Spring-security 学习与使用

更多信息看中文参考手册：https://www.springcloud.cc/spring-security-zhcn.html

1.基于SSM+RBAC模型的spring-security

• pom.xml

		 <!-- spring-security --><dependency><groupId>org.springframework.security</groupId><artifactId>spring-security-core</artifactId><version>4.2.3.RELEASE</version></dependency><dependency><groupId>org.springframework.security</groupId><artifactId>spring-security-web</artifactId><version>4.2.3.RELEASE</version></dependency><dependency><groupId>org.springframework.security</groupId><artifactId>spring-security-config</artifactId><version>4.2.3.RELEASE</version></dependency><dependency><groupId>org.springframework.security</groupId><artifactId>spring-security-taglibs</artifactId><version>4.2.3.RELEASE</version></dependency>	<!-- json转换 --><dependency><groupId>com.fasterxml.jackson.core</groupId><artifactId>jackson-databind</artifactId><version>2.9.8</version></dependency>

• spring-security.xml

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"xmlns:security="http://www.springframework.org/schema/security"xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"xsi:schemaLocation="http://www.springframework.org/schema/beanshttp://www.springframework.org/schema/beans/spring-beans.xsdhttp://www.springframework.org/schema/securityhttp://www.springframework.org/schema/security/spring-security.xsd"><!-- 释放静态资源 --><security:http pattern="/resource/**" security="none"/><!-- 	定义 Web 相关权限控制auto-config="true"：自动加载springsecurity配置文件 use-expressions="true"：使用spring的el表达式--><security:http auto-config="true" use-expressions="true"><!--		配置请求URL pattern 			    需要拦截的资源 	access  				拦截方式 	method					请求方法isFullyAuthenticated() 	 登录后可访问 	permitAll()			 	所有人可访问hasAuthority() 			有对应权限可访问--><security:intercept-url pattern="/product/index" access="permitAll()" /><security:intercept-url pattern="/userLogin" access="permitAll()" /><security:intercept-url pattern="/product/list" access="hasAuthority('ROLE_LIST_PRODUCT')" /><security:intercept-url pattern="/**" access="isFullyAuthenticated()" /><!-- 					基于表单的认证login-page						    自定义登录页面	login-processing-url				登录请求地址	default-target-url				    登录成功后的默认页面authentication-failure-forward-url	 登录失败请求转发的url（不能与失败处理器同时使用）authentication-success-forward-url	 登录成功请求转发的url （不能与成功处理器同时使用）username-parameter				    登录时用户名请求参数password-parameter			    	登录时密码请求参数authentication-success-handler-ref	 自定义登陆成功处理器（AuthenticationSuccessHandler的一个实例）authentication-failure-handler-ref	 自定义登陆失败处理器（AuthenticationFailureHandler的一个实例）--><security:form-login  login-page="/userLogin"login-processing-url="/loginCc"default-target-url="/product/index"username-parameter="username"password-parameter="password"authentication-success-handler-ref="myAuthenticationSuccessHandler"authentication-failure-handler-ref="myAuthenticationFailureHandler"/><!--				 注销功能 logout-url						注销请求地址logout-success-url				注销成功请求地址delete-cookies="JSESSIONID" 	注销后清除的COOKIE--><security:logout logout-url="/logout" logout-success-url="/product/index" delete-cookies="JSESSIONID"/><!-- 访问拒绝处理器error-page	访问被拒绝页面--><security:access-denied-handler error-page="/accessDenied"/><!-- 关闭CSRF机制 --><security:csrf disabled="true"/>
</security:http><!-- 			security认证管理器authentication-provider				载用户信息从一个` userdetailsservice 和用户名/密码组合所提供的登录时比较user-service-ref="myUserDetailsService"		    引用实现UserDetailsService的beanpassword-encoder		    		配置密码编码器
-->
<security:authentication-manager><security:authentication-provider user-service-ref="myUserDetailsService"><security:password-encoder ref="passwordEncoder"></security:password-encoder></security:authentication-provider>
</security:authentication-manager><!-- 通过一个自定义的UserDetailsService自定义身份验证 -->
<bean id="myUserDetailsService" class="com.liu.security.MyUserDetailsService"></bean>
<!--     myAuthenticationSuccessHandler	（AuthenticationSuccessHandler的一个实例）myAuthenticationFailureHandler	（AuthenticationFailureHandler的一个实例） -->
<bean id="myAuthenticationSuccessHandler" class="com.liu.security.MyAuthenticationSuccessHandler"></bean>
<bean id="myAuthenticationFailureHandler" class="com.liu.security.MyAuthenticationFailureHandler"></bean>
<!-- 密码编码器 -->
<bean id="passwordEncoder" class="org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder"></bean></beans>

