Spring Security入门【基于配置文件和数据库】

偏执的太偏执、 2021-12-13 20:31 195阅读 0赞

# 一、引言 #

安全包括两个主要操作。

**“认证”**，是为用户建立一个他所声明的主体。主题一般指用户，设备或可以在系统中执行动作的其他系统。简单来说，校验账号密码是否正确，就是"认证"的过程。  
**“授权”**，指的是一个用户能否在你的应用中执行某个操作，在到达授权判断之前，身份的主题已经由身份验证过程建立了。简单来说，就是用户是否有权利执行某项操作，而这个授权的过程一般已在数据库约定好了。

对于安全框架，一般是基于数据库的操作，而Spring Security还可以基于配置文件进行认证与授权的操作。

# 二、Spring Security快速入门案例 #

1. 创建一个webapp项目

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2l0Y2F0c19jbg_size_16_color_FFFFFF_t_70][]

2. 导入pom依赖

<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    	xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
    	<modelVersion>4.0.0</modelVersion>
        <groupId>cn.itcats</groupId>
          <artifactId>springsecurity-test</artifactId>
          <version>1.0-SNAPSHOT</version>
        <packaging>war</packaging>
    
    	<properties>
    		<spring.version>5.0.2.RELEASE</spring.version>
    		<spring.security.version>5.0.1.RELEASE</spring.security.version>
    	</properties>
    	<dependencies>
    		<dependency>
    			<groupId>org.springframework</groupId>
    			<artifactId>spring-core</artifactId>
    			<version>${spring.version}</version>
    		</dependency>
    		<dependency>
    			<groupId>org.springframework</groupId>
    			<artifactId>spring-web</artifactId>
    			<version>${spring.version}</version>
    		</dependency>
    		<dependency>
    			<groupId>org.springframework</groupId>
    			<artifactId>spring-webmvc</artifactId>
    			<version>${spring.version}</version>
    		</dependency>
    		<dependency>
    			<groupId>org.springframework</groupId>
    			<artifactId>spring-context-support</artifactId>
    			<version>${spring.version}</version>
    		</dependency>
    		<dependency>
    			<groupId>org.springframework</groupId>
    			<artifactId>spring-test</artifactId>
    			<version>${spring.version}</version>
    		</dependency>
    		<dependency>
    			<groupId>org.springframework</groupId>
    			<artifactId>spring-jdbc</artifactId>
    			<version>${spring.version}</version>
    		</dependency>
    		
    		<dependency>
    			<groupId>org.springframework.security</groupId>
    			<artifactId>spring-security-web</artifactId>
    			<version>${spring.security.version}</version>
    		</dependency>
    		<dependency>
    			<groupId>org.springframework.security</groupId>
    			<artifactId>spring-security-config</artifactId>
    			<version>${spring.security.version}</version>
    		</dependency>
    		<dependency>
    			<groupId>javax.servlet</groupId>
    			<artifactId>javax.servlet-api</artifactId>
    			<version>3.1.0</version>
    			<scope>provided</scope>
    		</dependency>
    	</dependencies>
    	<build>
    		<plugins>
    			
    			<plugin>
    				<groupId>org.apache.maven.plugins</groupId>
    				<artifactId>maven-compiler-plugin</artifactId>
    				<version>3.2</version>
    				<configuration>
    					<source>1.8</source>
    					<target>1.8</target>
    					<encoding>UTF-8</encoding>
    				</configuration>
    			</plugin>
    			<plugin>
    				<groupId>org.apache.tomcat.maven</groupId>
    				<artifactId>tomcat7-maven-plugin</artifactId>
    				<configuration>
    					
    					<port>8090</port>
    					
    					<path>/</path>
    				</configuration>
    			</plugin>
    		</plugins>
    	</build>
    </project>

3.  在web.xml中配置filter

需要注意的是：【filter-name中的springSecurityFilterChain不可改变】

<?xml version="1.0" encoding="UTF-8"?>
    <web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    	xmlns="http://java.sun.com/xml/ns/javaee"
    	xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd"
    	version="2.5">
    	<display-name>SpringSecurity314</display-name>
    
    	<context-param>
    		<param-name>contextConfigLocation</param-name>
    		<param-value>classpath:spring-security.xml</param-value>
    	</context-param>
    	<listener>
    		<listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
    	</listener>
    	<filter>
    		<filter-name>springSecurityFilterChain</filter-name>
    		<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
    	</filter>
    	<filter-mapping>
    		<filter-name>springSecurityFilterChain</filter-name>
    		<url-pattern>/*</url-pattern>
    	</filter-mapping>
    	<welcome-file-list>
    		<welcome-file>index.html</welcome-file>
    		<welcome-file>index.htm</welcome-file>
    		<welcome-file>index.jsp</welcome-file>
    		<welcome-file>default.html</welcome-file>
    		<welcome-file>default.htm</welcome-file>
    		<welcome-file>default.jsp</welcome-file>
    	</welcome-file-list>
    </web-app>

