springboot集成security

最新推荐文章于 2024-07-09 16:17:35 发布

看到此人请让他滚去学习

最新推荐文章于 2024-07-09 16:17:35 发布

阅读量190

点赞数 1

文章标签： java spring

本文链接：https://blog.csdn.net/weixin_44728476/article/details/104946925

版权

springboot 集成 security实现权限控制

1.导入依赖

<dependencies>
		<dependency>
			<groupId>org.springframework.boot</groupId>
			<artifactId>spring-boot-starter-web</artifactId>
			<version>2.0.4.RELEASE</version>
		</dependency>
		<dependency>
			<groupId>org.springframework.boot</groupId>
			<artifactId>spring-boot-starter-data-jpa</artifactId>
		</dependency>
		<dependency>
			<groupId>org.springframework.boot</groupId>
			<artifactId>spring-boot-starter-security</artifactId>
		</dependency>
		<dependency>
			<groupId>org.springframework.boot</groupId>
			<artifactId>spring-boot-starter-thymeleaf</artifactId>
		</dependency>

		<dependency>
			<groupId>org.springframework.boot</groupId>
			<artifactId>spring-boot-starter-test</artifactId>
			<scope>test</scope>
			<exclusions>
				<exclusion>
					<groupId>org.junit.vintage</groupId>
					<artifactId>junit-vintage-engine</artifactId>
				</exclusion>
			</exclusions>
		</dependency>
		<dependency>
			<groupId>org.springframework.security</groupId>
			<artifactId>spring-security-test</artifactId>
			<scope>test</scope>
		</dependency>
		<dependency>
			<groupId>mysql</groupId>
			<artifactId>mysql-connector-java</artifactId>
			<version>5.1.6</version>
		</dependency>
		<dependency>
			<groupId>org.springframework</groupId>
			<artifactId>spring-webmvc</artifactId>
			<version>5.2.1.RELEASE</version>
		</dependency>
		<dependency>
			<groupId>javax</groupId>
			<artifactId>javaee-api</artifactId>
			<version>7.0</version>
		</dependency>
	</dependencies>

2.配置数据库

spring.datasource.driver-class-name=com.mysql.jdbc.Driver
spring.datasource.url=jdbc:mysql://localhost:3306/demo-test?useUnicode=true&characterEncoding=utf-8
spring.datasource.username=root
spring.datasource.password=root

logging.level.org.springframework.security=info
spring.thymeleaf.cache=false
spring.jpa.hibernate.ddl-auto=update
spring.jpa.show-sql=true
spring.jackson.serialization.indent_output=true

3.创建用户和角色
>实现UserDetails接口
>重写getAuthorities方法，将用户角色作为权限

package com.ysj.springbootsecurity.myyoung.springbootsecurity;

import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.authority.SimpleGrantedAuthority;
import org.springframework.security.core.userdetails.UserDetails;

import javax.persistence.*;

import java.util.ArrayList;
import java.util.Collection;
import java.util.List;

/**
 * @Author:HuangYan
 * @Description:
 * @Date:Create in 9:44 2020/3/18
 * @Modified By:
 */
@Entity
public class SysUser implements UserDetails{
    @Id
    @GeneratedValue
    private Long id;
    private String username;
    private String password;
    @ManyToMany(cascade = {CascadeType.REFRESH},fetch = FetchType.EAGER)
    private List<SysRole> roles;

    @Override
    public boolean isAccountNonExpired() {
        return true;
    }

    @Override
    public boolean isAccountNonLocked() {
        return true;
    }

    @Override
    public boolean isCredentialsNonExpired() {
        return true;
    }

    @Override
    public boolean isEnabled() {
        return true;
    }

    @Override
    public Collection<? extends GrantedAuthority> getAuthorities() {
        ArrayList<GrantedAuthority> auths = new ArrayList<>();

        List<SysRole> roles = this.getRoles();
        for (SysRole role : roles) {
            auths.add(new SimpleGrantedAuthority(role.getName()));
        };
        return auths;
    }
    
    public Long getId() {
        return id;
    }

    public void setId(Long id) {
        this.id = id;
    }

    @Override
    public String getUsername() {
        return username;
    }

    public void setUsername(String username) {
        this.username = username;
    }

    @Override
    public String getPassword() {
        return password;
    }

    public void setPassword(String password) {
        this.password = password;
    }

    public List<SysRole> getRoles() {
        return roles;
    }

    public void setRoles(List<SysRole> roles) {
        this.roles = roles;
    }
}

4.表中插入自定义用户数据，密码需加密
5.角色实体类

package com.ysj.springbootsecurity.myyoung.springbootsecurity;

import javax.persistence.Entity;
import javax.persistence.GeneratedValue;
import javax.persistence.Id;

