spring security用户密码加密

1编码方式

加密：可以使用BCryptPasswordEncoder对象的 encode(CharSequence rawPassword) 方法加密CharSequence这个类型是字符串的顶级接口，所以可以直接传递字符串进行加密

可以把获取BCryptPasswordEncoder对象放到工具类中（也可以将这个对象交给ioc容器管理。。。。然后再service层直接注入）

    private static BCryptPasswordEncoder bCryptPasswordEncoder = new BCryptPasswordEncoder();

    public static String encodingPassword(String password){

        return  bCryptPasswordEncoder.encode(password);
    }
}

 然后在service层进行对应加密

    @Override
    public void save(UserInfo userInfo) {
        userInfo.setPassword(BCryptPasswordEncodingUtil.encodingPassword(userInfo.getPassword()));
        userDao.save(userInfo);
    }

登陆1： 在登陆时候将数据库获取的加密的密码和输入的密码进行对比，对应的方法

public boolean matches(CharSequence rawPassword, String encodedPassword) 

这里就不做操作了。。

 

2配置方式登陆

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
   xmlns:security="http://www.springframework.org/schema/security"
   xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
   xsi:schemaLocation="http://www.springframework.org/schema/beans          
    http://www.springframework.org/schema/beans/spring-beans.xsd          
    http://www.springframework.org/schema/security          
    http://www.springframework.org/schema/security/spring-security.xsd">
    
    <!-- 配置不拦截的资源 -->
    <security:http pattern="/login.jsp" security="none"/>
    <security:http pattern="/failer.jsp" security="none"/>
    <security:http pattern="/css/**" security="none"/>
    <security:http pattern="/img/**" security="none"/>
    <security:http pattern="/plugins/**" security="none"/>
    
    <!--
       配置具体的规则
       auto-config="true" 不用自己编写登录的页面，框架提供默认登录页面
       use-expressions="false"    是否使用SPEL表达式（没学习过）
    -->
    <security:http auto-config="true" use-expressions="false">
       <!-- 配置具体的拦截的规则 pattern="请求路径的规则" access="访问系统的人必须有ROLE_USER的角色" -->
       <security:intercept-url pattern="/**" access="ROLE_USER,ROLE_ADMIN"/>
       
       <!-- 定义跳转的具体的页面 -->
       <security:form-login  
          login-page="/login.jsp"
          login-processing-url="/login.do"
          default-target-url="/index.jsp"
          authentication-failure-url="/failer.jsp"
       />
       
       <!-- 关闭跨域请求 -->
       <security:csrf disabled="true"/>
       
       <!-- 退出 -->
       <security:logout invalidate-session="true" logout-url="/logout.do" logout-success-url="/login.jsp" />
       
    </security:http>
    
    <!-- 切换成数据库中的用户名和密码 -->
    <security:authentication-manager>
       <security:authentication-provider user-service-ref="userService">
          <!-- 配置加密的方式 -->
          <security:password-encoder ref="passwordEncoder"/>
       </security:authentication-provider>
    </security:authentication-manager>
    
    <!-- 配置加密类 -->
    <bean id="passwordEncoder" class="org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder"/>

    <!-- 提供了入门的方式，在内存中存入用户名和密码
    <security:authentication-manager>
       <security:authentication-provider>
          <security:user-service>
             <security:user name="admin" password="{noop}admin" authorities="ROLE_USER"/>
          </security:user-service>
       </security:authentication-provider>
    </security:authentication-manager>
    -->

 </beans>   
 
 
 
 
 
 
 
 
 
 
 
 
 

 

//登陆
@Override
public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {

    UserInfo userInfo = userDao.findByUsername(username);
    //需要把userinfo转化为UserDetails，实现类User构造如下
    //public User(String username, String password,
    //             权限：Collection<? extends GrantedAuthority > authorities)
    // 权限对象可以使用GrantedAuthority的子类 SimpleGrantedAuthority
    //将权限名（roles.getRoleName()）传给SimpleGrantedAuthority的构造器返回对应的对象。详细看下面的getAuthority方法

    List<Role> roles = userInfo.getRoles();
    List<SimpleGrantedAuthority> grantedAuthority = getAuthority(roles);

    // User(String username, String password, boolean enabled,
    //    boolean accountNonExpired, boolean credentialsNonExpired,
    //    boolean accountNonLocked, Collection<? extends GrantedAuthority> authorities)
    //下面这个参数较少的构造，其实也是调用上面这个构造
    //return new User(userInfo.getUsername(), "{noop}"+userInfo.getPassword(), grantedAuthority);
   return new User(userInfo.getUsername(),
           userInfo.getPassword(),
           userInfo.getStatus()==1,
           true,
           true,
           true,
           grantedAuthority//角色权限，根据角色的名字获取
           );
}


private List<SimpleGrantedAuthority> getAuthority(List<Role> roles) {
    List<SimpleGrantedAuthority> authoritys = new ArrayList();
    for (Role role : roles) {
        authoritys.add(new SimpleGrantedAuthority(role.getRoleName()));
    }
    return authoritys;
}

security提供了controller，我们不需要写controlle层，只需要service接口继承UserDetailsService，然后再实现类实现以上方法即可