SpringBoot+ES项目：7.业务开发 - 后台登录功能实现（Spring Security）

旧城等待， 2021-10-29 16:36 439阅读 0赞

**1. 实现目标**  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2x0aGlyZG9uZWw_size_16_color_FFFFFF_t_70]

**2. admin控制器的开发**

package com.xunwu.web.controller.admin;
    
    @Controller
    public class AdminController {
    
        /**
         * 后台管理中心
         * @return
         */
        @GetMapping("/admin/center")
        public String adminCenterPage() {
            return "admin/center";
        }
    
        /**
         * 欢迎页
         * @return
         */
        @GetMapping("/admin/welcome")
        public String welcomePage() {
            return "admin/welcome";
        }
    
        /**
         * 管理员登录页
         * @return
         */
        @GetMapping("/admin/login")
        public String adminLoginPage() {
            return "admin/login";
        }
    
        /**
         * 房源列表页
         * @return
         */
        @GetMapping("admin/house/list")
        public String houseListPage() {
            return "admin/house-list";
        }
    }

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2x0aGlyZG9uZWw_size_16_color_FFFFFF_t_70 1]

**3. 权限控制**

WebMvcConfig增加Security方言的支持

// 支持SpringSecurity方言
            SpringSecurityDialect securityDialect = new SpringSecurityDialect();
            templateEngine.addDialect(securityDialect);

pom.xml增加依赖包

<dependency>
                <groupId>org.thymeleaf.extras</groupId>
                <artifactId>thymeleaf-extras-springsecurity4</artifactId>
                <version>${thymeleaf-extras-springsecurity4.version}</version>
            </dependency>

新建WebSecurityConfig

package com.xunwu.config;
    
    @EnableWebSecurity
    @EnableGlobalMethodSecurity
    public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
    
        /**
         * HTTP权限控制
         * @param http
         * @throws Exception
         */
        @Override
        protected void configure(HttpSecurity http) throws Exception {
    
            // 资源访问权限
            http.authorizeRequests()
                    .antMatchers("/admin/login").permitAll() // 管理员登录入口
                    .antMatchers("/static/**").permitAll() // 静态资源
                    .antMatchers("/user/login").permitAll() // 用户登录入口
                    .antMatchers("/admin/**").hasRole("ADMIN")
                    .antMatchers("/user/**").hasAnyRole("ADMIN", "USER")
                    .antMatchers("/api/user/**").hasAnyRole("ADMIN",
                    "USER")
                    .and()
                    .formLogin()
                    .loginProcessingUrl("/login") // 配置角色登录处理入口（spring帮助生成一个登陆入口）
                    .and()
                    .logout()
                    .logoutUrl("/logout")
                    .logoutSuccessUrl("/logout/page")
                    .deleteCookies("JSESSIONID")
                    .invalidateHttpSession(true)
                    .and()
                    .exceptionHandling()
                    .accessDeniedPage("/403");
    
            http.csrf().disable();//关闭csrf防御
            http.headers().frameOptions().sameOrigin();//开启同源策略
        }
        /**
         * 自定义认证策略
         * AuthenticationManagerBuilder只能注入一个
         */
        @Autowired
        public void configGlobal(AuthenticationManagerBuilder auth) throws Exception {
    //        auth.authenticationProvider(authProvider()).eraseCredentials(true);
            auth.inMemoryAuthentication().withUser("admin").password("admin").roles("ADMIN").and();
        }
    }

这句是先用内存中的临时密码做验证进行**测试Security**

auth.inMemoryAuthentication().withUser("admin").password("admin").roles("ADMIN").and();

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2x0aGlyZG9uZWw_size_16_color_FFFFFF_t_70 2]

WebSecurityConfigurerAdapter  
https://blog.csdn.net/oblily/article/details/87803044  
Web Security  
https://blog.csdn.net/qq\_40800349/article/details/79856254  
@service  
https://www.jianshu.com/p/034fd482c669

**4. 真正用户名密码验证**

文件整体结构  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2x0aGlyZG9uZWw_size_16_color_FFFFFF_t_70 3]  
整体依赖关系  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2x0aGlyZG9uZWw_size_16_color_FFFFFF_t_70 4]

在User实体类中实现UserDetails接口

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2x0aGlyZG9uZWw_size_16_color_FFFFFF_t_70 5]

//设置一个Transient透明的（数据库中没有）的认证列表（存放从roles表获取来的相关信息）
     @Transient
        private List<GrantedAuthority> authorityList;
    
        public List<GrantedAuthority> getAuthorityList() {
            return authorityList;
        }
    
        public void setAuthorityList(List<GrantedAuthority> authorityList) {
            this.authorityList = authorityList;
        }
    	//public class User implements UserDetails 下面的四个认证先写为true，是实现UserDetails得来的
    
        @Override
        public Collection<? extends GrantedAuthority> getAuthorities() {
            return this.authorityList;
        }
        @Override
        public boolean isAccountNonExpired() {
            return true;
        }
    
        @Override
        public boolean isAccountNonLocked() {
            return true;
        }
    
        @Override
        public boolean isCredentialsNonExpired() {
            return true;
        }
    
        @Override
        public boolean isEnabled() {
            return true;
        }

UserDetails  
https://www.jianshu.com/p/b025ca9824a8

新建一个roles entity类

package com.xunwu.entity;
    
