SpringBoot集成Spring Security（1）——入门程序

编程语言 2018-11-20 17:40:12 阅读次数: 0

因为项目需要，第一次接触Spring Security，早就听闻Spring Security强大但上手困难，今天学习了一天，翻遍了全网资料，才仅仅出入门道，特整理这篇文章来让后来者少踩一点坑（本文附带实例程序，请放心食用）

本篇文章环境：SpringBoot 2.0 + Mybatis + Spring Security 5.0

源码地址:https://github.com/wzy010/home.git

项目结构图如下:

创建springboot项目

选择mybatis和mysql

文章目录

Step1 导入依赖

<dependencies>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-web</artifactId>
        </dependency>

        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-test</artifactId>
            <scope>test</scope>
        </dependency>

        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-security</artifactId>
        </dependency>

        <!-- https://mvnrepository.com/artifact/javax.persistence/persistence-api -->
        <dependency>
            <groupId>javax.persistence</groupId>
            <artifactId>persistence-api</artifactId>
            <version>1.0</version>
        </dependency>

        <dependency>
            <groupId>org.projectlombok</groupId>
            <artifactId>lombok</artifactId>
            <version>1.16.14</version>
            <scope>provided</scope>
        </dependency>

        <dependency>
            <groupId>org.mybatis.spring.boot</groupId>
            <artifactId>mybatis-spring-boot-starter</artifactId>
            <version>1.3.1</version>
        </dependency>

        <dependency>
            <groupId>mysql</groupId>
            <artifactId>mysql-connector-java</artifactId>
        </dependency>

    </dependencies>

Step2 创建数据库

一般权限控制有三层，即：用户<–>角色<–>权限，用户与角色是多对多，角色和权限也是多对多。这里我们先暂时不考虑权限，只考虑用户<–>角色。

创建用户表sys_user：

CREATE TABLE `sys_user` (
  `id` int(11) NOT NULL AUTO_INCREMENT,
  `name` varchar(255) NOT NULL,
  `password` varchar(255) NOT NULL,
  PRIMARY KEY (`id`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8;

创建权限表sys_role：

CREATE TABLE `sys_role` (
  `id` int(11) NOT NULL,
  `name` varchar(255) NOT NULL,
  PRIMARY KEY (`id`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8;

创建用户-角色表sys_user_role：

CREATE TABLE `sys_user_role` (
  `user_id` int(11) NOT NULL,
  `role_id` int(11) NOT NULL,
  PRIMARY KEY (`user_id`,`role_id`),
  KEY `fk_role_id` (`role_id`),
  CONSTRAINT `fk_role_id` FOREIGN KEY (`role_id`) REFERENCES `sys_role` (`id`) ON DELETE CASCADE ON UPDATE CASCADE,
  CONSTRAINT `fk_user_id` FOREIGN KEY (`user_id`) REFERENCES `sys_user` (`id`) ON DELETE CASCADE ON UPDATE CASCADE
) ENGINE=InnoDB DEFAULT CHARSET=utf8;

初始化一下数据：

INSERT INTO `sys_role` VALUES ('1', 'ROLE_ADMIN');
INSERT INTO `sys_role` VALUES ('2', 'ROLE_USER');

INSERT INTO `sys_user` VALUES ('1', 'admin', '123');
INSERT INTO `sys_user` VALUES ('2', 'wzy', '123');

INSERT INTO `sys_user_role` VALUES ('1', '1');
INSERT INTO `sys_user_role` VALUES ('2', '2');

博主有话说：

这里的权限格式为ROLE_XXX，是Spring Security规定的，不要乱起名字哦。

Step3 准备页面

静态资源放在resource的static目录下

因为是示例程序，页面越简单越好，只用于登陆的login.html以及用于登陆成功后的home.html：

login.html：

<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <title>登陆</title>
</head>
<body>
<h1>登陆</h1>
<form method="post" action="/login">
    <div>
        用户名：<input type="text" name="username">
    </div>
    <div>
        密码：<input type="password" name="password">
    </div>
    <div>
        <button type="submit">立即登陆</button>
    </div>
</form>
</body>
</html>

