Spring Security（一）自定义数据库模型的认证与授权

朴灿烈づ我的快乐病毒、 2023-06-04 14:57 13阅读 0赞

### 一、说明 ###

自定义数据结构实际上也仅需实现一个自定义的UserDetailsService；

UserDetailsService仅定义一个loadUserByUsername方法，用于获取一个UserDetails对象。UserDetails对象包含一系列在验证时会用到的信息，包括用户名、密码、权限以及其他信息，Spring Security会根据这些信息判定验证是否成功。

### 二、实现 ###

**1.数据库准备**

设计一个自定义的数据结构。

SET FOREIGN_KEY_CHECKS=0;
    
    -- ----------------------------
    -- Table structure for users
    -- ----------------------------
    DROP TABLE IF EXISTS `users`;
    CREATE TABLE `users` (
      `id` bigint(20) NOT NULL AUTO_INCREMENT,
      `username` varchar(50) COLLATE utf8mb4_bin NOT NULL COMMENT '用户名',
      `password` varchar(60) COLLATE utf8mb4_bin DEFAULT NULL COMMENT '密码',
      `enable` tinyint(4) NOT NULL DEFAULT '1' COMMENT '用户是否可用',
      `roles` text CHARACTER SET utf8mb4 COMMENT '用户角色，多个角色之间使用逗号隔开',
      PRIMARY KEY (`id`),
      KEY `idx_users_username` (`username`)
    ) ENGINE=InnoDB AUTO_INCREMENT=3 DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_bin;
    
    -- ----------------------------
    -- Records of users
    -- ----------------------------
    INSERT INTO `users` VALUES ('1', 'admin', '123', '1', 'ROLE_ADMIN,ROLE_USER');
    INSERT INTO `users` VALUES ('2', 'user', '123', '1', 'ROLE_USER');

**2.User实体**

User实体继承UserDetails。

package com.zit.springsecurity.entity;
    
    import org.springframework.security.core.GrantedAuthority;
    import org.springframework.security.core.userdetails.UserDetails;
    
    import java.util.Collection;
    import java.util.List;
    
    public class User implements UserDetails{
        private Long id;
        private String username;
        private String password;
        private String roles;
        private boolean enable;
    
        private List<GrantedAuthority> authorities;
    
        public Long getId() {
            return id;
        }
    
        public void setId(Long id) {
            this.id = id;
        }
    
        public void setUsername(String username) {
            this.username = username;
        }
    
        public void setPassword(String password) {
            this.password = password;
        }
    
        public String getRoles() {
            return roles;
        }
    
        public void setRoles(String roles) {
            this.roles = roles;
        }
    
        public boolean isEnable() {
            return enable;
        }
    
        public void setEnable(boolean enable) {
            this.enable = enable;
        }
    
        @Override
        public Collection<? extends GrantedAuthority> getAuthorities() {
            return this.authorities;
        }
    
        public void setAuthorities(List<GrantedAuthority> authorities) {
            this.authorities = authorities;
        }
    
        @Override
        public String getPassword() {
            return this.password;
        }
    
        @Override
        public String getUsername() {
            return this.username;
        }
    
        @Override
        public boolean isAccountNonExpired() {
            return true;
        }
    
        @Override
        public boolean isAccountNonLocked() {
            return true;
        }
    
        @Override
        public boolean isCredentialsNonExpired() {
            return true;
        }
    
        @Override
        public boolean isEnabled() {
            return this.enable;
        }
    }

实现UserDetails定义的几个方法：

*  isAccountNonExpired、isAccountNonLocked和isCredentialsNonExpired暂且用不到，统一返回true，否则Spring Security会认为账号异常。
 *  isEnabled对应enable字段，将其代入即可。
 *  getAuthorities方法本身对应的是roles字段，但由于结构不一致，所以此处新建一个，并在后续进行填充。

**3.实现UserDetailsService方法**

**3.1引入MyBatis**

<dependency>
    	<groupId>org.mybatis.spring.boot</groupId>
    	<artifactId>mybatis-spring-boot-starter</artifactId>
    	<version>1.3.2</version>
    </dependency>