    
    @Entity
    @Table(name = "role")
    public class Role {
        @Id
        @GeneratedValue(strategy = GenerationType.IDENTITY)
        private Long id;
        @Column(name = "user_id")
        private Long userId;
        private String name;
    
        public Long getId() {
            return id;
        }
    
        public void setId(Long id) {
            this.id = id;
        }
    
        public Long getUserId() {
            return userId;
        }
    
        public void setUserId(Long userId) {
            this.userId = userId;
        }
    
        public String getName() {
            return name;
        }
    
        public void setName(String name) {
            this.name = name;
        }
    }

实现一个RoleRepository 类

package com.xunwu.repository;
    
    /**
     * 角色数据DAO
     */
    public interface RoleRepository extends CrudRepository<Role, Long> {
        List<Role> findRolesByUserId(Long userId);
    }

新建一个用户服务类接口 IUserService.interface  
为了返回用户信息

package com.xunwu.service;
    import com.xunwu.entity.User;
    
    /**
     * 用户服务
     */
    public interface IUserService {
        User findUserByName(String userName);
    
    }

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2x0aGlyZG9uZWw_size_16_color_FFFFFF_t_70 6]  
新建一个用户服务类UserServiceImpl.class

package com.xunwu.service.user;
    
    @Service
    public class UserServiceImpl implements IUserService {
        @Autowired
        private UserRepository userRepository;
    
        private final Md5PasswordEncoder passwordEncoder = new Md5PasswordEncoder();
    	
    	//实现通过用户名搜索用户信息（用户自身信息+权限信息）如果异常便抛出
        @Override
        public User findUserByName(String userName) {
            User user = userRepository.findByName(userName);
    
            if (user == null) {
                return null;
            }
    
            List<Role> roles = roleRepository.findRolesByUserId(user.getId());
            if (roles == null || roles.isEmpty()) {
                throw new DisabledException("权限非法");
            }
    
            List<GrantedAuthority> authorities = new ArrayList<>();
            roles.forEach(role -> authorities.add(new SimpleGrantedAuthority("ROLE_" + role.getName())));
            user.setAuthorityList(authorities);
            return user;
        }
    }

实现AuthProvider类（新建security包）

/**
     * 自定义认证实现
     */
    public class AuthProvider implements AuthenticationProvider {
        @Autowired
        private IUserService userService;
    
        private final Md5PasswordEncoder passwordEncoder = new Md5PasswordEncoder();
    	//Authentication（封装用户名密码的对象）
        @Override
        public Authentication authenticate(Authentication authentication) throws AuthenticationException {
        	//获取用户输入的用户名密码
            String userName = authentication.getName();
            String inputPassword = (String) authentication.getCredentials();
    
            User user = userService.findUserByName(userName);
            if (user == null) {
            	//没有这个用户跑出异常
                throw new AuthenticationCredentialsNotFoundException("authError");
            }
    		//这里是与md5加密后的密码比较
            if (this.passwordEncoder.isPasswordValid(user.getPassword(), inputPassword, user.getId())) {
            //user.getAuthorities()这个方法未实现，下面通过role控制权限表实现一下
                return new UsernamePasswordAuthenticationToken(user, null, user.getAuthorities());
    
            }
    
            throw new BadCredentialsException("authError");
    
        }
    
        @Override
        public boolean supports(Class<?> authentication) {
            return true;
        }
    }

最后 在WebSecurityConfig自定义一下登录成功的策略

/**
         * 自定义认证策略
         */
    	@Autowired
        public void configGlobal(AuthenticationManagerBuilder auth) throws Exception {
            auth.authenticationProvider(authProvider()).eraseCredentials(true);
        }
    	//前面创建的认证类作为一个组件放入WebSecurity中作为一个认证策略
        @Bean
        public AuthProvider authProvider() {
            return new AuthProvider();
        }

AuthenticationProvider（authProvider继承的类）  
https://blog.csdn.net/lifeifei2010/article/details/78787558  
Authentication（封装用户名密码的对象）  
https://www.cnblogs.com/shiyu404/p/6530894.html  
Spring Boot2.0使用Spring Security  
https://www.cnblogs.com/wtzbk/p/9387859.html

[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2x0aGlyZG9uZWw_size_16_color_FFFFFF_t_70]: /images/20211029/15ecc092306a4cdf94e87a2f64000955.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2x0aGlyZG9uZWw_size_16_color_FFFFFF_t_70 1]: /images/20211029/37092bee904f4e4aba372788b54f87a7.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2x0aGlyZG9uZWw_size_16_color_FFFFFF_t_70 2]: /images/20211029/40f63d7780f14b90a0f21a58ea1e1bd9.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2x0aGlyZG9uZWw_size_16_color_FFFFFF_t_70 3]: /images/20211029/dd978235617f447b8417e99fca568a46.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2x0aGlyZG9uZWw_size_16_color_FFFFFF_t_70 4]: /images/20211029/8daf9d73a28547f6948cc630a2f79fb1.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2x0aGlyZG9uZWw_size_16_color_FFFFFF_t_70 5]: /images/20211029/3f0ef531be1f4d9bb827615f855bac2b.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2x0aGlyZG9uZWw_size_16_color_FFFFFF_t_70 6]: /images/20211029/60063dea09404204a04f23a6e995f6a2.png