**在很多业务场景中,在数据库中存在多张数据表,如果是同类型的用户表,那还好办但是更多的是怎么区分开用户分别认证鉴权呢?

这里笔者遇到了这样的问题,在网上找到的答案不是很详细,经过研究最终实现了;

那么我们可以定义多个过滤器链,总的来说过滤器都是按照顺序执行的,但是我们可以做的就是放行逻辑;
比如我们定义第一个过滤器放行/admin/**,第二个过滤器放行/app/** ,那么这两个过滤器就会完美错开,该怎么写逻辑就怎么写逻辑话不多说贴出配置逻辑:

package com.rubik.merchant.config;import com.rubik.merchant.security.admin.*;
import com.rubik.merchant.security.app.AppAuthTokenJWTFilter;
import com.rubik.merchant.security.app.AppUserAuthenticationProvider;
import com.rubik.merchant.security.app.AppUserLoginSuccessHandler;
import com.rubik.merchant.security.handler.UserAuthAccessDeniedHandler;
import com.rubik.merchant.security.handler.UserAuthenticationEntryPointHandler;
import com.rubik.merchant.security.handler.UserLoginFailureHandler;
import com.rubik.merchant.security.handler.UserLogoutSuccessHandler;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.core.annotation.Order;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.builders.WebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.config.http.SessionCreationPolicy;
import org.springframework.web.cors.CorsConfiguration;
import org.springframework.web.cors.CorsConfigurationSource;
import org.springframework.web.cors.UrlBasedCorsConfigurationSource;import java.util.Arrays;/*** @Auther: MR.rp* @Date: 2021/9/22 17:21* @Description:*/@Configuration
public class SecurityConfig  {@Configuration@Order(2) //这里的数字是指定优先级的,加上这个注解,数字越小优先级越高;static class SecurityConfig01 extends WebSecurityConfigurerAdapter{/*** 自定义登录成功处理器*/@Autowiredprivate AdminUserLoginSuccessHandler userLoginSuccessHandler;/*** 自定义登录失败处理器*/@Autowiredprivate UserLoginFailureHandler userLoginFailureHandler;/*** 自定义注销成功处理器*/@Autowiredprivate UserLogoutSuccessHandler userLogoutSuccessHandler;/*** 自定义暂无权限处理器*/@Autowiredprivate UserAuthAccessDeniedHandler userAuthAccessDeniedHandler;/*** 自定义未登录的处理器*/@Autowiredprivate UserAuthenticationEntryPointHandler userAuthenticationEntryPointHandler;/*** 自定义登录逻辑验证器*/@Autowiredprivate AdminUserAuthenticationProvider userAuthenticationProvider;@Overrideprotected void configure(HttpSecurity http) throws Exception {http.antMatcher("/admin/**").authorizeRequests()// 不进行权限验证的请求或资源(从配置文件中读取)
//                    .antMatchers(JWTConfig.antMatchers.split(",")).permitAll()// 其他的需要登陆后才能访问.anyRequest().authenticated().and()// 配置未登录自定义处理类.httpBasic().authenticationEntryPoint(userAuthenticationEntryPointHandler).and()// 配置登录地址.formLogin()
//                  .loginPage("/index.html").loginProcessingUrl("/admin/login")// 配置登录成功自定义处理类.successHandler(userLoginSuccessHandler)// 配置登录失败自定义处理类.failureHandler(userLoginFailureHandler).and()// 配置登出地址.logout().logoutUrl("/logout/admin")// 配置用户登出自定义处理类.logoutSuccessHandler(userLogoutSuccessHandler).and()// 配置没有权限自定义处理类.exceptionHandling().accessDeniedHandler(userAuthAccessDeniedHandler).and()// 开启跨域.cors().configurationSource(corsConfigurationSource()).and()// 取消跨站请求伪造防护.csrf().disable();// 基于Token不需要sessionhttp.