4.  默认webapp工程没有java和resources目录，创建并分别设置根路径和资源路径

5.在src/main/resources下创建spring-security.xml

6.  运行工程

在控制台输入    mvn tomcat7: run

7.  访问 http://localhost:8090

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2l0Y2F0c19jbg_size_16_color_FFFFFF_t_70 1][]

实际上springsecurity为我们提供了一个登录界面，归结于在springsecurity.xml中选择了默认配置

<security:http auto-config="true" use-expressions="false">

在访问任意资源时，都会进行拦截

<security:intercept-url pattern="/**" access="ROLE_USER" />

我们在配置的时候设置了user具有ROLE\_USER权限，所以在登录时如果使用user登录是可以成功登入系统的，而使用admin登录则显示  HTTP Status 403 - Forbidden 【权限不足】

<security:authentication-manager>
            <security:authentication-provider>
                <security:user-service>
                    <security:user name="user" password="{noop}user"
                                   authorities="ROLE_USER" />
                    <security:user name="admin" password="{noop}admin"
                                   authorities="ROLE_ADMIN" />
                </security:user-service>
            </security:authentication-provider>
        </security:authentication-manager>

以上为springsecurity的快速入门案例，实际开发中我们需要设置自己的登录页面，在登录成功或者登录失败后，实现页面的自定义跳转。

# 三、自定义登录和跳转页面 #

1. 在webapp目录下创建三个自定义的登录和跳转页面

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2l0Y2F0c19jbg_size_16_color_FFFFFF_t_70 2][]

<!DOCTYPE html>
    <html>
    <head>
        <meta charset="UTF-8">
        <title>Insert title here</title>
    </head>
    <body>
    <form action="login" method="post">
        <table>
        <tr>
            <td>用户名:</td>
            <td><input type="text" name="username" /></td>
        </tr>
            <tr> <td>密码:</td>
                <td><input type="password" name="password" /></td>
            </tr>
            <tr>
                <td colspan="2" align="center"><input type="submit" value="登录" />
                    <input type="reset" value="重置" /></td> </tr>
        </table>
    </form>
    </body>
    </html>

success.html

<!DOCTYPE html>
    <html>
    <head>
        <meta charset="UTF-8">
        <title>Insert title here</title>
    </head>
    <body>
    success html<br>
    <a href="logout">退出</a> </body>
    </html>

failer.html

<!DOCTYPE html>
    <html>
    <head>
        <meta charset="UTF-8"> <title>Insert title here</title> </head>
    <body>登录失败
    </body>
    </html>

2. 在spring-security.xml中配置登录页面和跳转页面

<?xml version="1.0" encoding="UTF-8"?>
    <beans xmlns="http://www.springframework.org/schema/beans"
           xmlns:security="http://www.springframework.org/schema/security"
           xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
           xsi:schemaLocation="http://www.springframework.org/schema/beans
              http://www.springframework.org/schema/beans/spring-beans.xsd
              http://www.springframework.org/schema/security
              http://www.springframework.org/schema/security/spring-security.xsd">
        
        <security:http security="none" pattern="/login.html" />
        <security:http security="none" pattern="/failer.html" />
        <security:http auto-config="true" use-expressions="false">
            
            <security:intercept-url pattern="/**" access="ROLE_USER" />
            
            <security:form-login login-page="/login.html"
                                 login-processing-url="/login" username-parameter="username"
                                 password-parameter="password" authentication-failure-url="/failer.html"
                                 default-target-url="/success.html"
                                 authentication-success-forward-url="/success.html"
            />
            
            <security:logout invalidate-session="true" logout-url="/logout"
                             logout-success-url="/login.jsp" />
            
            <security:csrf disabled="true" />
        </security:http>
        <security:authentication-manager>
            <security:authentication-provider>
                <security:user-service>
                    <security:user name="user" password="{noop}user"
                                   authorities="ROLE_USER" />
                    <security:user name="admin" password="{noop}admin"
                                   authorities="ROLE_ADMIN" />
                </security:user-service>
            </security:authentication-provider>
        </security:authentication-manager>
    </beans>

3. 控制台执行 mvn tomcat7:run

需要注意的是，使用admin登录仍然跳转到success.html页面，是因为default-target-url="/success.html"  。只要账号密码错误时候，才会触发authentication-failure-url="/failer.html"

# 四、Spring Security使用数据库认证 #

前面介绍的内容都是基于配置文件的认证和授权操作，在Spring Security中如果想要使用数据进行认证操作，有很多种操作方式，这里我们介绍使用**UserDetails、UserDetailsService**来完成操作。