• web.xml文件配置
• 加载spring配置文件时加载spring-security配置文件

<!--配置监听器加载spring -->
<listener><listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
</listener>
<!-- web容器启动时，按照如下的路径载入spring和spring-security配置文件 -->
<context-param><param-name>contextConfigLocation</param-name><param-value>classpath:applicationContext.xml,classpath:spring-security.xml</param-value>
</context-param>

• ​ SpringSecurityFilterChain 是作为 SpringSecurity 的核心过滤器链

<!-- Spring Security --><filter><filter-name>springSecurityFilterChain</filter-name><filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class></filter><filter-mapping><filter-name>springSecurityFilterChain</filter-name><url-pattern>/*</url-pattern></filter-mapping>

• UserDetailsService实现类：自定义身份验证

public class MyUserDetailsService implements UserDetailsService {@Autowiredprivate UserMapper userMapper;@Overridepublic UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {//根据用户名查询用户信息User user= userMapper.findByUsername(username);if(user!=null) {//查询用户所有权限List<Permission> list = userMapper.findPermissionByUsername(username);//存放用户所有权限List<GrantedAuthority> authorities=new ArrayList<GrantedAuthority>();for (Permission permission : list) {GrantedAuthority grantedAuthority=new SimpleGrantedAuthority(permission.getPermTag());authorities.add(grantedAuthority);}//把所有权限赋值给useruser.setAuthorities(authorities);return user;}//认证失败return null;	}
}

• AuthenticationSuccessHandler实现类：认证成功处理器

public class MyAuthenticationSuccessHandler implements AuthenticationSuccessHandler {@Overridepublic void onAuthenticationSuccess(HttpServletRequest request, HttpServletResponse response,Authentication authentication) throws IOException, ServletException {//登陆失败，发送json串ObjectMapper objectMapper = new ObjectMapper();Map<Object, Object> map = new HashMap();map.put("success", true);String json = objectMapper.writeValueAsString(map);response.setContentType("text/json;charset=utf-8");response.getWriter().write(json);}}

• AuthenticationSuccessHandler实现类：认证失败处理器

public class MyAuthenticationFailureHandler implements AuthenticationFailureHandler {@Overridepublic void onAuthenticationFailure(HttpServletRequest request, HttpServletResponse response,AuthenticationException exception) throws IOException, ServletException {//登陆成功，发送json串ObjectMapper objectMapper = new ObjectMapper();Map<Object, Object> map = new HashMap();map.put("success", false);String json = objectMapper.writeValueAsString(map);response.setContentType("text/json;charset=utf-8");response.getWriter().write(json);}
}

• 用户类：实现UserDetails

public class User implements UserDetails{private Integer id;private String username;private String realname;private String password;private Date creatDate;private Date lastLoginTime;private boolean enable;private boolean accountNonExpired;//账户未过期private boolean accountNonLocked;//账户未锁定private boolean credentialsNonExpired;//证书未过期//用户拥有的所有权限private List<GrantedAuthority> authorities=new ArrayList<GrantedAuthority>();//getter和setter方法@Overridepublic boolean isEnabled() {return true;}}

• 角色类

public class Role {private Integer id;private String roleName;private String roleDesc;	  
}

• 权限类

public class Permission {private Integer id;private String permName;private String permTag;
}

• UserMapper接口

public interface UserMapper {//查询当前用户User findByUsername(String username);//查询当前用户拥有的权限List<Permission> findPermissionByUsername(String username);
}

• UserMapper.xml

<?xml version="1.0" encoding="UTF-8" ?>
<!DOCTYPE mapperPUBLIC "-//mybatis.org//DTD Mapper 3.0//EN""http://mybatis.org/dtd/mybatis-3-mapper.dtd">
<mapper namespace="com.liu.mapper.UserMapper"><!--查询当前用户 --><select id="findByUsername" parameterType="String"resultType="com.liu.User">select * from sys_user where username= #{username}</select><!--查询当前用户所有权限 --><select id="findPermissionByUsername" parameterType="String"resultType="com.liu.Permission">SELECT sys_permission.*FROM sys_userinner JOIN sys_user_role on sys_user.id=sys_user_role.user_idinner JOIN sys_role_permission onsys_user_role.role_id=sys_role_permission.role_idinner JOIN sys_permission onsys_role_permission.permission_id=sys_permission.idwhere sys_user.username= #{username};</select>
</mapper>