写了，security自带了登录的Controller类
下面在security配置文件中就已经配置好了控制类

 <security:http auto-config="true" use-expressions="true">
        <!-- 配置具体的拦截的规则 pattern="请求路径的规则" access="访问系统的人，必须有ROLE_USER的角色" -->
        <security:intercept-url pattern="/**" access="hasAnyRole('ROLE_USER','ROLE_ADMIN')"/>

        <security:form-login login-page="/login.jsp"
                             login-processing-url="/login.do"
                             default-target-url="/index.jsp"
                             authentication-failure-url="/failer.jsp"
                             authentication-success-forward-url="/pages/main.jsp"/>

简单的jsp页面表单

<form action="${pageContext.request.contextPath}/login.do" method="post">
				<div class="form-group has-feedback">
					<input type="text" name="username" class="form-control"
						placeholder="用户名"> <span
						class="glyphicon glyphicon-envelope form-control-feedback"></span>
				</div>
				<div class="form-group has-feedback">
					<input type="password" name="password" class="form-control"
						placeholder="密码"> <span
						class="glyphicon glyphicon-lock form-control-feedback"></span>
				</div>
				<div class="row">
					<div class="col-xs-8">
						<div class="checkbox icheck">
							<label><input type="checkbox"> 记住 下次自动登录</label>
						</div>
					</div>
					<!-- /.col -->
					<div class="col-xs-4">
						<button type="submit" class="btn btn-primary btn-block btn-flat">登录</button>
					</div>
					<!-- /.col -->
				</div>
			</form>
LuLuke_lucky
关注
专栏目录
评论
添加红包

请填写红包祝福语或标题

个

红包个数最小为10个

元

红包金额最低5元

当前余额3.43元 前往充值 >
需支付：10.00元
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付元
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明：

1.余额是钱包充值的虚拟货币，按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载，可以购买VIP、付费专栏及课程。

余额充值