Spring Security入门实例

Love The Way You Lie 2022-04-04 05:15 174阅读 0赞

**目录**

第一章 程序架构

1.1 appliacition.properties的编写

第二章 代码编写

2.1 domain层的编写

2.1.1 SysUser

2.1.2 SysRole

2.1.3 Msg

2.2 dao层的编写

2.3 service层的编写

2.4 config的编写

2.4.1 SecurityConfiguration的编写

2.4.2 WebMvcConfig的编写

2.5 controller的编写

2.6 temeplates的书写

第三章 操作之前的准备

3.1 运行的时候可能出现的错误

3.1.1 There is no PasswordEncoder mapped for the id “null”

参考:There is no PasswordEncoder mapped for the id “null”

3.1.2 Encoded password does not look like BCrypt

3.2 数据库的配置

第四章 具体的操作

--------------------

前言:这个通过SpringSecurity实现了一个权限控制访问,拥有指定权限的用户才能访问指定的网页.

SpringBoot的版本为2.1.1,springSecurity的版本为5.1.2,前端用的是thymeleaf.

# 第一章 程序架构 #

config存放了配置文件,controller就是传统上的控制页面跳转的,domain里面装的是数据模型,dao就是SpringJPA那一套,service里放了一个自己实现的UserDetailsService,test用来测试一些东西

![20181215112406264.png][]

## 1.1 appliacition.properties的编写  ##

这是复制的以前的项目的一个properties,和此项目相关性不大,只是为了能用省事,可根据自己的情况来配置

spring.datasource.url=jdbc:mysql://localhost:3306/testSpringSecurity?serverTimezone=GMT%2B8&useUnicode=true&characterEncoding=UTF-8&useSSL=true
    spring.datasource.username=root
    spring.datasource.password=123456
    spring.datasource.driver-class-name=com.mysql.cj.jdbc.Driver
    spring.thymeleaf.prefix=classpath:/templates/
    
    spring.jpa.open-in-view=true
    
    spring.jpa.properties.hibernate.enable_lazy_load_no_trans=true
    
    spring.jpa.show-sql = true
    spring.jpa.hibernate.ddl-auto=update
    spring.thymeleaf.cache=false
    
    logging.level.org.springframework.data=DEBUG
    
    server.servlet.session.timeout=3600
    server.servlet.context-path=/SpringSecurity
    spring.jpa.database-platform=org.hibernate.dialect.MySQL5InnoDBDialect

# 第二章 代码编写 #

## 2.1 domain层的编写 ##

SysUser与SysRole是多对多的关系

### 2.1.1 SysUser ###

实现UserDetails是因为需要一个实现此接口的类来提供权限等信息.

@Entity
    public class SysUser implements UserDetails{
    	private static final long serialVersionUID = 1L;
    	@Id
    	@GeneratedValue(strategy=GenerationType.IDENTITY)
    	private Long id;
    	@Column
    	private String username;
    	@Column
    	private String password;
    	@ManyToMany(cascade= {CascadeType.REFRESH},fetch=FetchType.EAGER)
    	private List<SysRole>  roles;
    	public SysUser() {
    	}
    	@Override
    	public Collection<? extends GrantedAuthority> getAuthorities() {
    		System.out.println("进入了cellection");
    		List<GrantedAuthority> auths = new ArrayList<GrantedAuthority>();
    		List<SysRole> roles=this.getRoles();
    		for(SysRole role:roles)
    			{
    				auths.add(new SimpleGrantedAuthority(role.getName()));
    			}
    		return auths;
    	}
    
    	@Override
    	public boolean isAccountNonExpired() {
    		return true;
    	}
    
    	@Override
    	public boolean isAccountNonLocked() {
    		return true;
    	}
    
    	@Override
    	public boolean isCredentialsNonExpired() {
    		return true;
    	}
    
    	@Override
    	public boolean isEnabled() {
    		return true;
    	}
    
    	//省略get,set...
    }

### 2.1.2 SysRole ###

@Entity
    public class SysRole {
    	@Id
    	@GeneratedValue(strategy=GenerationType.IDENTITY)
    	private Long id;
    	@Column
    	private String name;
    	//省略get,set...
    	
    	
    }

### 2.1.3 Msg ###

这个domain主要是我们为了测试一下controller与themeleaf运行的正确性

public class Msg {
    	private String title;
    	private String content;
    	private String etraInfo;
    	public  Msg(String title,String conten,String etraInfo) {
    		super();
    		this.title=title;
    		this.content = conten;
    		this.etraInfo = etraInfo;
    	}
        //省略get,set...	
    
