用户登录和授权（三）springboot+security实现

Springboot整合security实现用户的身份认证和授权

1. 配置security；
2. 查询用户的身份信息和用户权限；
3. demo地址：https://github.com/pshdhx/security-boot-pshdhx.git

1、配置security

package com.pshdhx.config;

import org.springframework.context.annotation.Bean;

import org.springframework.context.annotation.Configuration;

import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;

import org.springframework.security.config.annotation.web.builders.HttpSecurity;

import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;

import org.springframework.security.config.http.SessionCreationPolicy;

import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;

import org.springframework.security.crypto.password.PasswordEncoder;

/**

 * 【核心】

 */

@Configuration

@EnableGlobalMethodSecurity(securedEnabled = true,prePostEnabled = true)

public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

    //定义用户信息服务（查询用户信息）

/*

    @Bean

    public UserDetailsService userDetailsService(){

        InMemoryUserDetailsManager manager = new InMemoryUserDetailsManager();

        manager.createUser(User.withUsername("zhangsan").password("123").authorities("p1").build());

        manager.createUser(User.withUsername("lisi").password("456").authorities("p2").build());

        return manager;

    }

*/

    //密码编码器

    /*@Bean

    public PasswordEncoder passwordEncoder(){

        return NoOpPasswordEncoder.getInstance();

    }*/

    @Bean

    public PasswordEncoder passwordEncoder() {

        return new BCryptPasswordEncoder();

    }

    //安全拦截机制（最重要）

    @Override

    protected void configure(HttpSecurity http) throws Exception {

        http.csrf().disable() //关闭csrf

                .authorizeRequests()

//                .antMatchers("/r/r1").hasAuthority("p2")

//                .antMatchers("/r/r2").hasAuthority("p2")

                .antMatchers("/r/**").authenticated()//所有/r/**的请求必须认证通过

                .anyRequest().permitAll()//除了/r/**，其它的请求可以访问

                .and()

                .formLogin()//允许表单登录

                .loginPage("/login-view")//登录页面=视图解析器URL

                .loginProcessingUrl("/login")//登录控制器接口

                .successForwardUrl("/login-success")//自定义登录成功页面接口

                .and()

                .sessionManagement()

                .sessionCreationPolicy(SessionCreationPolicy.IF_REQUIRED)//需要的时候创建session会话；

                .and()

                .logout()

                .logoutUrl("/logout")//浏览器URL退出

                .logoutSuccessUrl("/login-view?logout");//退出成功后的浏览器URL

    }

}

2、查询用户的身份和权限，保存的security的上下文中

package com.pshdhx.service;

import com.pshdhx.dao.UserDao;

import com.pshdhx.model.UserDto;

import org.springframework.beans.factory.annotation.Autowired;

import org.springframework.security.core.userdetails.User;

import org.springframework.security.core.userdetails.UserDetails;

import org.springframework.security.core.userdetails.UserDetailsService;

import org.springframework.security.core.userdetails.UsernameNotFoundException;

import org.springframework.stereotype.Service;

import java.util.List;

/**

 * @author Administrator

 * @version 1.0

 * 【核心】

 **/

@Service

public class SpringDataUserDetailsService implements UserDetailsService {

    @Autowired

    UserDao userDao;

    //根据 账号查询用户信息

    @Override

    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {

        //将来连接数据库根据账号查询用户信息

        UserDto userDto = userDao.getUserByUsername(username);

        if(userDto == null){

            //如果用户查不到，返回null，由provider来抛出异常

            return null;

        }

        //根据用户的id查询用户的权限

        List<String> permissions = userDao.findPermissionsByUserId(userDto.getId());

        //将permissions转成数组

        String[] permissionArray = new String[permissions.size()];

        permissions.toArray(permissionArray);

        UserDetails userDetails = User.withUsername(userDto.getUsername()).password(userDto.getPassword()).authorities(permissionArray).build();

        return userDetails;

    }

}