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);// 禁用缓存http.headers().cacheControl();// 添加JWT过滤器http.addFilter(new AdminAuthTokenJWTFilter(authenticationManager()));}/*** 配置登录验证逻辑*/@Overrideprotected void configure(AuthenticationManagerBuilder auth){//这里可启用我们自己的登陆验证逻辑auth.authenticationProvider(userAuthenticationProvider);}@Beanpublic CorsConfigurationSource corsConfigurationSource(){CorsConfiguration corsConfiguration = new CorsConfiguration();corsConfiguration.setAllowedHeaders(Arrays.asList("*"));corsConfiguration.setAllowedMethods(Arrays.asList("*"));corsConfiguration.setAllowedOrigins(Arrays.asList("*"));corsConfiguration.setMaxAge(3600L);UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();source.registerCorsConfiguration("/**",corsConfiguration);return  source;}@Overridepublic void configure(WebSecurity web) throws Exception {web.ignoring().antMatchers("/swagger-ui.html","/webjars/**","/v2/**","/swagger-resources/**","/doc.html","/file/**","/images/**");}}@Configuration@Order(1)static  class SecurityConfig02 extends  WebSecurityConfigurerAdapter{/*** 自定义登录成功处理器*/@Autowiredprivate AppUserLoginSuccessHandler userLoginSuccessHandler;/*** 自定义登录失败处理器*/@Autowiredprivate UserLoginFailureHandler userLoginFailureHandler;/*** 自定义注销成功处理器*/@Autowiredprivate UserLogoutSuccessHandler userLogoutSuccessHandler;/*** 自定义暂无权限处理器*/@Autowiredprivate UserAuthAccessDeniedHandler userAuthAccessDeniedHandler;/*** 自定义未登录的处理器*/@Autowiredprivate UserAuthenticationEntryPointHandler userAuthenticationEntryPointHandler;/*** 自定义登录逻辑验证器*/@Autowiredprivate AppUserAuthenticationProvider userAuthenticationProvider;@Autowiredprivate  CorsConfigurationSource corsConfigurationSource;@Overrideprotected void configure(HttpSecurity http) throws Exception {http.antMatcher("/app/**").authorizeRequests()// 不进行权限验证的请求或资源(从配置文件中读取)// .antMatchers(JWTConfig.antMatchers.split(",")).permitAll()// 其他的需要登陆后才能访问.anyRequest().authenticated().and()// 配置未登录自定义处理类.httpBasic().authenticationEntryPoint(userAuthenticationEntryPointHandler).and()// 配置登录地址.formLogin()
//                .loginPage("/index.html").loginProcessingUrl("/app/login")// 配置登录成功自定义处理类.successHandler(userLoginSuccessHandler)// 配置登录失败自定义处理类.failureHandler(userLoginFailureHandler).and()// 配置登出地址.logout().logoutUrl("/app/logout")// 配置用户登出自定义处理类.logoutSuccessHandler(userLogoutSuccessHandler).and()// 配置没有权限自定义处理类.exceptionHandling().accessDeniedHandler(userAuthAccessDeniedHandler).and()// 开启跨域.cors().configurationSource(corsConfigurationSource).and()// 取消跨站请求伪造防护.csrf().disable();// 基于Token不需要sessionhttp.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);// 禁用缓存http.headers().cacheControl();// 添加JWT过滤器http.addFilter(new AppAuthTokenJWTFilter(authenticationManager()));}@Overridepublic void configure(WebSecurity web) throws Exception {web.ignoring().antMatchers("/swagger-ui.html","/webjars/**","/v2/**","/swagger-resources/**","/doc.html","/file/**","/images/**");}/*** 配置登录验证逻辑*/@Overrideprotected void configure(AuthenticationManagerBuilder auth){auth.authenticationProvider(userAuthenticationProvider);}}}

这里写了很多自定义的逻辑,需要自己实现下,大体的流程是这样,有什么更好的办法也可以讨论和学习一下哦