SpringSecurity实现自定义登录认证、权限验证、鉴权

最新推荐文章于 2024-09-26 00:15:00 发布

持盾的紫眸

最新推荐文章于 2024-09-26 00:15:00 发布

阅读量1.8w

点赞数 14

分类专栏： Java Spring Security 文章标签： Java 权限验证登录认证 Spring Security 源码

本文链接：https://blog.csdn.net/zimou5581/article/details/89511381

版权

本文介绍了如何使用SpringSecurity实现自定义登录认证和权限验证。通过实现UserDetails、UserDetailsService和AuthenticationProvider接口完成登录认证，利用AccessDecisionManager、FilterInvocationSecurityMetadataSource和AbstractSecurityInterceptor进行权限验证。此外，还提到了配置类WebSecurityConfigurerAdapter在OAuth2认证中的应用。

摘要由CSDN通过智能技术生成

Demo源码：https://github.com/ygsama/ipa

自定义登录认证的实现

需要实现三个接口
UserDetails 用户类接口
UserDetailsService 查询用户密码的service 接口
AuthenticationProvider 为认证管理器AuthenticationManager 提供验证组件AuthenticationProvider

/**
 * 实现了 {@link UserDetails}接口
 * 用于构建存储在SecurityContextHolder的Authentication对象
 *
 * @author ygsama
 */
@Slf4j
@Data
public class SysUserDO implements UserDetails {
   

	private String username;

	private String password;

	private String name;

	private List<SysRoleDO> roleList;

	// ... 其他字段省略

	/**
	 * 装填用户的角色列表
	 */
	@Override
	public Collection<? extends GrantedAuthority> getAuthorities() {
   
		if (roleList == null || roleList.size() < 1) {
   
			return AuthorityUtils.commaSeparatedStringToAuthorityList("");
		}
		log.info("[原始用户角色列表装填]: ", roleList);
		StringBuilder roles = new StringBuilder();
		for (SysRoleDO role : roleList) {
   
			roles.append("ROLE_").append(role.getNo()).append(",");
		}
		List<GrantedAuthority> authorityList = AuthorityUtils.commaSeparatedStringToAuthorityList(roles.substring(0, roles.length() - 1));
		log.info("[遍历并返回用户的角色列表]: {}", authorityList);
		return authorityList;
	}

	@Override
	public String getPassword() {
   
		return this.password;
	}

	@Override
	public String getUsername() {
   
		return this.username;
	}

	@Override
	public boolean isAccountNonExpired() {
   
		return true;
	}

	@Override
	public boolean isAccountNonLocked() {
   
		return true;
	}

	@Override
	public boolean isCredentialsNonExpired() {
   
		return true;
	}

	@Override
	public boolean isEnabled() {
   
		return true;
	}

}

/**
 * 用户登录的service实现类 <br>
 * 框架的默认实现是{@link JdbcDaoImpl} <br>
 *
 * @author ygsama
 */
@Slf4j
@Service("userDetailsService")
public class LoginUserDetailsServiceImpl implements UserDetailsService {
   

	private final AuthUserMapper authUserMapper;
	private final AuthRoleMapper authRoleMapper;

	@Autowired
	public LoginUserDetailsServiceImpl(AuthUserMapper authUserMapper, AuthRoleMapper authRoleMapper) {
   
		this.authUserMapper = authUserMapper;
		this.authRoleMapper = authRoleMapper;
	}

	@Override
	public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
   
		SysUserDO sysUserDO = authUserMapper.selectByPrimaryKey(username)

最低0.47元/天解锁文章