博主有话说：

用户的登陆认证是由Spring Security进行处理的，请求路径默认为/login，用户名默认为username，密码默认为password

home.html：

<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <title>Title</title>
</head>
<body>
    <h1>登陆成功</h1>
    <a href="/admin">检测ROLE_ADMIN角色</a>
    <a href="/user">检测ROLE_USER角色</a>
    <button onclick="window.location.href='/logout'">退出登录</button>
</body>
</html>

Step4 配置application.properties

在配置文件中配置下数据库连接：

spring.datasource.driver-class-name=com.mysql.jdbc.Driver
spring.datasource.url=jdbc:mysql://localhost:3306/security?useUnicode=true&characterEncoding=utf-8&useSSL=true&serverTimezone=GMT
spring.datasource.username=root
spring.datasource.password=root

#开启Mybatis下划线命名转驼峰命名
mybatis.configuration.map-underscore-to-camel-case=true

Step5 创建实体、Dao、Service和Controller

5.1 实体

(1)SysUser

package com.chwx.springbootspringsecurity.pojo;


import lombok.Data;

import javax.persistence.Column;
import javax.persistence.Id;
import javax.persistence.Table;
import java.io.Serializable;

@Data
@Table(name="sys_user")
public class SysUser implements Serializable {

    @Id
    private Integer id;
    private String name;
    private String password;
}

(2)SysRole

package com.chwx.springbootspringsecurity.pojo;

import lombok.Data;

import javax.persistence.Id;
import javax.persistence.Table;
import java.io.Serializable;
@Data
@Table(name="sys_role")
public class SysRole implements Serializable {
    @Id
    private Integer id;
    private String name;
}

(3)SysUserRole

package com.chwx.springbootspringsecurity.pojo;

import lombok.Data;

import javax.persistence.Column;
import javax.persistence.Table;
import java.io.Serializable;

@Data
@Table(name="sys_user_role")
public class SysUserRole implements Serializable {
    @Column(name="user_id")
    private  Integer userId;
    @Column(name="role_id")
    private Integer roleId;
}

5.2 Dao

(1)SysUserMapper

package com.chwx.springbootspringsecurity.dao;

import com.chwx.springbootspringsecurity.pojo.SysUser;
import org.apache.ibatis.annotations.Mapper;
import org.apache.ibatis.annotations.Select;

@Mapper
public interface SysUserMapper {
    @Select("select * from sys_user where id = #{id}")
    SysUser selectById(Integer id);
    @Select("select * from sys_user where name = #{name}")
    SysUser selectByName(String name);

}

(2)SysRoleMapper

package com.chwx.springbootspringsecurity.dao;

import com.chwx.springbootspringsecurity.pojo.SysRole;
import org.apache.ibatis.annotations.Mapper;
import org.apache.ibatis.annotations.Select;

@Mapper
public interface SysRoleMapper {
    @Select("select * from sys_role where id =#{id}")
    SysRole selectById(Integer id);
}

(3)SysUserRoleMapper

package com.chwx.springbootspringsecurity.dao;

import com.chwx.springbootspringsecurity.pojo.SysUserRole;
import org.apache.ibatis.annotations.Mapper;
import org.apache.ibatis.annotations.Select;

import java.util.List;

@Mapper
public interface SysUserRoleMapper {
    @Select("select * from sys_user_role where user_id = #{userId}")
    List<SysUserRole> listByUserId(Integer userId);
}

5.3 Service

(1)SysUserService

package com.chwx.springbootspringsecurity.service;

import com.chwx.springbootspringsecurity.dao.SysUserMapper;
import com.chwx.springbootspringsecurity.pojo.SysUser;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.stereotype.Service;

@Service
public class SysUserService {

    @Autowired
    private SysUserMapper sysUserMapper;

    public SysUser selectById(Integer id){
        return  sysUserMapper.selectById(id);
    }

    public SysUser selectByName(String name){
        return sysUserMapper.selectByName(name);
    }
}

