Springboot2（52）集成Security5

桃扇骨 2021-12-21 13:25 216阅读 0赞

> [源码地址][Link 1]
> 
> [springboot2教程系列][springboot2]

## 添加依赖 ##

<dependency>
        <groupId>mysql</groupId>
        <artifactId>mysql-connector-java</artifactId>
        <version>5.1.47</version>
    </dependency>
    
    <dependency>
        <groupId>com.alibaba</groupId>
        <artifactId>druid</artifactId>
        <version>1.1.12</version>
    </dependency>
    
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-data-jpa</artifactId>
    </dependency>
    
    
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-security</artifactId>
    </dependency>
    
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-thymeleaf</artifactId>
    </dependency>

## 配置文件 ##

spring:
      messages:
        basename: i18n/Messages,i18n/Pages
      datasource:
        type: com.alibaba.druid.pool.DruidDataSource    # 配置当前要使用的数据源的操作类型
        driver-class-name: org.gjt.mm.mysql.Driver      # 配置MySQL的驱动程序类
        url: jdbc:mysql://47.106.106.53:3306/security?allowMultiQueries=true&useUnicode=true&characterEncoding=UTF-8           # 数据库连接地址
        username: root                                  # 数据库用户名
        password: Rojao@123
    
    
    spring.jpa.database: mysql
    spring.jpa.database-platform: org.hibernate.dialect.MySQL5InnoDBDialect
    # 显示后台处理的SQL语句
    spring.jpa.show-sql: true
    # 自动检查实体和数据库表是否一致，如果不一致则会进行更新数据库表
    spring.jpa.hibernate.ddl-auto: create
    spring.jpa.open-in-view: false

## Security配置类 ##

@Configuration
    @EnableWebSecurity
    @EnableGlobalMethodSecurity(prePostEnabled = true)  // 启用方法级别的权限认证
    public class SecurityConfig extends WebSecurityConfigurerAdapter { 
    
        @Autowired
        private MyUserDetailsService myUserDetailsService;
    
        @Override
        protected void configure(HttpSecurity http) throws Exception { 
            // 允许所有用户访问"/"和"/index.html"
            http.authorizeRequests()
                    .antMatchers("/", "/index.html").permitAll()  //定义不需要认证就可以访问
                    .antMatchers("/level1/**").hasRole("VIP1")    //需要拥有VIP1权限
                    .anyRequest().authenticated()      // 其他地址的访问均需验证权限
                    .and()
                    //开启cookie保存用户数据
                    .rememberMe()
                    //设置cookie有效期
                    .tokenValiditySeconds(60 * 60 * 24 * 7)
                    .and()
                    .formLogin()                     //  定义当需要用户登录时候，转到的登录页面
                    .loginPage("/login.html")      //  登录页
                    .failureUrl("/login-error.html").permitAll()
                    .and()
                    .logout()
                    .logoutSuccessUrl("/index.html");
        }
    
        @Autowired
        public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception { 
           /* auth.inMemoryAuthentication() .withUser("admin").password("123456").roles("USER");*/
        }
    
        @Override
        public void configure(WebSecurity web) throws Exception { 
            //静态资源忽略认证
            web.ignoring().antMatchers("/css/**");
        }
    
        /** * 配置登录验证 * * @param auth * @throws Exception */
        @Override
        protected void configure(AuthenticationManagerBuilder auth) throws Exception { 
            auth.userDetailsService(myUserDetailsService).passwordEncoder(passwordEncoder());
        }
    
        @Bean
        public PasswordEncoder passwordEncoder() { 
            // return new BCryptPasswordEncoder();
            return new MyPasswordEncoder();
        }
    
    
    }

> 通过@EnableWebSecurity注解开启Spring Security的功能 继承WebSecurityConfigurerAdapter，并重写它的方法来设置一些web安全的细节 configure(HttpSecurity http)方法，通过authorizeRequests()定义哪些URL需要被保护、哪些不需要被保护。例如以上代码指定了/和/home不需要任何认证就可以访问，其他的路径都必须通过身份验证。 通过formLogin()定义当需要用户登录时候，转到的登录页面。 configureGlobal(AuthenticationManagerBuilder auth)方法，在内存中创建了一个用户，该用户的名称为admin，密码为123456，用户角色为USER。

### 自定义密码解析 ###

public class MyPasswordEncoder implements PasswordEncoder { 
        @Override
        public String encode(CharSequence charSequence) { 
            //MD5Util.encode((String) charSequence);
            System.out.println(charSequence.toString());
            return null;
        }
    
        @Override
        public boolean matches(CharSequence charSequence, String s) { 
            System.out.println(charSequence);
            System.out.println(s);
            return  s.equals(charSequence.toString());;
        }
    }

> 指定了密码的加密方式（5.0 版本强制要求设置），因为我们数据库是明文存储的，所以明文返回即可

### 自定义UserDetailsService实现类 ###

@Service
    public class MyUserDetailsService implements UserDetailsService { 
    
        @Autowired
        private SysUserDao sysUserDao;
    