/**
 * @Author:HuangYan
 * @Description: 权限类
 * @Date:Create in 9:54 2020/3/18
 * @Modified By:
 */
@Entity
public class SysRole {
    @Id
    @GeneratedValue
    private Long id;
    private String name;

    public Long getId() {
        return id;
    }

    public void setId(Long id) {
        this.id = id;
    }

    public String getName() {
        return name;
    }

    public void setName(String name) {
        this.name = name;
    }
}

6.传值对象，测试不同权限登录

package com.ysj.springbootsecurity.myyoung.springbootsecurity;

/**
 * @Author:HuangYan
 * @Description: 传值对象
 * @Date:Create in 10:51 2020/3/18
 * @Modified By:
 */
public class Msg {
    private String title;
    private String content;
    private String extraInfo;

    public Msg() {
    }

    public Msg(String title, String content, String extraInfo) {
        this.title = title;
        this.content = content;
        this.extraInfo = extraInfo;
    }

    public String getTitle() {
        return title;
    }

    public void setTitle(String title) {
        this.title = title;
    }

    public String getContent() {
        return content;
    }

    public void setContent(String content) {
        this.content = content;
    }

    public String getExtraInfo() {
        return extraInfo;
    }

    public void setExtraInfo(String extraInfo) {
        this.extraInfo = extraInfo;
    }
}

7.访问数据，只做了简单的根据username查询

package com.ysj.springbootsecurity.myyoung.springbootsecurity;

import org.springframework.data.jpa.repository.JpaRepository;

/**
 * @Author:HuangYan
 * @Description: 访问数据
 * @Date:Create in 10:54 2020/3/18
 * @Modified By:
 */
public interface SysUserRepository extends JpaRepository<SysUser,Long>{

    SysUser findByUsername(String username);
}

8.自定义userService实现UserDetailService接口重写loadUserByUsername方法，通过该方法查询到对应的用户，这里之所以要实现UserDetailsService接口，是因为在Spring Security中我们配置相关参数需要UserDetailsService类型的数据。

package com.ysj.springbootsecurity.myyoung.springbootsecurity;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.core.userdetails.UsernameNotFoundException;

/**
 * @Author:HuangYan
 * @Description:
 * @Date:Create in 10:58 2020/3/18
 * @Modified By:
 */
public class CustomUserService implements UserDetailsService{
    @Autowired
    private SysUserRepository sysUserRepository;

    @Override
    public UserDetails loadUserByUsername(String s) throws UsernameNotFoundException {
        SysUser user = sysUserRepository.findByUsername(s);
        if(user == null){
            throw new RuntimeException("用户名不存在");
        }
        return user;
    }
}

SpringMVC配置

package com.ysj.springbootsecurity.myyoung.springbootsecurity;

import org.springframework.context.annotation.Configuration;
import org.springframework.web.servlet.config.annotation.ViewControllerRegistry;
import org.springframework.web.servlet.config.annotation.WebMvcConfigurationSupport;

/**
 * @Author:HuangYan
 * @Description: Spring Mvc 配置
 * @Date:Create in 11:06 2020/3/18
 * @Modified By:
 */
@Configuration
public class WebMvcConfig extends WebMvcConfigurationSupport {
    //注册访问/login转向login.html页面
    @Override
    protected void addViewControllers(ViewControllerRegistry registry) {
        registry.addViewController("/login").setViewName("login");
    }
}

Spring Security配置

package com.ysj.springbootsecurity.myyoung.springbootsecurity;

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;

/**
 * @Author:HuangYan
 * @Description: Spring Security配置
 * @Date:Create in 11:13 2020/3/18
 * @Modified By:
 */

@Configuration
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
    @Bean
    UserDetailsService customUserDetailService(){
        return new CustomUserService();
    }

    @Bean
    public PasswordEncoder passwordEncoder(){
        return new BCryptPasswordEncoder();
    }
	
	/**
	*Spring Security 升级到5版本后密码支持多种加密格式；
	*/
    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.userDetailsService(customUserDetailService()).passwordEncoder(passwordEncoder());
    }

    /**
     *
     * @param http
     * @throws Exception
     */
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests()
                .anyRequest().authenticated()
                .and().formLogin().loginPage("/login").failureUrl("/login?error").permitAll().and()
                .logout().permitAll();
    }
}

