springboot整合spring-security登录认证，复制就能用

springboot使用spring-security登录认证完整代码，一步一步来，复制就能用，别看那么长就放弃。

 

解决方法：

1.创建核心配置类，整合spring security

@Configurable

@EnableWebSecurity

public class WebSpringSecurityConfig extends WebSecurityConfigurerAdapter {

 

   @Value("${survey.openUrl}")

   private String openUrl;

 

   @Value("${survey.authenticationUrl}")

   private String authenticationUrl;

 

   @Autowired

   @Qualifier("survetRememberMeService")

   RememberMeServices rememberMeServices;

   @Autowired

  private SimpleAuthenticationProvider simpleAuthenticationProvider;

 

   @Override

   protected void configure(HttpSecurity http) throws Exception {

       List<String> openUrlList=new ArrayList<String>();

       if (!openUrl.isEmpty()){

           for(String s:openUrl.split(",")){

               openUrlList.add(s);

           }

       }

       List<String> authenticationUrllList=new ArrayList<String>();

       if (!authenticationUrl.isEmpty()){

           for(String s:authenticationUrl.split(",")){

               authenticationUrllList.add(s);

           }

       }

     

       http.cors().and().csrf().disable().exceptionHandling()

               .authenticationEntryPoint(new UnauthorizedEntryPoint())

               .and().headers()

               .frameOptions().disable().and().authorizeRequests()

               .antMatchers(authenticationUrllList.toArray(new String[0])).hasAnyRole("NORMAL","SUPERADMIN")//这里要注意了SUPERADMIN指的是数据库存的用户角色是ROLE_SUPERADMIN

               .antMatchers(openUrlList.toArray(new String[0])).permitAll()//匹配到的路径不需要验证

               .antMatchers("/api/login").permitAll()

               .anyRequest().authenticated()

               .and()

               .formLogin()

               .usernameParameter("userName").passwordParameter("password")

               .loginProcessingUrl("/api/login")

               .successHandler(new AjaxAuthSuccessHandler())

               .failureHandler(new AjaxAuthFailHandler())

               .and()

               .logout()

               .logoutUrl("/api/logout").logoutSuccessHandler(new AjaxLogoutSuccessHandler()).and().rememberMe().rememberMeServices(rememberMeServices);

 

   }

 

   @Autowired

   public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {

       super.configure(auth);

       auth.authenticationProvider(simpleAuthenticationProvider);

   }

 

}

 

2.UnauthorizedEntryPoint、AjaxAuthSuccessHandler、AjaxAuthFailHandler、AjaxLogoutSuccessHandler和SimpleAuthenticationProvider类源码可参考：http://www.yayihouse.com/yayishuwu/chapter/2848