Spring-security基本教程（5.2.0版本）

• 今天在配置spring安全框架的时候英文没有注意细节导致项目多次启动失败，所以开个帖子记录以下配置，以免日后遗忘。

一、依赖的jar包

• 由于是maven项目，直接贴上pom

 <!--spring-security框架-->
        <dependency>
            <groupId>org.springframework.security</groupId>
            <artifactId>spring-security-config</artifactId>
            <version>5.2.0.RELEASE</version>
        </dependency>
        <dependency>
            <groupId>org.springframework.security</groupId>
            <artifactId>spring-security-core</artifactId>
            <version>5.2.0.RELEASE</version>
        </dependency>
        <dependency>
            <groupId>org.springframework.security</groupId>
            <artifactId>spring-security-web</artifactId>
            <version>5.2.0.RELEASE</version>
        </dependency>

二、security配置文件：

• 这个配置文件要被主配置文件引入
  – <import resource="classpath:spring-security.xml"/>
• 或者注入到全局参数（TomCat为例）

   <context-param>
       <param-name>contextConfigLocation</param-name>
       <param-value>/WEB-INF/security.xml</param-value>
   </context-param>

   <listener>
       <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
   </listener>

• 配置文件内容

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
       xmlns:security="http://www.springframework.org/schema/security"
       xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd http://www.springframework.org/schema/security https://www.springframework.org/schema/security/spring-security.xsd">

    <!--放行登录界面和注册界面-->
    <security:http pattern="/*.html" security="none"/>
    <security:http pattern="/css/**" security="none"/>
    <security:http pattern="/img/**" security="none"/>
    <security:http pattern="/js/**" security="none"/>
    <security:http pattern="/plugins/**" security="none"/>
    <security:http pattern="/seller/add.do" security="none"/>

    <security:http use-expressions="false">

        <!-- 配置框架页面不拦截 -->
        <security:headers>
            <security:frame-options policy="SAMEORIGIN"/>
        </security:headers>

        <!--指定需要验证权限的路径，access是指的需要的权限-->
        <security:intercept-url pattern="/**" access="ROLE_ADMIN"/>
        <!--指定登录界面-->
        <security:form-login default-target-url="/admin/index.html" login-page="/shoplogin.html"
                             always-use-default-target="true"
                             authentication-failure-url="/shoplogin.html"/>
        <!--指定注销的路径-->
        <security:logout logout-url="/logout"/>
        
        <security:csrf disabled="true"/>
    </security:http>

    <!--配置不进行密码加密-->
    <!--没有这个bean则会用默认的加密方式加密密码加密-->
    <bean id="passwordEncoder"
          class="org.springframework.security.crypto.password.NoOpPasswordEncoder"/>

    <security:authentication-manager>
        <!--这里的userAuth指向自定的实现类-->
        <security:authentication-provider user-service-ref="userAuth">
            <security:password-encoder ref="passwordEncoder"/>
        </security:authentication-provider>
    </security:authentication-manager>

</beans>

三、自定的验证实现类

@Component
//自定的验证实现类要求实现UserDetailsService接口，并实现其中的loadUserByUsername方法
public class UserAuth implements UserDetailsService {

    //由于使用的是dubbo微服务，需要用注解注入bean
    @Reference
    SellerService sellerService;

    /**
     *
     * @param username 这里spring安全框架会将登录表单中的用户名传入，自己编写逻辑查询相应的密码
     * @return 返回的内容中包含账号和密码，spring安全框架会对其进行验证
     */
    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        //账号为空则直接返回null，返回null会登录失败
        if (username == null) {
            return null;
        }
        //从数据库获取该账号对应的对象
        List<Seller> sellers = sellerService.selectById(username);
        if (sellers.size() > 0) {
            Seller seller = sellers.get(0);
            //配置权限
            LinkedList<GrantedAuthority> grantedAuthorities = new LinkedList<>();
            //这里对应配置文件的access属性
            grantedAuthorities.add(new SimpleGrantedAuthority("ROLE_ADMIN"));
            //返回一个user对象，注意这里的User不是自己的pojo，而是spring的User
            //import org.springframework.security.core.userdetails.User;
            //                  username          password               该账号拥有的权限集合
            return new User(seller.getSellerId(), seller.getPassword(), grantedAuthorities);
        }
        return null;
    }
}