一、导包
在maven项目的pom.xml文件下输入:
<dependency>
<groupId>org.springframework.security</groupId>
<artifactId>spring-security-web</artifactId>
<version>${spring.security.version}</version>
</dependency>
<dependency>
<groupId>org.springframework.security</groupId>
<artifactId>spring-security-config</artifactId>
<version>${spring.security.version}</version>
</dependency>
<dependency>
<groupId>org.springframework.security</groupId>
<artifactId>spring-security-core</artifactId>
<version>${spring.security.version}</version>
</dependency>
<dependency>
<groupId>org.springframework.security</groupId>
<artifactId>spring-security-taglibs</artifactId>
<version>${spring.security.version}</version>
</dependency>
二、配置
在下面的配置文件中进行配置

<!-- 配置不拦截的资源 -->
<security:http pattern="/login.jsp" security="none"/>
<security:http pattern="/failer.jsp" security="none"/>
<security:http pattern="/css/**" security="none"/>
<security:http pattern="/img/**" security="none"/>
<security:http pattern="/plugins/**" security="none"/>
<security:http auto-config="true" use-expressions="true">
<!-- 配置具体的拦截的规则 pattern="请求路径的规则" access="访问系统的人,必须有ROLE_USER的角色" -->
<security:intercept-url pattern="/**" access="hasAnyRole('ROLE_USER','ROLE_ADMIN')"/>
<security:form-login login-page="/login.jsp"
login-processing-url="/login.do"
default-target-url="/index.jsp"
authentication-failure-url="/failer.jsp"
authentication-success-forward-url="/pages/main.jsp"/>
<!-- 关闭跨域请求 -->
<security:csrf disabled="true"/>
<!--退出并跳转到首页-->
<security:logout invalidate-session="true" logout-url="/logout.do" logout-success-url="/login.jsp"></security:logout>
</security:http>
三、在提供登录用户名密码的Service中,使其继承于UserDetailsService
例如:

然后在其实现类中获取用户名和密码和角色权限
public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
UserInfo userInfo = userInfoDao.findByUserName(username);
List<Role> roles = roleDao.findRoleByUserId(userInfo.getId());
User user = new User(userInfo.getUsername(),"{noop}"+userInfo.getPassword(),getAuthority(roles));
return user;
}
private Collection<? extends GrantedAuthority> getAuthority(List<Role> roles) {
List<SimpleGrantedAuthority> list = new ArrayList<>();
for(Role role:roles){
list.add(new SimpleGrantedAuthority("ROLE_"+role.getRolename()));
}
return list;
}
在对应的mapper层编写实现该数据库操作的配置文件:
<select id="findByUserName" resultType="com.study.bean.UserInfo" parameterType="String">
select * from userinfo where username=#{username}
</select>
<select id="findRoleByUserId" parameterType="int" resultType="com.study.bean.Role">
select * from role where id in(select roleid from user_role where userid =#{id})
</select>
四、最后
通过以上步骤,即可完成使用该框架实现权限控制功能。当登录成功后即可访问拦截的内容,登录失败或者未登录状态下访问其他页面时会跳转到登录页面。
本文介绍了如何使用Spring Security框架实现Web应用的权限控制。主要内容包括:在Maven项目中引入依赖、配置安全拦截规则、实现登录认证服务以及数据库操作等步骤。

被折叠的 条评论
为什么被折叠?