1.首先当我们要自定义Spring Security的时候我们需要继承自
WebSecurityConfigurerAdapter来完成，相关配置重写对应方法即可。
2.我们在这里注册CustomUserService的Bean，然后通过重写configure
方法添加我们自定义的认证方式。
3.在configure(HttpSecurity http)方法中，我们设置了登录页面，
而且登录页面任何人都可以访问，然后设置了登录失败地址，也设置了注销请求，
注销请求也是任何人都可以访问的。
4.permitAll表示该请求任何人都可以访问，.anyRequest().authenticated(),
表示其他的请求都必须要有权限认证。
5.这里我们可以通过匹配器来匹配路径，比如antMatchers方法，
假设我要管理员才可以访问admin文件夹下的内容，我可以这样来写：
.antMatchers("/admin/").hasRole(“ROLE_ADMIN”)，
也可以设置admin文件夹下的文件可以有多个角色来访问，
写法如下：.antMatchers("/admin/").
hasAnyRole(“ROLE_ADMIN”,“ROLE_USER”)
6.可以通过hasIpAddress来指定某一个ip可以访问该资源,
假设只允许访问ip为210.210.210.210的请求获取admin下的资源，
写法如下.antMatchers("/admin/**").hasIpAddress(“210.210.210.210”)

登录页面

login.html

<!DOCTYPE html>
<html lang="en" xmlns:th="http://www.thymeleaf.org">
<head>
    <meta charset="UTF-8"/>
    <title>登录</title>
    <style type="text/css">
        body {
            padding-top: 50px;
        }

        .starter-template {
            padding: 40px 15px;
            text-align: center;
        }
    </style>
</head>
<body>
<nav class="navbar navbar-inverse navbar-fixed-top">
    <div class="container">
        <div class="navbar-header">
            <a class="navbar-brand" href="#">Spring Security演示</a>
        </div>
        <div id="navbar" class="collapse navbar-collapse">
            <ul class="nav navbar-nav">
                <li><a th:href="@{/}">首页</a></li>
                <li><a th:href="@{http://www.baidu.com}">百度</a></li>
            </ul>
        </div>
    </div>
</nav>
<div class="container">
    <div class="starter-template">
        <p th:if="${param.logout}" class="bg-warning">已注销</p>
        <p th:if="${param.error}" class="bg-danger">有错误，请重试</p>
        <h2>使用账号密码登录</h2>
        <form class="form-signin" role="form" name="form" th:action="@{/login}" action="/login" method="post">
            <div class="form-group">
                <label for="username">账号</label>
                <input type="text" class="form-control" id="username" name="username" value="" placeholder="账号"/>
            </div>
            <div class="form-group">
                <label for="password">密码</label>
                <input type="password" class="form-control" id="password" name="password" placeholder="密码"/>
            </div>
            <input type="submit" id="login" value="Login" class="btn btn-primary"/>
        </form>
    </div>
</div>
</body>
</html>

index.html

<!DOCTYPE html>
<html lang="en" xmlns:th="http://www.thymeleaf.org"
      xmlns:sec="http://www.thymeleaf.org/thymeleaf-extras-springsecurity4">
<head>
    <meta charset="UTF-8"/>
    <title sec:authentication="name"></title>
    <style type="text/css">
        body {
            padding-top: 50px;
        }

        .starter-template {
            padding: 40px 15px;
            text-align: center;
        }
    </style>
</head>
<body>
<nav class="navbar navbar-inverse navbar-fixed-top">
    <div class="container">
        <div class="navbar-header">
            <a class="navbar-brand" href="#">Spring Security演示</a>
        </div>
        <div id="navbar" class="collapse navbar-collapse">
            <ul class="nav navbar-nav">
                <li><a th:href="@{/}">首页</a></li>
                <li><a th:href="@{http://www.baidu.com}">百度</a></li>
            </ul>
        </div>
    </div>
</nav>
<div class="container">
    <div class="starter-template">
        <h1 th:text="${msg.title}"></h1>
        <p class="bg-primary" th:text="${msg.content}"></p>
        <div sec:authorize="hasRole('ROLE_ADMIN')">
            <p class="bg-info" th:text="${msg.extraInfo}"></p>
        </div>
        <div sec:authorize="hasRole('ROLE_USER')">
            <p class="bg-info">无更多显示信息</p>
        </div>
        <form th:action="@{/logout}" method="post">
            <input type="submit" class="btn btn-primary" value="注销"/>
        </form>
    </div>
</div>
</body>
</html>

demo结构

在这里插入图片描述
原文出处：https://blog.csdn.net/jianpengxuexikaifa/article/details/104523473/
在此基础上稍加改进

看到此人请让他滚去学习

关注

1
点赞
踩
0

收藏

觉得还不错? 一键收藏
0
评论
springboot集成security

springboot 集成 security实现权限控制1.导入依赖<dependencies> <dependency> <groupId>org.springframework.boot</groupId> <artifactId>spring-boot-starter-web</artifactId>...
复制链接

扫一扫