**UserDetails**是一个接口，我们可以认为UserDetails作用是**用于封装当前进行认证的用户信息**，但由于其是一个接口，所以我们可以对其进行实现，也可以使用Spring Security提供的一个UserDetails的实现类User来完成操作。

**UserDetails**

public interface UserDetails extends Serializable {
        Collection<? extends GrantedAuthority> getAuthorities();
        String getPassword();
        String getUsername();
        boolean isAccountNonExpired();
        boolean isAccountNonLocked();
        boolean isCredentialsNonExpired();
        boolean isEnabled();
    }

**User**

public class User implements UserDetails, CredentialsContainer {
        private String password;
        private final String username;
        private final Set<GrantedAuthority> authorities;
        private final boolean accountNonExpired; //帐户是否过期 
        private final boolean accountNonLocked; //帐户是否锁定 
        private final boolean credentialsNonExpired; //认证是否过期 
        private final boolean enabled; //帐户是否可用
    }

UserDetailsService也是一个接口，用于规范用户在认证时调用哪一个方法

**UserDetailsService**

public interface UserDetailsService {
        UserDetails loadUserByUsername(String username) throws UsernameNotFoundException;
    }

**执行流程：**

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2l0Y2F0c19jbg_size_16_color_FFFFFF_t_70 3][]

注意Dao层返回的应该是数据库users表中对应的实体类UserInfo对象，而在Service层中，需要处理UserInfo对象，以UserDetails对象返回

1. 编写spring-security.xml文件(数据库)

<?xml version="1.0" encoding="UTF-8"?>
    <beans xmlns="http://www.springframework.org/schema/beans"
           xmlns:security="http://www.springframework.org/schema/security"
           xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
           xsi:schemaLocation="http://www.springframework.org/schema/beans
        http://www.springframework.org/schema/beans/spring-beans.xsd
        http://www.springframework.org/schema/security
        http://www.springframework.org/schema/security/spring-security.xsd">
    
        
        <security:http pattern="/login.jsp" security="none"/>
        <security:http pattern="/failer.jsp" security="none"/>
        <security:http pattern="/css/**" security="none"/>
        <security:http pattern="/img/**" security="none"/>
        <security:http pattern="/plugins/**" security="none"/>
    
        
        <security:http auto-config="true" use-expressions="false">
            
            <security:intercept-url pattern="/**" access="ROLE_USER,ROLE_ADMIN"/>
    
            
            <security:form-login
                    login-page="/login.jsp"
                    login-processing-url="/login.do"
                    default-target-url="/index.jsp"
                    authentication-failure-url="/failer.jsp"
            />
    
            
            <security:csrf disabled="true"/>
    
            
            <security:logout invalidate-session="true" logout-url="/logout.do" logout-success-url="/login.jsp" />
    
        </security:http>
    
        
        <security:authentication-manager>
            <security:authentication-provider user-service-ref="userService">
                
                <security:password-encoder ref="passwordEncoder"/>
            </security:authentication-provider>
        </security:authentication-manager>
    
        
        <bean id="passwordEncoder" class="org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder"/>
    
        
    
    </beans>

2. 创建自己的Service层并继承UserDetailsService，实现自己的Service层，并在容器中命名为userService【待改造】

public interface IUserService extends UserDetailsService{}

@Service("userService")
    @Transactional
    public class UserServiceImpl implements IUserService{
        @Override
        public UserDetails loadUserByUsername(String s) throws UsernameNotFoundException {
            return null;
        }
    }

3. Dao层

public interface IUserDao {
        //返回数据库users表对应的UserInfo对象
        @Select(select * from users where username = #{username})
        public UserInfo findUserByUsername(String username);
    }

4. 处理UserServiceImpl类

IDEA中使用快捷键control + H 查看UserDetails继承关系，其底层有一个User实现类

public User(String username, String password, Collection<? extends GrantedAuthority> authorities) {
            this(username, password, true, true, true, true, authorities);
        }

User类在构造时可以传入用户名、密码、以及该用户所具有的角色。

所以在UserServiceImpl可以通过创建User(org.springframework.security.core.userdetails.User)对象，并返回(因为User是UserDetails的实现类)，返回之后spring-security底层就会根据返回的用户名、密码、角色信息进行认证与授权，决定是放行还是拦截。

以上的getAuthority()方法是自己手动添加的用户角色，实际上应该从数据库查出来，并且包装在UserInfo对象中，**再次改造UserServiceImpl类**。

users表中的字段信息

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2l0Y2F0c19jbg_size_16_color_FFFFFF_t_70 4][]

设计UserInfo实体类时，除了以上字段还设计了StatusStr表示状态，还有List<Role>用户所具有的角色信息

public class UserInfo {
        private String id;
        private String username;
        private String email;
        private String password;
        private String phoneNum;
        private int status;
        private String statusStr;
        private List<Role> roles;
    }

