springboot+Security

朱雀 2022-01-12 14:23 485阅读 0赞

### 项目背景：JDK1.8，springboot2.1.4 ###

### 一、创建一个简单的maven工程 ###

### 二、pom文件引入jar包依赖 ###

<parent>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-parent</artifactId>
            <version>2.1.4.RELEASE</version>
        </parent>
    dependencies>
            <dependency>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-starter-web</artifactId>
            </dependency>
            <dependency>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-starter-security</artifactId>
            </dependency>
        </dependencies>

### 三、分别创建简单的用户实体类User.java和角色枚举类ROLE.java ###

package com.hegret.entity;
    
    import java.io.Serializable;
    
    public class User implements Serializable {
    
    	private static final long serialVersionUID = 1L;
    	private ROLE role;
    	private String userName;
    	private String password;
    	
    	public User() {
    		super();
    	}
    
    	public User(ROLE role, String userName, String password) {
    		super();
    		this.role = role;
    		this.userName = userName;
    		this.password = password;
    	}
    
    	public ROLE getRole() {
    		return role;
    	}
    
    	public void setRole(ROLE role) {
    		this.role = role;
    	}
    
    	public String getUserName() {
    		return userName;
    	}
    
    	public void setUserName(String userName) {
    		this.userName = userName;
    	}
    
    	public String getPassword() {
    		return password;
    	}
    
    	public void setPassword(String password) {
    		this.password = password;
    	}
    
    	@Override
    	public String toString() {
    		return "User [role=" + role + ", userName=" + userName + ", password=" + password + "]";
    	}
    
    }

package com.hegret.entity;
    
    public enum ROLE {
    	
    	ADMIN("admin"), USER("user"), VIP("vip"), DBA("dba");
    	
    	private String name;
    	
    	public String getName() {
    		return name;
    	}
    
    	private ROLE(String name) {
    		this.name = name;
    	}
    
    }

### 四、创建自定义CustomUserDetailsService.java类 ###

package com.hegret.custom.service;
    
    import java.util.ArrayList;
    import java.util.Collection;
    
    import org.springframework.beans.factory.annotation.Autowired;
    import org.springframework.security.authentication.DisabledException;
    import org.springframework.security.core.GrantedAuthority;
    import org.springframework.security.core.authority.SimpleGrantedAuthority;
    import org.springframework.security.core.userdetails.User;
    import org.springframework.security.core.userdetails.UserDetails;
    import org.springframework.security.core.userdetails.UserDetailsService;
    import org.springframework.security.core.userdetails.UsernameNotFoundException;
    import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
    
    import com.hegret.entity.ROLE;
    
    public class CustomUserDetailsService implements UserDetailsService {
    	
    	@Autowired
    	private BCryptPasswordEncoder passwordEncoder;
    
        @Override
        public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
            com.hegret.entity.User user = new com.hegret.entity.User(ROLE.VIP, "admin", "1234");
            if (user == null || !user.getUserName().equals(username)) {
            	// 如果抛出UsernameNotFoundException，异常会被Security捕捉并替换掉
                throw new DisabledException("userName :" + username + " not found");
            }
            Collection<GrantedAuthority> authorities = new ArrayList<>();
            System.out.println("name:" + user.getRole().name() + ",getName:" + user.getRole().getName());
            System.out.println("CustomUserDetailsService----BCryptPasswordEncoder" + passwordEncoder);
            /*
    	         * 设置权限，与http.authorizeRequests().antMatchers("/vip/**").hasAuthority("VIP")中的hasAuthority("VIP")
    	         * 以及@PreAuthorize注解中的hasAuthority('VIP')、hasAnyAuthority('VIP')对应
    		 * 不与http.authorizeRequests().antMatchers("/vip/**").hasRole("VIP")中的hasRole("VIP")、
    		 * http.authorizeRequests().antMatchers("/vip/**").hasAuthority("ROLE_VIP")中的hasAuthority("ROLE_VIP")
    		 * 以及@PreAuthorize注解中的hasRole('VIP'))、hasRole('ROLE_VIP')、hasAnyRole('VIP')、 hasAnyRole('ROLE_VIP')
    		 * hasAuthority('ROLE_VIP')、hasAnyAuthority('ROLE_USER','ROLE_VIP')对应，
    		 */
            authorities.add(new SimpleGrantedAuthority(user.getRole().name()));
    		/*
    		 * 设置角色，与http.authorizeRequests().antMatchers("/vip/**").hasRole("VIP")中的hasRole("VIP")、
    		 * http.authorizeRequests().antMatchers("/vip/**").hasAuthority("ROLE_VIP")中的hasAuthority("ROLE_VIP")
    		 * 以及@PreAuthorize注解中的hasRole('VIP'))、hasRole('ROLE_VIP')、hasAnyRole('VIP')、 hasAnyRole('ROLE_VIP')
    		 * hasAuthority('ROLE_VIP')、hasAnyAuthority('ROLE_USER','ROLE_VIP')对应，
    		 * 不与http.authorizeRequests().antMatchers("/vip/**").hasAuthority("VIP")中的hasAuthority("VIP")
    		 * 以及@PreAuthorize注解中的hasAuthority('VIP')、hasAnyAuthority('VIP')对应
    		 */
            authorities.add(new SimpleGrantedAuthority("ROLE_" + user.getRole().name()));
            return new User(username, passwordEncoder.encode("1234"), authorities);
        }
    
