当前SpringBoot版本2.2.5.RELEASE,对应SpringSecurity5.2.2.RELEASE
1.声明
当前内容用于不认人学习和使用SpringSecurity,当前内容主要涉及SpringSecurity访问数据库集成MyBatis的操作,实现用户权限的基本控制
2.pom依赖
<parent>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-parent</artifactId>
<version>2.2.5.RELEASE</version>
<relativePath/> <!-- lookup parent from repository -->
</parent>
<dependency>
<groupId>junit</groupId>
<artifactId>junit</artifactId>
<version>3.8.1</version>
<scope>test</scope>
</dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-web</artifactId>
</dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-security</artifactId>
</dependency>
<dependency>
<groupId>org.projectlombok</groupId>
<artifactId>lombok</artifactId>
</dependency>
<dependency>
<groupId>org.mybatis.spring.boot</groupId>
<artifactId>mybatis-spring-boot-starter</artifactId>
<version>RELEASE</version>
</dependency>
<dependency>
<groupId>mysql</groupId>
<artifactId>mysql-connector-java</artifactId>
<version>5.1.46</version>
<scope>runtime</scope>
</dependency>
<!-- https://mvnrepository.com/artifact/com.alibaba/druid -->
<dependency>
<groupId>com.alibaba</groupId>
<artifactId>druid</artifactId>
<version>1.1.21</version>
</dependency>
3.实体类Account和Controller以及入口类
实体类
@Data
@AllArgsConstructor
@NoArgsConstructor
public class Account {
private Long id;
private String username;
private String password;
private Boolean enabled;
private List<String> roles;
}
controller层
@RestController
public class VisitController {
@RequestMapping("/visitAdminPage")
public String visitAdminPage() {
return "访问admin页面成功";
}
@RequestMapping("/visitUserPage")
public String visitUserPage() {
return "访问user页面成功";
}
@RequestMapping("/visitIndexPage")
public String visitIndexPage() {
return "访问index页面成功";
}
}
入口类
@SpringBootApplication
public class SpringSecurityMybatisApplication {
public static void main(String[] args) {
SpringApplication.run(SpringSecurityMybatisApplication.class, args);
}
}
4.创建配置类
数据源配置
@Configuration
@PropertySource(value = { "db.properties" })
public class DataSourceConfig {
@Value("${url}")
private String url;
@Value("${dbname}")
private String dbname;
@Value("${dbpwd}")
private String dbpwd;
@Value("${driverClassName}")
private String driverClassName;
@Bean
public DataSource configDataSource() {
DruidDataSource dataSource = new DruidDataSource();
dataSource.setDriverClassName(driverClassName);
dataSource.setUrl(url);
dataSource.setUsername(dbname);
dataSource.setPassword(dbpwd);
return dataSource;
}
}
db.properties文件
url=jdbc:mysql://localhost:3306/springboot-security
dbname=root
dbpwd=root
driverClassName=com.mysql.jdbc.Driver
mybatis的配置类
@Configuration
@MapperScan(basePackages = {"com.hy.springboot.security.mybatis.mapper"})
@EnableTransactionManagement
public class MyBatisConfig {
@Autowired
DataSource dataSource; // mybatis需要数据源
// 配置当前sql会话工厂
@Bean("sqlSessionFactoryBean")
public SqlSessionFactoryBean configSqlSessionFactoryBean() throws Exception {
SqlSessionFactoryBean sqlSessionFactoryBean = new SqlSessionFactoryBean();
sqlSessionFactoryBean.setDataSource(dataSource);
sqlSessionFactoryBean.setTypeAliasesPackage("com.hy.springboot.security.mybatis.entity");
/* sqlSessionFactoryBean.setMapperLocations(mapperLocations); */
return sqlSessionFactoryBean;
}
}
SpringSecurity的配置类
@Configuration
public class SpringSecurityConfig extends WebSecurityConfigurerAdapter {
// 创建自定义的userDetailService用于获取用户信息
@Bean
protected UserDetailsService userDetailsService() {
return new DefaultUserDetailsService();
}
class DefaultUserDetailsService implements UserDetailsService {
@Autowired
AccountMapper accountMapper;
@Override
public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
if (username == null || "".equals(username.trim())) {
throw new UsernameNotFoundException("用户名不能为空!");
}
Account account = accountMapper.findByUsername(username);
if (account == null) {
throw new UsernameNotFoundException("用户名不存在!");
}
Collection<GrantedAuthority> roles = new ArrayList<GrantedAuthority>();
for (String roleName : account.getRoles()) {
roles.add(new SimpleGrantedAuthority(roleName));
}
return new User(account.getUsername(), account.getPassword(), account.getEnabled(), true, true, true,
roles);
}
}
@Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
// TODO Auto-generated method stub
//BCryptPasswordEncoder使用这个加密方式
// 本人不使用加密方式
auth.userDetailsService(userDetailsService()).passwordEncoder(NoOpPasswordEncoder.getInstance());
}
@Override
protected void configure(HttpSecurity http) throws Exception {
http.authorizeRequests()
.antMatchers("/visitAdminPage").hasRole("ADMIN")
.antMatchers("/visitUserPage").hasRole("USER")// 所需要的格式为ROLE_USER,必须以ROLE_开头
.anyRequest().authenticated()
.and()
.formLogin().successForwardUrl("/visitIndexPage").permitAll()
.and().csrf().disable();
}
}
5.创建Mapper类和Mapper的配置文件
public interface AccountMapper {
Account findByUsername(String username);
}
<mapper
namespace="com.hy.springboot.security.mybatis.mapper.AccountMapper">
<resultMap type="account" id="tableAccount">
<id column="id" property="id" />
<result column="username" property="username" />
<result column="password" property="password" />
<result column="enabled" property="enabled" />
<collection property="roles" ofType="String">
<constructor>
<arg column="roleName" />
</constructor>
</collection>
</resultMap>
<select id="findByUsername" resultMap="tableAccount">
SELECT u.*,r.`roleName`
FROM security_mybatis_users u
INNER JOIN security_mybatis_roles r ON r.`username`=u.`username`
WHERE u.`username`=#{username}
</select>
</mapper>
6.数据库的表创建
users表
role表
7.登录测试
然后各种页面测试都成功,用user登录也成功,权限校验也成功
8.总结
1.通过实现UserDetailsService方式默认只要进行通过用户名获取,密码校验是SpringSecurity来自动检查的,必须定义passwordEncoder方式,否则密码校验出现错误
2.SpringSecurity是提供了默认的登录页面,如果定义类登录的url则使用用户定义的登录页面
以上纯属个人见解,如有问题请联系本人!