spring security使用数据库认证

在 Spring Security 中如果想要使用数据进行认证操作，有很多种操作方式，这里我们介绍使用 UserDetails 、 UserDetailsService来完成操作。

• UserDetails

public interface UserDetails extends Serializable {

Collection <? extends GrantedAuthority > getAuthorities ();

String getPassword ();

String getUsername ();

boolean isAccountNonExpired ();

boolean isAccountNonLocked ();

boolean isCredentialsNonExpired ();

boolean isEnabled ();

}

 UserDetails是一个接口，我们可以认为UserDetails作用是于封装当前进行认证的用户信息，但由于其是一个 接口，所以我们可以对其进行实现，也可以使用Spring Security提供的一个UserDetails的实现类User来完成 操作

• 2. User

public class User implements UserDetails , CredentialsContainer {

private String password ;

private final String username ;

private final Set < GrantedAuthority > authorities ; //角色（权限）

private final boolean accountNonExpired ; //帐户是否过期

private final boolean accountNonLocked ; // 帐户是否锁定

private final boolean credentialsNonExpired ; // 认证是否过期

private final boolean enabled ; // 帐户是否可用

｝

•  UserDetailsService

public interface UserDetailsService {

UserDetails loadUserByUsername(String username) throws UsernameNotFoundException;

}

流程

在service层实现

//首先service接口层继承UserDetailsService接口
public interface UserService extends UserDetailsService 

//然后再实现类中重写方法


@Service("userService")
public class UserServiceImpl implements UserService {

    @Autowired
    private UserDao userDao;

//实现loadUserByUsername
    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {

        UserInfo userInfo = userDao.findByUsername(username);
        //需要把userinfo转化为UserDetails，实现类User构造如下
        //public User(String username, String password,
        //	            权限：Collection<? extends GrantedAuthority > authorities)
        // 权限对象可以使用GrantedAuthority的子类 SimpleGrantedAuthority
        //将权限名（roles.getRoleName()）传给SimpleGrantedAuthority的构造器返回对应的对象。详细看下面的getAuthority方法

        List<Role> roles = userInfo.getRoles();
        List<SimpleGrantedAuthority> grantedAuthority = getAuthority(roles);
        //因为这里password未加密，所以要加上“{noop}”
        return new User(userInfo.getUsername(), "{noop}"+userInfo.getPassword(), grantedAuthority);
    }
    //根据role的权限字段，获取SimpleGrantedAuthority对象
    private List<SimpleGrantedAuthority> getAuthority(List<Role> roles) {
        List<SimpleGrantedAuthority> authoritys = new ArrayList();
        for (Role role : roles) {
            authoritys.add(new SimpleGrantedAuthority(role.getRoleName()));
        }
        return authoritys;
    }


}

配置文件：spring-security.xml

​
<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
	xmlns:security="http://www.springframework.org/schema/security"
	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
	xsi:schemaLocation="http://www.springframework.org/schema/beans          
    http://www.springframework.org/schema/beans/spring-beans.xsd          
    http://www.springframework.org/schema/security          
    http://www.springframework.org/schema/security/spring-security.xsd">
    
    <!-- 配置不拦截的资源 -->
    <security:http pattern="/login.jsp" security="none"/>
    <security:http pattern="/failer.jsp" security="none"/>
    <security:http pattern="/css/**" security="none"/>
    <security:http pattern="/img/**" security="none"/>
    <security:http pattern="/plugins/**" security="none"/>
    
    
    <security:http auto-config="true" use-expressions="false">
    	<!-- 配置具体的拦截的规则 pattern="请求路径的规则" access="访问系统的人必须有ROLE_USER的角色" -->
    	<security:intercept-url pattern="/**" access="ROLE_USER,ROLE_ADMIN"/>
    	
    	<!-- 定义跳转的具体的页面 -->
    	<security:form-login  
    		login-page="/login.jsp"
    		login-processing-url="/login.do"
    		default-target-url="/index.jsp"
    		authentication-failure-url="/failer.jsp"
    	/>
    	
    	<!-- 关闭跨域请求 -->
    	<security:csrf disabled="true"/>
    	
    	<!-- 退出 前台访问logout.do就会触发推出，删除session，跳转到login.do页面-->
    	<security:logout invalidate-session="true" logout-url="/logout.do" logout-success-url="/login.jsp" />
    	
    </security:http>
    
    <!-- 切换成数据库中的用户名和密码 -->
    <security:authentication-manager>
    	<security:authentication-provider user-service-ref="userService">
    		
		</security:authentication-provider>
    </security:authentication-manager>
    
    
 </beans>   
 
 
 
 
 
 
 
 
 
 
 
 
 

web.xml中

<?xml version="1.0" encoding="UTF-8"?>
<web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xmlns="http://xmlns.jcp.org/xml/ns/javaee"
         xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee http://xmlns.jcp.org/xml/ns/javaee/web-app_3_1.xsd"
         version="3.1">

    <!--配置监听器-->
    <listener>
        <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
    </listener>
    <!--配置加载类路径的配置文件,服务器启动会触发监听器读取配置文件applicationContext.xml-->
    <context-param>
        <param-name>contextConfigLocation</param-name>
        <param-value>classpath*:applicationContext.xml,classpath*:spring-security.xml</param-value>
    </context-param>

    <!--配置前端控制器，读取springmvc配置文件-->
    <servlet>
        <servlet-name>dispatcherServlet</servlet-name>
        <servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
        <init-param>
            <param-name>contextConfigLocation</param-name>
            <param-value>classpath:spring-mvc.xml</param-value>
        </init-param>
        <load-on-startup>1</load-on-startup>
    </servlet>
    <servlet-mapping>
        <servlet-name>dispatcherServlet</servlet-name>
        <url-pattern>*.do</url-pattern>
    </servlet-mapping>
    <!--字符编码过滤器-->
    <filter>
        <filter-name>characterEncodingFilter</filter-name>
        <filter-class>org.springframework.web.filter.CharacterEncodingFilter</filter-class>
        <init-param>
            <param-name>encoding</param-name>
            <param-value>UTF-8</param-value>
        </init-param>
    </filter>
    <filter-mapping>
        <filter-name>characterEncodingFilter</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>


    <!--security的过滤器 名字必须是springSecurityFilterChain-->
    <filter>
        <filter-name>springSecurityFilterChain</filter-name>
        <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
    </filter>
    <filter-mapping>
        <filter-name>springSecurityFilterChain</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>


    <!--  欢迎界面-->
    <welcome-file-list>
        <welcome-file>index.html</welcome-file>
        <welcome-file>index.htm</welcome-file>
        <welcome-file>index.jsp</welcome-file>
        <welcome-file>default.html</welcome-file>
        <welcome-file>default.htm</welcome-file>
        <welcome-file>default.jsp</welcome-file>
    </welcome-file-list>

</web-app>