    }

### 五、自定义bean对象 ###

package com.hegret.custom.beans;
    
    import org.springframework.context.annotation.Bean;
    import org.springframework.context.annotation.Configuration;
    import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
    
    
    @Configuration
    public class CustomBeans {
    	
    	@Bean
        public BCryptPasswordEncoder passwordEncoder() {
    		System.out.println("CustomBeans----BCryptPasswordEncoder======");
        	return new BCryptPasswordEncoder();
        }
    	
    }

### 六、创建自定义容器类CustomContainer.java ###

package com.hegret.custom.container;
    
    import org.springframework.boot.web.server.ErrorPage;
    import org.springframework.boot.web.server.WebServerFactoryCustomizer;
    import org.springframework.boot.web.servlet.server.ConfigurableServletWebServerFactory;
    import org.springframework.http.HttpStatus;
    import org.springframework.stereotype.Component;
    
    @Component
    public class CustomContainer implements WebServerFactoryCustomizer<ConfigurableServletWebServerFactory> {
    
    	public void customize(ConfigurableServletWebServerFactory factory) {
    //      factory.setPort(8080);
    //      factory.setContextPath("");
    		factory.addErrorPages(new ErrorPage(HttpStatus.FOUND, "/302"), 
    				new ErrorPage(HttpStatus.FORBIDDEN, "/403"),
    				new ErrorPage(HttpStatus.NOT_FOUND, "/404"),
    				new ErrorPage(HttpStatus.INTERNAL_SERVER_ERROR, "/500"));
    	}
    
    //	@Bean
    //	public WebServerFactoryCustomizer<ConfigurableServletWebServerFactory> webServerFactoryCustomizer() {
    //		return (factory) -> factory.addErrorPages(new ErrorPage(HttpStatus.FORBIDDEN, "/403"), 
    //				new ErrorPage(HttpStatus.NOT_FOUND, "/404"));
    //	}
    }

### 七、创建自定义安全配置类WebSecurityConfig.java ###

package com.hegret.custom.config;
    
    import org.springframework.context.annotation.Bean;
    import org.springframework.context.annotation.Configuration;
    import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
    import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
    import org.springframework.security.config.annotation.web.builders.HttpSecurity;
    //import org.springframework.security.config.annotation.web.builders.WebSecurity;
    import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
    import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
    import org.springframework.security.core.userdetails.UserDetailsService;
    
    import com.hegret.custom.service.CustomUserDetailsService;
    
    /**
     * 注解 @EnableGlobalMethodSecurity(prePostEnabled = true) 开启全局方法安全
     * 配合 @PreAuthorize , @PostAuthorize , @Secured 和 Spring EL表达式使用
     * @author zsx
     *
     */
    @Configuration
    @EnableWebSecurity
    @EnableGlobalMethodSecurity(prePostEnabled = true, securedEnabled = true, jsr250Enabled = true)
    public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
    	
    	@Override
    	protected void configure(HttpSecurity http) throws Exception {
            http
    	        .authorizeRequests()
    	            .antMatchers("/", "/home").permitAll()
    	            .antMatchers("/admin/**").hasRole("ADMIN") //设置访问角色
    	            .antMatchers("/vip/**").hasAuthority("VIP") //设置访问权限
    	            .anyRequest().authenticated()
    	            .and()
    	        .formLogin()
    //	            .loginPage("/login") //设置自定义登陆页
                    .usernameParameter("username")  //自定义用户名name值
                    .defaultSuccessUrl("/userRole")
                    .passwordParameter("password")  //自定义密码name值
                    .failureUrl("/login?error") //登录失败则重定向到此URl
                    .permitAll() //登录页都可以访问
                    .and()
                .logout()//开启自动配置的注销功能
                    .logoutSuccessUrl("/")//注销成功后返回到页面并清空Session
                    .and()
                .rememberMe()
                    .rememberMeParameter("remember")//自定义rememberMe的name值，默认remember-Me
                    .tokenValiditySeconds(86400);//记住我的时间/秒
    	}
    	
    	@Override
    	@Bean
    	public UserDetailsService userDetailsService() {
    		 return new CustomUserDetailsService();
    	}
    	