(2)SysRoleService

package com.chwx.springbootspringsecurity.service;

import com.chwx.springbootspringsecurity.dao.SysRoleMapper;
import com.chwx.springbootspringsecurity.pojo.SysRole;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.stereotype.Service;

@Service
public class SysRoleService {
    @Autowired
    private SysRoleMapper sysRoleMapper;

    public SysRole selectById(Integer id){
        return sysRoleMapper.selectById(id);
    }
}

(3)SysUserRoleService

package com.chwx.springbootspringsecurity.service;

import com.chwx.springbootspringsecurity.dao.SysUserRoleMapper;
import com.chwx.springbootspringsecurity.pojo.SysUserRole;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.stereotype.Service;

import java.util.List;

@Service
public class SysUserRoleService {
    @Autowired
    private SysUserRoleMapper sysUserRoleMapper;

    public List<SysUserRole> listByUserId(Integer userId){
        return  sysUserRoleMapper.listByUserId(userId);
    }
}

5.4 Controller

package com.chwx.springbootspringsecurity.controller;

import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.security.access.prepost.PreAuthorize;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.RequestBody;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.ResponseBody;

@Controller
public class LoginController {

    private Logger logger = LoggerFactory.getLogger(LoginController.class);

    @RequestMapping("/")
    public String showHome(){
        String name = SecurityContextHolder.getContext().getAuthentication().getName();
        logger.info("当前登录用户: "+name);
        return "home.html";
    }

    @RequestMapping("/login")
    public String showLogin(){
        return "login.html";
    }

    @RequestMapping("/admin")
    @ResponseBody
    @PreAuthorize("hasRole('ROLE_ADMIN')")
    public String printAdmin(){
        return "如果你看见这句话，说明你有ROLE_ADMIN角色";
    }

    @RequestMapping("/user")
    @ResponseBody
    @PreAuthorize("hasRole('ROLE_USER')")
    public String printUser(){
        return "如果你看见这句话，说明你有ROLE_USER角色";
    }

}

博主有话说：

  • 如代码所示，获取当前登录用户：SecurityContextHolder.getContext().getAuthentication()
  • @PreAuthorize用于判断用户是否有指定权限，没有就不能访问

Step6 配置SpringSecurity

6.1 UserDetailsService

首先我们需要自定义UserDetailsService，将用户信息和权限注入进来。

我们需要重写loadUserByUsername方法，参数是用户输入的用户名。

返回值是UserDetails，这是一个接口，一般使用它的子类org.springframework.security.core.userdetails.User（当前你也可以自定义个UserDetails），它有三个参数，分别是用户名、密码和权限集。
 

package com.chwx.springbootspringsecurity.common;

import com.chwx.springbootspringsecurity.pojo.SysRole;
import com.chwx.springbootspringsecurity.pojo.SysUser;
import com.chwx.springbootspringsecurity.pojo.SysUserRole;
import com.chwx.springbootspringsecurity.service.SysRoleService;
import com.chwx.springbootspringsecurity.service.SysUserRoleService;
import com.chwx.springbootspringsecurity.service.SysUserService;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.authority.SimpleGrantedAuthority;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.core.userdetails.UsernameNotFoundException;
import org.springframework.stereotype.Service;
import java.util.ArrayList;
import java.util.Collection;
import java.util.List;

@Service
public class CustomUserDetailsService implements UserDetailsService {
    @Autowired
    private SysUserService userService;
    @Autowired
    private SysRoleService roleService;
    @Autowired
    private SysUserRoleService userRoleService;

    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        Collection<GrantedAuthority> authorities = new ArrayList<>();
        //数据库获取用户信息
        SysUser user = userService.selectByName(username);
        //判断用户是否存在
        if (user == null){
            System.out.println("用户不存在");
            throw new UsernameNotFoundException("用户不存在");
        }

        //添加权限
        List<SysUserRole> userRoles = userRoleService.listByUserId(user.getId());
        for (SysUserRole userRole : userRoles){
            SysRole role = roleService.selectById(userRole.getRoleId());
            authorities.add(new SimpleGrantedAuthority(role.getName()));
        }
        //返回UserDeatils实现类
        return new User(user.getName(),user.getPassword(),authorities);
    }
}

