Spring-Security（数据库认证）

导入依赖

        <dependency>
            <groupId>org.springframework.security</groupId>
            <artifactId>spring-security-web</artifactId>
            <version>${spring.security.version}</version>
        </dependency>
        <dependency>
            <groupId>org.springframework.security</groupId>
            <artifactId>spring-security-config</artifactId>
            <version>${spring.security.version}</version>
        </dependency>
        <dependency>
            <groupId>org.springframework.security</groupId>
            <artifactId>spring-security-core</artifactId>
            <version>${spring.security.version}</version>
        </dependency>
        <dependency>
            <groupId>org.springframework.security</groupId>
            <artifactId>spring-security-taglibs</artifactId>
            <version>${spring.security.version}</version>
        </dependency>

web.xml配置

 <context-param>        
	 <param-name>contextConfigLocation</param-name>        
	 <param-value>classpath:spring-security.xml</param-value>   
 </context-param>    
  <listener>       
	   <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>    
 </listener>   
<filter>        
    <filter-name>springSecurityFilterChain</filter-name>        
    <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>    </filter>
<filter-mapping>
      <filter-name>springSecurityFilterChain</filter-name>        
      <url-pattern>/*</url-pattern>    
</filter-mapping>

spring-security.xml

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
       xmlns:security="http://www.springframework.org/schema/security"
       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
       xsi:schemaLocation="http://www.springframework.org/schema/beans
    http://www.springframework.org/schema/beans/spring-beans.xsd
    http://www.springframework.org/schema/security
    http://www.springframework.org/schema/security/spring-security.xsd">

    <!-- 配置不拦截的资源 -->
    <security:http pattern="/login.jsp" security="none"/>
    <security:http pattern="/failer.jsp" security="none"/>
    <security:http pattern="/css/**" security="none"/>
    <security:http pattern="/img/**" security="none"/>
    <security:http pattern="/plugins/**" security="none"/>
    <!--
    	配置具体的规则
    	auto-config="true"	自动配置
    	use-expressions="true"	是否使用SPEL表达式（没学习过）
    -->
    <security:http auto-config="true" use-expressions="true">
     <!--  
		让验证页面可以匿名访问
		<security:intercept pattern="/login.jsp" access="permitAll()"/>
	-->
        <!-- 配置具体的拦截的规则 pattern="请求路径的规则" access="访问系统的人，必须有ROLE_USER的角色" -->
        <security:intercept-url pattern="/**" access="hasAnyAuthority('ROLE_USER','ROLE_ADMIN')"/>

        <!-- 定义跳转的具体的页面 -->
        <security:form-login
                login-page="/login.jsp"
                login-processing-url="/login.do"
                default-target-url="/index.jsp"
                authentication-failure-url="/failer.jsp"
                authentication-success-forward-url="/pages/main.jsp"
        />

        <!-- 关闭跨域请求 -->
        <!-- 也可以不关，但是在登录页面的from表单上要加入<security:csrfInput />来自动获取csrf的值 -->
        <!-- 如果不关则所有的有风险的操作都要用POST的方式来进行，同时还要加入上述的标签来获取csrf的值-->
        <security:csrf disabled="true"/>
        <!-- 退出 -->
        <security:logout invalidate-session="true" logout-url="/logout.do" logout-success-url="/login.jsp" />

    </security:http>

    <!-- 切换成数据库中的用户名和密码 -->
    <security:authentication-manager>
        <security:authentication-provider user-service-ref="userService">
            <!-- 配置加密的方式
            <security:password-encoder ref="passwordEncoder"/>-->
        </security:authentication-provider>
    </security:authentication-manager>

    <!-- 配置加密类 -->
    <bean id="passwordEncoder" class="org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder"/>

    <!-- 提供了入门的方式，在内存中存入用户名和密码
    <security:authentication-manager>
    	<security:authentication-provider>
    		<security:user-service>
    			<security:user name="admin" password="{noop}admin" authorities="ROLE_USER"/>
    		</security:user-service>
    	</security:authentication-provider>
    </security:authentication-manager>
    -->

</beans>

主要流程

service代码

public interface IUserService extends UserDetailsService {
    public List<UserInfo> findAll();

    public UserInfo findByUsername(String name);
}

@Service("userService")
@Transactional
public class UserServiceImpl implements IUserService {

    @Autowired
    private IUserDao userDao;

    @Override
    public UserDetails loadUserByUsername(String s) throws UsernameNotFoundException {
        UserInfo userInfo=null;
        try {
            userInfo = userDao.findByUsername(s);
        } catch (Exception e) {
            e.printStackTrace();
        }
     /**
     * 1.如果配置了加密方式则可以不用拼接{noop}（数据库中的密码信息也必须是加密了的）
     * 2.可以设置账号的状态User user=new User(userInfo.getUsername(),
     * userInfo.getPassword(),
     * userInfo.getStatus==1,
     * true,
     * true,
     * true,
     * getAuthority())
     */
    User user=new User(userInfo.getUsername(),"{noop}"+userInfo.getPassword(),getAuthority());
        return user;
    }
      /**
     * 由于上述的new User(byUsername.getUsername(),"{noop}"+byUsername.getPassword(),getAuthority())的权限参数类型要
     * 用到的是SimpleGrantedAuthority类型，所以则需要以下方法获得。
     * 当自己的数据库内有权限数据和用户数据绑定时则可以用有参数的方法。
     * 注意：不管是那种，权限的值的格式为“ROLE_”
     *
     * @return
     */
    public List<SimpleGrantedAuthority> getAuthority(){
        List<SimpleGrantedAuthority> list=new ArrayList<>();
        list.add(new SimpleGrantedAuthority("ROLE_USER"));
        return list;
    }
    private List<SimpleGrantedAuthority> getAuthority(List<Role> roles) {
        List<SimpleGrantedAuthority> authoritys = new ArrayList();
        for (Role role : roles) {
            authoritys.add(new SimpleGrantedAuthority(role.getRoleName()));
        }
        return authoritys;
    }
}