    	
    	/**
    	 * 定义认证规则
    	 */
    	@Override
    	protected void configure(AuthenticationManagerBuilder auth) throws Exception {
    		// 保存用户信息到内存中
    //		auth.inMemoryAuthentication()
    //			.withUser("root")
    //			.password(passwordEncoder.encode("1234")).roles("ROLE_USER", "ROLE_VIP").authorities("ADMIN");
    //		auth.authenticationProvider(new CustomAuthenticationProvider());
    		auth.userDetailsService(userDetailsService());
    	}
    	
    //	@Override
    //	public void configure(WebSecurity web) throws Exception {
    //		//忽略静态资源
    //		web.ignoring().antMatchers("/resources/templates/**");
    //	}
    
    }

### 八、分别创建控制器类AuthController.java、VipController.java、AdminController.java ###

package com.hegret.controller;
    
    import org.springframework.security.access.prepost.PreAuthorize;
    import org.springframework.web.bind.annotation.GetMapping;
    import org.springframework.web.bind.annotation.RestController;
    
    @RestController
    public class AuthController {
    	
    	@GetMapping({"", "/home"})
    	public String home() {
    		return "home";
    	}
    
    	@GetMapping("/adminRole")
    	@PreAuthorize("hasAuthority('ROLE_ADMIN')")
    	public String adminRole() {
    		return "adminRole";
    	}
    
    	@GetMapping("/userRole")
    	@PreAuthorize("hasAnyRole('ADMIN', 'USER', 'VIP')")
    	public String userRole() {
    		return "userRole";
    	}
    	
    	@GetMapping("/dbaRole")
    	@PreAuthorize("hasRole('DBA')")
    	public String dbaRole() {
    		return "dbaRole";
    	}
    	
    	@GetMapping("/vipRole")
    	@PreAuthorize("hasAnyAuthority('ROLE_USER','ROLE_VIP')")
    	public String vipRole() {
    		return "vipRole";
    	}
    	
    	@GetMapping("/logout")
    	public String logout() {
    		return "redirect:/login?logout";
    	}
    
    	@GetMapping("/403")
    	public String forbidden() {
    		return "403";
    	}
    	
    	@GetMapping("/404")
    	public String notFound() {
    		return "404";
    	}
    	
    	@GetMapping("/500")
    	public String internalServerError() {
    		return "500";
    	}
    }

package com.hegret.controller;
    
    import org.springframework.web.bind.annotation.GetMapping;
    import org.springframework.web.bind.annotation.RequestMapping;
    import org.springframework.web.bind.annotation.RestController;
    
    @RestController
    @RequestMapping("/vip")
    public class VipController {
    	
    	@GetMapping("/info")
    	public String info() {
    		return "VIP Info";
    	}
    
    }

package com.hegret.controller;
    
    import org.springframework.web.bind.annotation.GetMapping;
    import org.springframework.web.bind.annotation.RequestMapping;
    import org.springframework.web.bind.annotation.RestController;
    
    @RestController
    @RequestMapping("/admin")
    public class AdminController {
    	
    	@GetMapping("/manager")
    	public String manager() {
    		return "admin manager";
    	}
    
    }

### 九、创建引导类Security02Application.java ###

package com.hegret;
    
    import org.springframework.boot.SpringApplication;
    import org.springframework.boot.autoconfigure.SpringBootApplication;
    
    @SpringBootApplication
    public class Security02Application {
    	
    	public static void main(String[] args) {
            SpringApplication.run(Security02Application.class, args);
        }
    }

### 十、启动引导类 ###

.   ____          _            __ _ _
     /\\ / ___'_ __ _ _(_)_ __  __ _ \ \ \ \
    ( ( )\___ | '_ | '_| | '_ \/ _` | \ \ \ \
     \\/  ___)| |_)| | | | | || (_| |  ) ) ) )
      '  |____| .__|_| |_|_| |_\__, | / / / /
     =========|_|==============|___/=/_/_/_/
     :: Spring Boot ::        (v2.1.4.RELEASE)
    
