1. 问题描述
基于数据库MySQL实现用户登录的身份验证，暂时不考虑权限问题；
2.技术选型
SpringBoot+SpringSecurity+SpringData JPA+MySQL;
3.Pom依赖
3.1 springboot版本
<parent>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-parent</artifactId>
<version>2.1.8.RELEASE</version>
<relativePath/> <!-- lookup parent from repository -->
</parent>
3.2 maven依赖
<dependencies>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-data-jpa</artifactId>
</dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-security</artifactId>
</dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-web</artifactId>
</dependency>
<dependency>
<groupId>mysql</groupId>
<artifactId>mysql-connector-java</artifactId>
<scope>runtime</scope>
</dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-test</artifactId>
<scope>test</scope>
<exclusions>
<exclusion>
<groupId>org.junit.vintage</groupId>
<artifactId>junit-vintage-engine</artifactId>
</exclusion>
</exclusions>
</dependency>
<dependency>
<groupId>org.springframework.security</groupId>
<artifactId>spring-security-test</artifactId>
<scope>test</scope>
</dependency>
</dependencies>
4.application.yml配置
spring:
# jpa
jpa:
show-sql: true
hibernate:
ddl-auto: update
database: mysql
# db
datasource:
type: com.zaxxer.hikari.HikariDataSource
url: jdbc:mysql://localhost/yuyufeng?useUnicode=true&characterEncoding=utf-8&useSSL=false&serverTimezone=UTC
hikari:
driver-class-name: com.mysql.cj.jdbc.Driver
username: root
password: 2289288246
5.项目结构
6.HelloSecurityController实现
package springsecuritydemo1.controller;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RestController;
@RestController
@RequestMapping("/hello")
public class HelloSecurityController {
@GetMapping
public String hello(){
return "Hello Spring Security!";
}
}
启动项目，访问HelloSecurityController的路由，由于导入了SpringSecurity依赖，会出现默认的身份验证，跳转到 路径： http://localhost:8080/login; 默认用户名是：user，密码会在控制台生成：
Using generated security password: d3f3d4ff-111a-442c-8488-d6dfd4a15475
默认登录页面：
7.SpringData jpa实现
7.1 UserInfo实体实现
package springsecuritydemo1.entity;
import javax.persistence.*;
@Entity(name="userInfo")
@Table(name="user_info")
public class UserInfo {
@Id
@Column(name = "id")
@GeneratedValue(strategy = GenerationType.IDENTITY)//自增
private Long id;
//用户名
@Column(name = "username",nullable = false)
private String username;
//用户密码
@Column(name = "password",nullable = false,unique = false)
private String password;
public Long getId() {
return id;
}
public void setId(Long id) {
this.id = id;
}
public String getUsername() {
return username;
}
public void setUsername(String username) {
this.username = username;
}
public String getPassword() {
return password;
}
public void setPassword(String password) {
this.password = password;
}
@Override
public String toString() {
return "UserInfo{" +
"id=" + id +
", username='" + username + '\'' +
", password='" + password + '\'' +
'}';
}
}
7.2 UserInfoRepository实现
package springsecuritydemo1.repository;
import org.springframework.data.jpa.repository.JpaRepository;
import org.springframework.stereotype.Repository;
import springsecuritydemo1.entity.UserInfo;
@Repository
public interface UserInfoRepository extends JpaRepository<UserInfo,Long> {
UserInfo findByUsername(String username);
}
7.3 UserInfoService接口及UserInfoServiceImpl类实现
（1） UserInfoService接口
package springsecuritydemo1.service;
import springsecuritydemo1.entity.UserInfo;
public interface UserInfoService {
UserInfo create(UserInfo userInfo);
UserInfo findByUsername(String username);
}
（2）UserInfoServiceImpl类
package springsecuritydemo1.service.impl;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.stereotype.Service;
import springsecuritydemo1.entity.UserInfo;
import springsecuritydemo1.repository.UserInfoRepository;
import springsecuritydemo1.service.UserInfoService;
@Service
public class UserInfoServiceImpl implements UserInfoService {
@Autowired
private UserInfoRepository userInfoRepository;
@Autowired
private PasswordEncoder passwordEncoder;
@Override
public UserInfo create(UserInfo userInfo) {
//密码加密
userInfo.setPassword(passwordEncoder.encode(userInfo.getPassword()));
return userInfoRepository.save(userInfo);
}
@Override
public UserInfo findByUsername(String username) {
return userInfoRepository.findByUsername(username);
}
}
7.4 数据库数据准备
package springsecuritydemo1;
import org.junit.Test;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.boot.test.context.SpringBootTest;
import springsecuritydemo1.entity.UserInfo;
import springsecuritydemo1.service.UserInfoService;
@SpringBootTest
class SpringSecurityDemo1ApplicationTests {
@Autowired
private UserInfoService userInfoService;
@Test
void contextLoads() {
UserInfo userInfo1 = new UserInfo();
userInfo1.setId(1L);
userInfo1.setUsername("admin");
userInfo1.setPassword("123456");
UserInfo userInfoPO1 = userInfoService.create(userInfo1);
System.out.println(userInfo1);
UserInfo userInfo2 = new UserInfo();
userInfo2.setId(2L);
userInfo2.setUsername("user");
userInfo2.setPassword("123456");
UserInfo userInfoPO2 = userInfoService.create(userInfo2);
System.out.println(userInfo2);
}
}
不出意外，数据库已存在上述两条数据；
8. MyUserDetailService实现（关键步骤）
创建MyUserDetailService类，实现UserDetailsService接口，重写loadUserByUsername(String s)方法，返回的UserDetails类包含了用户名、密码、权限（暂不考虑），交给SpringSecurity进行身份验证；
package springsecuritydemo1.common.security;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.core.userdetails.UsernameNotFoundException;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.stereotype.Component;
import springsecuritydemo1.entity.UserInfo;
import springsecuritydemo1.service.UserInfoService;
import java.util.ArrayList;
import java.util.List;
@Component
public class MyUserDetailService implements UserDetailsService {
@Autowired
private UserInfoService userInfoService;
@Autowired
private PasswordEncoder passwordEncoder;
@Override
public UserDetails loadUserByUsername(String s) throws UsernameNotFoundException {
UserInfo userInfo = userInfoService.findByUsername(s);
if (userInfo == null) {
throw new UsernameNotFoundException("用户不存在");
}
//暂时不考虑权限验证，故该权限List为空；
List<GrantedAuthority> authorities = new ArrayList<>();
User userDetails = new User(userInfo.getUsername(), userInfo.getPassword(), authorities);
return userDetails;
}
}
9.SecurityConfig类实现
创建SecurityConfig类继承WebSecurityConfigurerAdapter类，注入PasswordEncoder；
package springsecuritydemo1.config;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {
@Bean
public PasswordEncoder passwordEncoder(){
return new BCryptPasswordEncoder();
}
@Override
protected void configure(HttpSecurity http) throws Exception {
super.configure(http);
}
@Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
super.configure(auth);
}
}
10.测试
10.1 测试
访问HelloSecurityController，进入默认登录页面，输入用户名与密码（参照7.4），登录成功，验证成功。