**3.2数据库配置**

## 数据库配置
    spring.datasource.hikari.jdbc-url=jdbc:mysql://127.0.0.1:3306/spring_security?serverTimezone=Asia/Shanghai&useUnicode=true&characterEncoding=utf-8&useSSL=true
    spring.datasource.hikari.username=root
    spring.datasource.hikari.password=Rfid123456
    spring.datasource.hikari.driver-class-name=com.mysql.cj.jdbc.Driver

**3.3在入口类配置@MapperScan指定MyBatis要扫描的映射文件目录。**

@SpringBootApplication
    @MapperScan("com.zit.springsecurity.mapper")
    public class SpringSecurityApplication {
    
    	public static void main(String[] args) {
    		SpringApplication.run(SpringSecurityApplication.class, args);
    	}
    }

**3.4映射文件**

package com.zit.springsecurity.mapper;
    
    import com.zit.springsecurity.entity.User;
    import org.apache.ibatis.annotations.Param;
    import org.apache.ibatis.annotations.Select;
    import org.springframework.stereotype.Component;
    
    @Component
    public interface UserMapper {
        @Select("SELECT * FROM users WHERE username=#{username}")
        User findByUserName(@Param("username") String username);
    }

**4.UserDetailsService编码实现**

package com.zit.springsecurity.service;
    
    import com.zit.springsecurity.entity.User;
    import com.zit.springsecurity.mapper.UserMapper;
    import org.springframework.beans.factory.annotation.Autowired;
    import org.springframework.security.core.authority.AuthorityUtils;
    import org.springframework.security.core.userdetails.UserDetails;
    import org.springframework.security.core.userdetails.UserDetailsService;
    import org.springframework.security.core.userdetails.UsernameNotFoundException;
    import org.springframework.stereotype.Service;
    
    @Service
    public class MyUserDetailsService implements UserDetailsService{
        @Autowired
        private UserMapper userMapper;
    
        @Override
        public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
            // 从数据库尝试读取该用户
            User user = userMapper.findByUserName(username);
            // 用户不存在，抛出异常
            if(user == null){
                throw new UsernameNotFoundException("用户不存在");
            }
            // 将数据库形式的roles解析为UserDetails的权限集
            // AuthorityUtils.commaSeparatedStringToAuthorityList()是Spring Security提供的
            // 该方法用于将逗号隔开的权限集合字符串切割成可用权限对象列表
            // 当然也可以自己实现，如用分号来隔开等，参考generateAuthorities
            user.setAuthorities(AuthorityUtils.commaSeparatedStringToAuthorityList(user.getRoles()));
            return user;
        }
    }

**5.WebSecurityConfig配置**

package com.zit.springsecurity.configuration;
    
    import com.zit.springsecurity.service.MyUserDetailsService;
    import org.springframework.beans.factory.annotation.Autowired;
    import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
    import org.springframework.security.config.annotation.web.builders.HttpSecurity;
    import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
    import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
    
    @EnableWebSecurity
    public class WebSecurityConfig extends WebSecurityConfigurerAdapter{
    
    
        @Autowired
        private MyUserDetailsService myUserDetailsService;// 上面定义
    
        @Override
        protected void configure(AuthenticationManagerBuilder auth) throws Exception{
            auth.userDetailsService(myUserDetailsService).passwordEncoder(new MyPasswordEncoder());// 替换myUserDetailsService引用
        }
    
        @Override
        protected void configure(HttpSecurity http) throws Exception{
            http.authorizeRequests()
                    .antMatchers("/admin/api/**").hasRole("ADMIN")
                    .antMatchers("/user/api/**").hasRole("USER")
                    .antMatchers("/app/api/**").permitAll()
                    .anyRequest().authenticated()
                    .and()
                    .formLogin();
        }
    }

**6.效果**

**![20191008105959554.png][]**

[20191008105959554.png]: /images/20230601/4088c4e807e24647b832c7baf01e1d59.png