6.2 WebSecurityConfig

该类是Spring Security的配置类，该类的三个注解分别是标识该类是配置类、开启Security服务、开启全局Securtiy注解。

首先将我们自定义的userDetailsService注入进来，在configure()方法中使用auth.userDetailsService()方法替换默认的userDetailsService。

这里我们还指定了密码的加密方式（Spring Security 5.0强制要求设置），因为我们数据库是明文存储的，所以无需加密，如下所示：
 

package com.chwx.springbootspringsecurity.common;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.builders.WebSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.web.authentication.rememberme.JdbcTokenRepositoryImpl;
import org.springframework.security.web.authentication.rememberme.PersistentTokenRepository;

import javax.sql.DataSource;

@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
    @Autowired
    private CustomUserDetailsService userDetailsService;


    @Override
    protected void configure(HttpSecurity http) throws Exception {

        http.authorizeRequests()
                //如果有允许匿名访问的url,填写在下面
                //.antMatchers().permitAll()
        .anyRequest()
                .authenticated()
                //设置登录页面
                .and().formLogin().loginPage("/login")
                //设置登陆成功页面
        .defaultSuccessUrl("/").permitAll()
                // 自定义登陆用户名和密码参数，默认为username和password
//                .usernameParameter("username")
//                .passwordParameter("password")
        .and().logout().permitAll();
       
        // 关闭CSRF跨域
        http.csrf().disable();
    }

    @Override
    public void configure(WebSecurity web) throws Exception {
        // 设置拦截忽略文件夹，可以对静态资源放行
        web.ignoring().antMatchers("/css/**","/js/**");
        super.configure(web);
    }

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.userDetailsService(userDetailsService).passwordEncoder(new PasswordEncoder() {
            @Override
            public String encode(CharSequence charSequence) {
                
                return charSequence.toString();
                
            }

            @Override
            public boolean matches(CharSequence charSequence, String s) {
            
                return s.equals(charSequence.toString());
               
            }
        });
    }
}

Step7 运行程序

注：如果你想要使用密码加密功能的话，修改configure()方法如下：

@Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
     auth.userDetailsService(userDetailsService)
         .passwordEncoder(new PasswordEncoder() {
             @Override
             public String encode(CharSequence rawPassword) {
                 return new BCryptPasswordEncoder().encode(rawPassword);
             }

             @Override
             public boolean matches(CharSequence rawPassword, String encodedPassword) {
                 return new BCryptPasswordEncoder().matches(rawPassword,encodedPassword);
             }
         });
 }

猜你喜欢

转载自blog.csdn.net/SKT_T1_Faker/article/details/84291416
今日推荐
《美国对全球网络空间安全与发展的威胁和破坏》报告发布
火速冲上 GitHub 热榜 —— 开源编程语言、框架哪有这么可爱？
北京人形机器人创新中心发布全球首个纯电驱拟人奔跑的全尺寸人形机器人“天工”
LFOSSA 源来如此公开课 | 掌握云原生未来：CNCF 认证全面攻略与备考秘籍
周排行
循环神经网络（rnn）讲解
Tigao教程四：单独的关节运动
金蝶K3WISE15.0-注册套打教程
如何在Mac上配置Kubernetes
Android应用结束自身进程的方法
SpringMVC学习 十三 拦截器栈
中国驻洛杉矶总领馆举行新春招待会
HttpClient get post 发送
11 - three.js 笔记 - 绘制三维字体模型
Mysql递归获取某个父节点下面的所有子节点和子节点上的所有父节点
每日归档
更多
2024-05-01(4)
2024-04-30(1)
2024-04-29(40)
2024-04-28(0)
2024-04-27(56)
2024-04-26(39)
2024-04-25(22)
2024-04-24(36)
2024-04-23(26)
2024-04-22(39)

代码天地 © 2018 codetd.com

境外服务器   最新电视剧2022