SpringBoot中使用Security(二)

前面一篇文章说到

实现一个配置类继承WebSecurityConfigurerAdapter，并且重写configure(HttpSecurity http)方法。同样可以取消掉Security登录验证。

@Configuration
@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests().antMatchers("/**").permitAll();
    }

    /**
     * 配置一个userDetailsService Bean
     * 不再生成默认security.user用户
     */
    @Bean
    @Override
    protected UserDetailsService userDetailsService() {
        return super.userDetailsService();
    }
}
这种方式取消了Security的验证。关于登录的一些操作就是在这做，例如用户防重复登录等。上面的方法是取消了Security的登录验证，在这可以像配置文件中配置用户名和密码一样，把用户名和密写在这。

import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;

@Configuration
@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

//    @Override
//    protected void configure(HttpSecurity http) throws Exception {
//        http.authorizeRequests().antMatchers("/**").permitAll();
//    }

    /**
     * 将配置中的用户名和密码写在这里。
     * 这里可以对用户密码进行加密
     * 这个configure和上面的configure只存在一个更加合理，因为上面的configure是取消验证，这个是给验证加规则
     * @param auth
     * @throws Exception
     */
    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.inMemoryAuthentication()
                .passwordEncoder(new BCryptPasswordEncoder())
                .withUser("admin")
                .password(new BCryptPasswordEncoder().encode("admin"))
                .roles("ADMIN");
    }

    /**
     * 配置一个userDerailsService Bean
     * 不再生成默认security.user用户
     */
    protected UserDetailsService userDetailsService(){
        return super.userDetailsService();
    }
}

这样书写就是将用户名和密码写在了后台代码中，实现了和配置文件中一样的功能。但是正常情况下登录不会是这样简单.

 

我们可以这样做，在WebSecurityConfigureAdapter实现类中实现下面代码。

将加密类型抽离出来，实现UserDetailsService接口，将两者注入到AuthenticationManagerBuilder中：

import com.one.smile.service.impl.MyUserDetailsService;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;

@Configuration
@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
    //在MyUserDetailsService中实现用户名和密码的操作
    @Autowired
    private MyUserDetailsService userDetailsService;

    @Bean
    public BCryptPasswordEncoder passwordEncoder(){
        return new BCryptPasswordEncoder();
    }

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.userDetailsService(userDetailsService)
                .passwordEncoder(passwordEncoder());
    }
}
Service层类MyUserDeailsService
UserDetaisService接口实现类
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.authority.SimpleGrantedAuthority;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.core.userdetails.UsernameNotFoundException;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.stereotype.Service;
import java.util.ArrayList;
import java.util.Collection;

@Service
public class MyUserDetailsService implements UserDetailsService {
    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        Collection<GrantedAuthority> authorities = new ArrayList<>();
        authorities.add(new SimpleGrantedAuthority("ADMIN"));
        return new User("root", new BCryptPasswordEncoder().encode("root"), authorities);
    }
}

这里的 User 对象是框架提供的一个用户对象，注意包名是：org.springframework.security.core.userdetails.User，里面的属性中最核心的就是password，username和authorities。

这时候去访问项目，要求输入的用户名和密码就是你抽离出去的UserDetailsService接口的实现类中定义的用户名和密码。