SpringSecurity【用户+权限的数据库持久化】

亦凉 2022-06-10 05:45 163阅读 0赞

## 实战前理论讲解 ##

[Github代码查看][Github]

[数据库文件][Link 1]

要想达到这个目的：主要是实现一个接口，UserDetilsService。  
然后，把这个类配置到SpringSecurity的配置文件中。

这个接口只有一个方法：

public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException{
    
    }

*这个方法的作用就是返回用户的相关信息包括用户名和密码还有该用户拥有的权限信息。*

*返回的这些信息将会被用作SpringSecurity验证用户登录信息的标准，及这个方法返回的用户名密码，将会和 在用户登录界面接收到的信息进行比对。这些权限信息也会被保留到SpringSecurity自身的其它类中存储起来，在以后访问页面时将会验证当前用户的权限。*

所以经过上面的分析，我们就能够知道，我们可以在这个类中写数据库访问的逻辑。

通常我们数据库的表结构，有以下五个就够了。

user(username 主键 , password)  
role(rid 主键 , rname , rdescription)  
user\_role(urid 主键 , username 外键 , rid 外键)  
res(res\_id 主键 , res\_url , res\_description)  
res\_role(res\_r\_id 主键 , res\_id 外键 , r\_id 外键)

## 实现UserDetilsService ##

/**
     * Created by Administrator on 2017/8/9.
     */
    @Component("customUserService")
    public class CustomUserService implements UserDetailsService{
        
    
        @Autowired
        private UserMapper userMapper;
    
        @Autowired
        private UserRoleMapper userRoleMapper;
    
        @Override
        public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
    
            UserCustom requestMessage = new UserCustom(username,"");
    
            cn.domarvel.po.User resultUser = userMapper.findUserByUsername(requestMessage);
            if (resultUser == null) {
                return null;
            }
            String password = resultUser.getPassword();
            boolean enabled = true;
            boolean accountNonLoked = true;
            boolean accountNonExpired = true;
            boolean credentialsNonExipred = true;
    
            Collection<GrantedAuthority> authorities = new ArrayList<>();
    
            List<Role> roles = userRoleMapper.findRolesByUsername(requestMessage);
    
            if (roles == null) {
                return null;
            }
            for (Role role : roles) {
                authorities.add(new SimpleGrantedAuthority(role.getRname()));
            }
    
            //前面的所有铺垫都是为了返回这个User参数。所以你只需要看这一步就行了。相关参数 自行百度！！谢谢！！
            User user = new User(username,password,enabled,accountNonExpired,credentialsNonExipred,accountNonLoked,authorities);
    
            return user;
        }
    }

## 配置 SpringSecurity文件 ##

<security:authentication-manager alias="authenticationManagerw">
            <security:authentication-provider user-service-ref="customUserService">
            </security:authentication-provider>
        </security:authentication-manager>

### 总的配置文件： ###

<?xml version="1.0" encoding="UTF-8"?>
    <beans xmlns="http://www.springframework.org/schema/beans"
           xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
           xmlns:security="http://www.springframework.org/schema/security"
           xmlns:mvc="http://www.springframework.org/schema/mvc"
           xmlns:context="http://www.springframework.org/schema/context"
           xsi:schemaLocation="http://www.springframework.org/schema/beans
           http://www.springframework.org/schema/beans/spring-beans.xsd http://www.springframework.org/schema/security
           http://www.springframework.org/schema/security/spring-security.xsd http://www.springframework.org/schema/mvc http://www.springframework.org/schema/mvc/spring-mvc.xsd http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd">
    
    
        <security:http pattern="/**/*.css" security="none"></security:http>
        <security:http pattern="/**/*.jpg" security="none"></security:http>
        <security:http pattern="/**/*.jpeg" security="none"></security:http>
        <security:http pattern="/**/*.gif" security="none"></security:http>
        <security:http pattern="/**/*.png" security="none"></security:http>
        <security:http pattern="/**/*.js" security="none"></security:http>
    
        <security:http pattern="/login.jsp" security="none"></security:http>
        <security:http pattern="/index.jsp" security="none"></security:http>
        <security:http pattern="/getCode" security="none" />
        <security:http pattern="/test/**" security="none"></security:http>
    
        
        <security:http auto-config="true" use-expressions="false">
    
            <security:custom-filter ref="filterSecurityInterceptor" before="FILTER_SECURITY_INTERCEPTOR"/>
    
            
            
            <security:logout logout-url="/logoutSecurity" invalidate-session="true" delete-cookies="JSESSIONID"/>
            
            <security:csrf disabled="true"/>
        </security:http>
    
        
        <security:authentication-manager alias="authenticationManagerw">
            <security:authentication-provider user-service-ref="customUserService">
            </security:authentication-provider>
        </security:authentication-manager>
    
        <bean id="MyaccessManager" class="org.springframework.security.access.vote.AffirmativeBased">
            <constructor-arg name="decisionVoters">
                <list>
                    <ref bean="roleVoter"/>
                    <ref bean="authVoter"/>
                </list>
            </constructor-arg>
        </bean>
    
        <bean id="roleVoter" class="org.springframework.security.access.vote.RoleVoter">
            <property name="rolePrefix" value="ROLE_"/>
        </bean>
    
        <bean id="authVoter" class="org.springframework.security.access.vote.AuthenticatedVoter"/>
    
        <bean id="securityMetadataSource" class="cn.domarvel.springsecurity.model.URLFilterInvocationSecurityMetadataSource" />
    
        
        <bean id="filterSecurityInterceptor" class="org.springframework.security.web.access.intercept.FilterSecurityInterceptor">
            <property name="accessDecisionManager" ref="MyaccessManager"></property>
            <property name="authenticationManager" ref="authenticationManagerw"></property>
            <property name="securityMetadataSource" ref="securityMetadataSource"></property>
        </bean>
    </beans>

[Github]: https://github.com/Fire-Star/Learn-SpringSecurity/tree/master/SpringSecurity-firstDao
[Link 1]: https://github.com/Fire-Star/Learn-SpringSecurity/blob/master/SpringSecurity-firstDao/springsecurity.sql