        /** * 授权的时候是对角色授权，认证的时候应该基于资源，而不是角色，因为资源是不变的，而用户的角色是会变的 */
        @Override
        public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException { 
            SysUserEntity userEntity = sysUserDao.findByUserName(username);
            if (null == userEntity) { 
                throw new UsernameNotFoundException(username);
            }
            List<SimpleGrantedAuthority> authorities = new ArrayList<>();
            List<SysRoleEntity> roleList = userEntity.getRoleList();
            if(roleList == null || roleList.size() == 0){ 
                return new User(userEntity.getUserName(), userEntity.getPassword(), authorities);
            }
            for (SysRoleEntity role : roleList) { 
                List<SysPermissionEntity> permList = role.getPermissionEntityList();
                if(permList == null){ 
                    continue;
                }
                for(SysPermissionEntity permission : permList){ 
                    //添加用户的权限
                    authorities.add(new SimpleGrantedAuthority(permission.getCode()));
                }
            }
            return new User(userEntity.getUserName(), userEntity.getPassword(), authorities);
        }
    }

> 需要重写 loadUserByUsername 方法，参数是用户输入的用户名。返回值是UserDetails，这是一个接口，一般使用它的子类org.springframework.security.core.userdetails.User，它有三个参数，分别是用户名、密码和权限集。

### 自定义对 `hasPermission()` ###

@Component
    public class CustomPermissionEvaluator implements PermissionEvaluator { 
        @Override
        public boolean hasPermission(Authentication authentication, Object targetUrl, Object targetPermission) { 
            // 获得loadUserByUsername()方法的结果
            User user = (User)authentication.getPrincipal();
            // 获得loadUserByUsername()中注入的角色
            Collection<GrantedAuthority> authorities = user.getAuthorities();
            for(GrantedAuthority authority : authorities){ 
                if(authority.getAuthority().equals(targetPermission)){ 
                    return true;
                }
            }
            return false;
        }
    
        @Override
        public boolean hasPermission(Authentication authentication, Serializable serializable, String s, Object o) { 
            return false;
        }
    }

@RestController
    public class PermissionController { 
    
        @RequestMapping("/perm")
        @PreAuthorize("hasPermission('/perm','perm')")
        public String perm(){ 
            return "success";
        }
    }

> `@PreAuthorize("hasPermission('/perm','perm')")`是关键，参数1指明了**访问该接口需要的url**，参数2指明了**访问该接口需要的权限**。

### 自定义Filter ###

public class MyAuthenticationFilter  extends AbstractAuthenticationProcessingFilter { 
    
        public MyAuthenticationFilter(String defaultFilterProcessesUrl) { 
            super(defaultFilterProcessesUrl);
        }
    
    
        @Override
        public Authentication attemptAuthentication(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse) throws AuthenticationException, IOException, ServletException { 
            return null;
        }
    
        @Override
        public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException { 
            HttpServletRequest req = (HttpServletRequest) request;
            HttpServletResponse res = (HttpServletResponse) response;
            String userName = (String) req.getSession().getAttribute("username");
            if("test".equals(userName)){ 
                super.unsuccessfulAuthentication(req, res,new InsufficientAuthenticationException("输入的验证码不正确"));
            }
           // super.unsuccessfulAuthentication(req, res,new InsufficientAuthenticationException("输入的验证码不正确"));
            chain.doFilter(request, response);
        }
    }

## 实体类 ##

@Data
    @Entity
    @Table(name = "sys_user")
    public class SysUserEntity { 
    
        @Id
        @GeneratedValue
        @Column(name = "user_id")
        private Long userId;
    
        @Column(nullable = false,unique = true, length =  50)
        private String userName;
    
        @Column(nullable = false, length =  200)
        private String password;
    
        @ManyToMany(cascade = { CascadeType.ALL},fetch = FetchType.EAGER)
        @JoinTable(name="sys_user_role_map",joinColumns={ @JoinColumn(name="user_id")},inverseJoinColumns={ @JoinColumn(name="role_id")})
        List<SysRoleEntity> roleList;
    }

@Data
    @Entity
    @Table(name = "sys_role")
    public class SysRoleEntity { 
    
        @Id
        @Column(name = "role_id")
        private Long roleId;
    
        @Column(nullable = false, length =  200)
        private String roleName;
    
        @ManyToMany(cascade = { CascadeType.ALL},fetch = FetchType.EAGER)
        @JoinTable(name="sys_role_permission_map",joinColumns={ @JoinColumn(name="role_id")},inverseJoinColumns={ @JoinColumn(name="perm_id")})
        List<SysPermissionEntity> permissionEntityList;
    
    }

@Data
    @Entity
    @Table(name = "sys_permission")
    public class SysPermissionEntity { 
    
        @Id
        @Column(name = "perm_id")
        private Long permId;
    
        @Column(length = 30)
        private String code;
    }

## DAO类 ##

@Repository
    public interface SysUserDao  extends JpaRepository<SysUserEntity, Long> { 
         SysUserEntity findByUserName(String userName);
    }

## 运行程序 ##

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2Nvd2JpbjIwMTI_size_16_color_FFFFFF_t_70]

[Link 1]: https://gitee.com/cowboy2016/springboot2-open
[springboot2]: https://blog.csdn.net/cowbin2012/article/details/85254990
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2Nvd2JpbjIwMTI_size_16_color_FFFFFF_t_70]: /images/20211220/1034fc9c1b4349159a557723bb68419d.png