授权服务器

逃离我推掉我的手 2021-09-18 04:06 315阅读 0赞

# WebSecurityConfiguration #

忽略拦截  
web.ignoring

/**
         * @MethodName: configure
         * @Description: 忽略拦截/user/login
         * @Param: [web]
         * @Return: void
         * @Author: pl
         * @Date: 23:16
        **/
        @Override
        public void configure(WebSecurity web) throws Exception {
           /* web.ignoring()
                    .antMatchers("/user/login");*/
        }

不配忽略访问 /user/login

![18721752-833051080852eccd.png][]

image.png

{
        "error": "unauthorized", #没授权
        "error_description": "Full authentication is required to access this resource"
    }

# 授权访问路径 #

antMatchers

/**
         * @MethodName: configure
         * @Description: 授权
         * @Param: [http]
         * @Return: void
         * @Author: pl
         * @Date: 0:03
        **/
        @Override
        protected void configure(HttpSecurity http) throws Exception {
            http.exceptionHandling()
                    .and()
                    .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS)
                    .and()
                    .authorizeRequests()
                    // 增加了授权访问配置
                    .antMatchers("/user/info").hasAuthority("ADMIN");
                   /* .antMatchers("/user/logout").hasAuthority("ADMIN");*/
        }

![18721752-e8132440f245473e.png][]

image.png

{
        "error": "unauthorized",
        "error_description": "Full authentication is required to access this resource"
    }

# 不同角色 #

用户是USER角色，但是访问路径授权是ADMIN

@Override
        public UserDetails loadUserByUsername(String userName) throws UsernameNotFoundException {
            // 用户名匹配
            if (userName.equals(USERNAME)) {
                List<GrantedAuthority> grantedAuthorities = Lists.newArrayList();
                //内存模式授权 user角色
                GrantedAuthority grantedAuthority = new SimpleGrantedAuthority("USER");
                grantedAuthorities.add(grantedAuthority);
                return new User(USERNAME, PASSWORD, grantedAuthorities);
            }
            // 用户名不匹配
            else {
                return null;
            }
        }

/user/logout 授予 ADMIN角色

@Override
        protected void configure(HttpSecurity http) throws Exception {
            http.exceptionHandling()
                    .and()
                    .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS)
                    .and()
                    .authorizeRequests()
                    // 增加了授权访问配置
                    .antMatchers("/user/info").hasAuthority("ADMIN")
                    .antMatchers("/user/logout").hasAuthority("ADMIN");
        }

![18721752-44acc1b25b178df6.png][]

image.png

{
        "error": "unauthorized",
        "error_description": "Full authentication is required to access this resource"
    }

这时日志中什么都没打印出来，说明直接给拦截了。

[18721752-833051080852eccd.png]: /images/20210918/9fd00f024f044d349f43f675a48e03a1.png
[18721752-e8132440f245473e.png]: /images/20210918/82ad6a42250844929fc9f20b45f31e7e.png
[18721752-44acc1b25b178df6.png]: /images/20210918/6bb9b344a359485cbcd11dd47aa33a62.png