Role数据库表信息

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2l0Y2F0c19jbg_size_16_color_FFFFFF_t_70 5][]

Role实体类信息

public class Role {
        private String id;
        private String roleName;
        private String roleDesc;
        private List<Permission> permissions;
        private List<User> users;
    }

一个用户可以拥有多个角色，一个角色又对应多个用户，所以用户与角色之间是多对多关系，我们通过user\_role中间表来描述其关联，在实体类中User中存在List，在Role中有List。

CREATE TABLE users_role(
        userId varchar2(32),
        roleId varchar2(32),
        PRIMARY KEY(userId,roleId),
        FOREIGN KEY (userId) REFERENCES users(id),
        FOREIGN KEY (roleId) REFERENCES role(id)
    )

**改造IUserDao**

public interface IUserDao {
    
        //相当于XML中的ResultMap
        //根据用户column id去
        @Results(id = "findUserByUsername", value = {
                @Result(id = true, property = "id", column = "id"),
                @Result(property = "username", column = "username"),
                @Result(property = "email", column = "email"),
                @Result(property = "password", column = "password"),
                @Result(property = "phoneNum", column = "phoneNum"),
                @Result(property = "status", column = "status"),
                @Result(property = "roles", column = "id", javaType = java.util.List.class,
                        many = @Many(select = "cn.itcats.dao.IRoleDao.findRoleListByUserId"))
        })
        //返回数据库users表对应的UserInfo对象
        @Select("select * from users where username = #{username}")
        public UserInfo findUserByUsername(String username);
    }

**书写IRoleDao**

public interface IRoleDao {
        //根据用户id查询出所有对应的权限角色
        @Select("select * from role where id in (select roleId from users_role where userId = #{userId})")
        public List<Role> findRoleListByUserId(String userId);
    }

**改造后的UserServiceImpl**

@Service("userService")
    @Transactional
    public class UserServiceImpl implements IUserService{
        @Autowired
        private IUserDao iUserDao;
    
        @Override
        public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
            UserInfo userInfo = iUserDao.findUserByUsername(username);
            //注意,密码需要加入前缀 {noop} 否则会出现500错误 no PasswordEncoder mapped for the id "null"
            //该User构造器忽略了用户是否可用,即用户的state信息,如果不可用,也不能登录
            //需要的话可以使用User的另外一个构造器
    //        User user = new User(userInfo.getUsername(),
    //                "{noop}"+ userInfo.getPassword(),getAuthority(userInfo.getRoles()));
            User user = new User(userInfo.getUsername(),
                    "{noop}"+ userInfo.getPassword(),userInfo.getStatus() == 0 ? false : true,
                    true, true, true, getAuthority(userInfo.getRoles()));
            return null;
        }
    
        //返回一个List集合,集合中装的是用户的权限信息
        public List<SimpleGrantedAuthority> getAuthority(List<Role> roleList){
            List<SimpleGrantedAuthority> authorityList = new ArrayList<>();
            //在数据库中存储的是 ADMIN USER等信息, 需要手动拼接ROLE_
            roleList.stream().map(x -> authorityList.add(new SimpleGrantedAuthority("ROLE_" + x.getRoleName())));
            return authorityList;
        }
    }

以上解决的问题：只有在用户账号密码正确、角色信息权限足够、用户账号状态正常时，才可以正常登录。

# 五、实现账号的登出功能 #

在spring-security.xml配置文件中加入

<security:logout invalidate-session="true" logout-url="/logout.do" logout-success-
    url="/login.jsp" />

只要访问/logout.do，就可以执行logout注销操作，session信息失效，在成功注销后跳转到/login.jsp页面

实际操作过程中只需要在前端页面的"注销/退出登录按钮"，修改路径为/logout.do即可

[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2l0Y2F0c19jbg_size_16_color_FFFFFF_t_70]: /images/20211213/36a6664d2ac44014880ba9163e01a1d5.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2l0Y2F0c19jbg_size_16_color_FFFFFF_t_70 1]: /images/20211213/54649443e18b4ab8a6a93604a85cec7a.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2l0Y2F0c19jbg_size_16_color_FFFFFF_t_70 2]: /images/20211213/fcfcd8456edd4e3bac949387e0a33941.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2l0Y2F0c19jbg_size_16_color_FFFFFF_t_70 3]: /images/20211213/2780ca0d4a21499f850695967b741381.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2l0Y2F0c19jbg_size_16_color_FFFFFF_t_70 4]: /images/20211213/ff23ddd1138847b384a92a3b7c95b256.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2l0Y2F0c19jbg_size_16_color_FFFFFF_t_70 5]: /images/20211213/ed5457e87d944b58b2ec16eb5225ea00.png