    }

## 2.2 dao层的编写 ##

只要能根据用户名查找用户即可

public interface SysUserRepository extends JpaRepository<SysUser,Long>{
    	SysUser findByUsername(String username);
    }

## 2.3 service层的编写 ##

SpringSecurity将调用实现了UserDetailService的类返回User

@Component
    public class myUserDetailService implements UserDetailsService {
    	@Autowired
    	SysUserRepository sysUserRepository;
    	@Override
    	public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
    		SysUser user = sysUserRepository.findByUsername(username);
    		if(user==null) {
    			
    			System.out.println("没有查找到用户");
    		}
    		return user;
    	}
    
    }

## 2.4 config的编写 ##

### 2.4.1 SecurityConfiguration的编写 ###

@Configuration
    public class SecurityConfiguration extends WebSecurityConfigurerAdapter{
        
        //这里将我们刚才写的myUserDetailsService,将调用它返回user
    	@Bean
    	protected UserDetailsService myUserDetailsService() {
    		return new myUserDetailService();
    	}
        //将加密器注册为BEAN
    	@Bean
    	protected PasswordEncoder  PasswordEncoder() {
    		return new BCryptPasswordEncoder();
    	}
        //这是新版SpringSecurity的要求,要求必须指定加密器,不然会报null的错误,这里我们表示将用
    //BCryptPasswordEncoder()来加密解密密码.
    	@Override
    	protected void configure(AuthenticationManagerBuilder auth) throws Exception {
    		auth.userDetailsService(myUserDetailsService()).passwordEncoder(new BCryptPasswordEncoder());
    	}
    	@Override
    	protected void configure(HttpSecurity http) throws Exception {
    		http.authorizeRequests() //给请求授权,定义哪些URL需要被保护、哪些不需要被保护
    			.antMatchers("/test1/**").hasRole("ADMIN")
    			.antMatchers("/test2/**").hasRole("USER")
    			.antMatchers("/test3/**").hasRole("TEACHER")
    			.anyRequest().authenticated() //任何没有匹配上的其他的url请求，都需要用户被验证
    			.and()
    			.formLogin()   //定义登陆的一些事项
    				.loginPage("/login") //  定义当需要用户登录时候，转到的登录页面
    				.failureUrl("/login?error")
    				.permitAll()
    			.and()
    			.logout().permitAll();
    	}
    }

### 2.4.2 WebMvcConfig的编写 ###

这里就配置了一个页面跳转,和再controller配置效果是一样的.

@Configuration
    public class WebMvcConfig implements WebMvcConfigurer{
    	
    	@Override
    	public void addViewControllers(ViewControllerRegistry registry) {
    		WebMvcConfigurer.super.addViewControllers(registry);
    		registry.addViewController("/login").setViewName("login");
    	}
    
    }

## 2.5 controller的编写 ##

这里登陆成功会自动跳转到主页.

@Controller
    public class HomeController {
    	@RequestMapping("/")
    	public String index(Model model) {
    		Msg msg = new Msg("测试标题", "测试内容", "额外信息,只对管理员显示");
    		model.addAttribute("msg", msg);
    		return "home";
    	}
    	@RequestMapping("/test1")
    	public String  test1(Model model) {
    		Msg msg = new Msg("测试标题", "测试内容", "额外信息,只对管理员显示");
    		model.addAttribute("msg", msg);
    		return "test1";
    	}
    	
    	@RequestMapping("/test2")
    	public String  test2(Model model) {
    		Msg msg = new Msg("测试标题", "测试内容", "额外信息,只对管理员显示");
    		model.addAttribute("msg", msg);
    		return "test2";
    	}
    	
    	@RequestMapping("/test3")
    	public String  test3(Model model) {
    		Msg msg = new Msg("测试标题", "测试内容", "额外信息,只对管理员显示");
    		model.addAttribute("msg", msg);
    		return "test3";
    	}
    	
    }

## 2.6 temeplates的书写 ##

![20181215120520685.png][]

home:

<!DOCTYPE html>
    <html lang="en" xmlns:th="http://www.thymeleaf.org" xmlns:sec="http://www.thymeleaf.org/thymeleaf-extras-springsecurity4">
    <head>
    <meta content="text/html;charset=UTF-8">
    <title sec:authentication="name"></title>
    </head>
    <body>
    	<a th:href="@{/}">首页</a>
    	<h1 th:text="${msg.title}"></h1>
    	<p th:text="${msg.content}"></p>
    	
    	<div sec:authorize="isAuthenticated()">
    		<p th:text="${msg.etraInfo}"></p>
    	</div>
    	
    	<span sec:authorize="hasRole('ROLE_ADMIN')">管理员</span>
    	
    	<div sec:authorize="hasRole('ROLE_USER')">
    		<p >无更多信息显示</p>
    	</div>
    	<form th:action="@{/logout}" method="post">
    		<input type="submit" value="注销"/>
    	</form>
    	
    </body>
    </html>

test1:

<!DOCTYPE html>
    <html lang="en" xmlns:th="http://www.thymeleaf.org">
    <head>
    <meta charset="UTF-8">
    <title>这是test1</title>
    </head>
    <body>
    	<p th:text="${msg.content}"></p>
    </body>
    </html>

test2:

<!DOCTYPE html>
    <html lang="en" xmlns:th="http://www.thymeleaf.org">
    <head>
    <meta charset="UTF-8">
    <title>这是test2</title>
    </head>
    <body>
    	<p th:text="${msg.content]"></p>
    </body>
    </html>

test3:

<!DOCTYPE html>
    <html lang="en" xmlns:th="http://www.thymeleaf.org">
    <head>
    <meta charset="UTF-8">
    <title>这是test3</title>
    </head>
    <body>
    	<p th:text="${msg.content}"></p>
    </body>
    </html>

<!DOCTYPE html>
    <html lang="en" xmlns:th="http://www.thymeleaf.org">
    <head>
    <meta content="text/html;charset=UTF-8"/>
    <title>登陆页面</title>
    </head>
    <body>
    <a th:href="@{/}">首页</a>
    <p th:if="${param.logout}">已成功注销</p>
    <p th:if="${param.error}">有错误,请重试</p>
    <form th:action="@{/login}" method="POST">
    	<label>账号</label>
    	<input type="text" name="username">
    	<label>密码</label>
    	<input type="password" name="password">
    	<input type="submit" id="login" value="login"/>
    </form>
    </body>
    </html>

# 第三章 操作之前的准备 #

## 3.1 运行的时候可能出现的错误 ##

### 3.1.1 There is no PasswordEncoder mapped for the id “null” ###

参考:There is no PasswordEncoder mapped for the id “null”

就是没用类似BCrypt的加密器,现在这个版本的必须要用这个加密,按上面的加个BCrypt的Bean就好了.

### 3.1.2 Encoded password does not look like BCrypt ###

参考:[https://blog.csdn.net/zhuyongru/article/details/82108543][https_blog.csdn.net_zhuyongru_article_details_82108543]

就是数据库的密码不是加密过的,因为我们设置了加密器,所以加密器要求我们数据的密码是加密过的,具体的形式如下图.

![20181215121726788.png][]

如何插入加密后的密码?见下图,将用户的密码取出并加密

@SpringBootTest
    @RunWith(SpringRunner.class)
    public class MyTest {
    	
    	@Autowired
    	SysUserRepository sysUserRepository;
    	@Test
    	public void test1() {
    		System.out.println("第一个测试");
    		SysUser user = sysUserRepository.findByUsername("zhangchen");
    		BCryptPasswordEncoder passwordEncoder = new BCryptPasswordEncoder();
    		user.setPassword(passwordEncoder.encode(user.getPassword()));
    		sysUserRepository.save(user);
    	}
    
    }

### 3.2 数据库的配置 ###

![20181215121851277.png][]

sys\_role

注意,数据库里的权限我们要加上ROLE\_

![20181215121912757.png][]

sys\_user

![20181215121925123.png][]

sys\_user\_roles

![20181215122010163.png][]

# 第四章 具体的操作 #

打开登陆页面

![2018121512225528.png][]

此时我们发现无论访问什么url都会跳转到登陆,于是我们输入账号密码进行登陆,登陆后跳转到首页

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3E2MTAzNzY2ODE_size_16_color_FFFFFF_t_70][]

我们尝试访问/test1

![2018121512242591.png][]

再尝试访问/test2,可以访问被禁止了,因为没有USER权限

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3E2MTAzNzY2ODE_size_16_color_FFFFFF_t_70 1][]

我们加上USER权限,再重新登陆,再访问test2,成功了

![20181215122611336.png][]         ![20181215122629650.png][]

![20181215122726824.png][]

[20181215112406264.png]: /images/20220404/c6a380e0227e40cbb5747d2a93756dec.png
[20181215120520685.png]: /images/20220404/a2683d978e414549b635a9c9e73fcfbd.png
[https_blog.csdn.net_zhuyongru_article_details_82108543]: https://blog.csdn.net/zhuyongru/article/details/82108543
[20181215121726788.png]: /images/20220404/b98c38c0ecda4e02be4ef19b8eb76ee1.png
[20181215121851277.png]: /images/20220404/f0829f9973ab401db81d84893f3bc570.png
[20181215121912757.png]: /images/20220404/1eda5a43b1f9440b82ebc1bf12096bf5.png
[20181215121925123.png]: /images/20220404/5ad83a776a5a4da6b249466214778370.png
[20181215122010163.png]: /images/20220404/c7153b1dbe0d4f56af7c9761e9019df4.png
[2018121512225528.png]: /images/20220404/204c82f78a5642f4a609c3d04485ff3a.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3E2MTAzNzY2ODE_size_16_color_FFFFFF_t_70]: /images/20220404/3d398d0fe0694fe586889f61b57f8191.png
[2018121512242591.png]: /images/20220404/847a7b19f0144921ae9a76950351f2ee.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3E2MTAzNzY2ODE_size_16_color_FFFFFF_t_70 1]: /images/20220404/cb325f005ec84f4d915022ddfb241293.png
[20181215122611336.png]: https://img-blog.csdnimg.cn/20181215122611336.png
[20181215122629650.png]: /images/20220404/f61d410898f040a5ab32129502b8a50c.png
[20181215122726824.png]: /images/20220404/019d8ad546ea4cb5866ed06f9f69f75a.png