    2019-06-17 23:21:22.795  INFO 8608 --- [           main] com.hegret.Security02Application         : Starting Security02Application on zsx with PID 8608 (F:\workspace4.11\spring-boot-security02\target\classes started by admin in F:\workspace4.11\spring-boot-security02)
    2019-06-17 23:21:22.798  INFO 8608 --- [           main] com.hegret.Security02Application         : No active profile set, falling back to default profiles: default
    2019-06-17 23:21:23.765  INFO 8608 --- [           main] o.s.b.w.embedded.tomcat.TomcatWebServer  : Tomcat initialized with port(s): 8080 (http)
    2019-06-17 23:21:23.784  INFO 8608 --- [           main] o.apache.catalina.core.StandardService   : Starting service [Tomcat]
    2019-06-17 23:21:23.784  INFO 8608 --- [           main] org.apache.catalina.core.StandardEngine  : Starting Servlet engine: [Apache Tomcat/9.0.17]
    2019-06-17 23:21:23.790  INFO 8608 --- [           main] o.a.catalina.core.AprLifecycleListener   : An older version [1.2.16] of the APR based Apache Tomcat Native library is installed, while Tomcat recommends a minimum version of [1.2.21]
    2019-06-17 23:21:23.790  INFO 8608 --- [           main] o.a.catalina.core.AprLifecycleListener   : Loaded APR based Apache Tomcat Native library [1.2.16] using APR version [1.6.3].
    2019-06-17 23:21:23.790  INFO 8608 --- [           main] o.a.catalina.core.AprLifecycleListener   : APR capabilities: IPv6 [true], sendfile [true], accept filters [false], random [true].
    2019-06-17 23:21:23.790  INFO 8608 --- [           main] o.a.catalina.core.AprLifecycleListener   : APR/OpenSSL configuration: useAprConnector [false], useOpenSSL [true]
    2019-06-17 23:21:24.828  INFO 8608 --- [           main] o.a.catalina.core.AprLifecycleListener   : OpenSSL successfully initialized [OpenSSL 1.0.2m  2 Nov 2017]
    2019-06-17 23:21:24.917  INFO 8608 --- [           main] o.a.c.c.C.[Tomcat].[localhost].[/]       : Initializing Spring embedded WebApplicationContext
    2019-06-17 23:21:24.918  INFO 8608 --- [           main] o.s.web.context.ContextLoader            : Root WebApplicationContext: initialization completed in 2091 ms
    CustomBeans----BCryptPasswordEncoder======
    2019-06-17 23:21:25.221  INFO 8608 --- [           main] o.s.s.web.DefaultSecurityFilterChain     : Creating filter chain: any request, [org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter@51745f40, org.springframework.security.web.context.SecurityContextPersistenceFilter@ca66933, org.springframework.security.web.header.HeaderWriterFilter@3f4f9acd, org.springframework.security.web.csrf.CsrfFilter@1144a55a, org.springframework.security.web.authentication.logout.LogoutFilter@6b04acb2, org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter@77bb0ab5, org.springframework.security.web.authentication.ui.DefaultLoginPageGeneratingFilter@408a247c, org.springframework.security.web.authentication.ui.DefaultLogoutPageGeneratingFilter@45673f68, org.springframework.security.web.savedrequest.RequestCacheAwareFilter@4fa06f52, org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter@61942c1, org.springframework.security.web.authentication.rememberme.RememberMeAuthenticationFilter@7bc9e6ab, org.springframework.security.web.authentication.AnonymousAuthenticationFilter@27abb83e, org.springframework.security.web.session.SessionManagementFilter@4bf324f9, org.springframework.security.web.access.ExceptionTranslationFilter@7fae4d4a, org.springframework.security.web.access.intercept.FilterSecurityInterceptor@294bdeb4]
    2019-06-17 23:21:25.367  INFO 8608 --- [           main] o.s.s.concurrent.ThreadPoolTaskExecutor  : Initializing ExecutorService 'applicationTaskExecutor'
    2019-06-17 23:21:25.503  INFO 8608 --- [           main] o.s.b.a.w.s.WelcomePageHandlerMapping    : Adding welcome page template: index
    2019-06-17 23:21:25.595  INFO 8608 --- [           main] o.s.b.w.embedded.tomcat.TomcatWebServer  : Tomcat started on port(s): 8080 (http) with context path ''
    2019-06-17 23:21:25.598  INFO 8608 --- [           main] com.hegret.Security02Application         : Started Security02Application in 3.06 seconds (JVM running for 3.86)

### 十一、打开浏览器，输入请求链接[http://localhost:8080/login][http_localhost_8080_login]，进入系统默认登录页 ###

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3pzeDE4MjczMTE3MDAz_size_16_color_FFFFFF_t_70][]

### 十二、输入前面设置的账号admin，密码1234（角色为VIP）进行登录 ###

**1.请求链接[http://localhost:8080/userRole][http_localhost_8080_userRole]**

![20190617232910367.png][]

**2.请求链接[http://localhost:8080/vipRole][http_localhost_8080_vipRole]**

![20190617233530226.png][]

**3.请求链接[http://localhost:8080/adminRole][http_localhost_8080_adminRole]**

![20190617233629408.png][]

**4.请求链接[http://localhost:8080/dbaRole][http_localhost_8080_dbaRole]**

![20190617234653238.png][]

**5.请求链接[http://localhost:8080/vip/info][http_localhost_8080_dbaRole]**

![20190617233850418.png][]

**6.请求链接[http://localhost:8080/admin/manager][http_localhost_8080_admin_manager]**

![20190617234810989.png][]

**从以上结果可以看出权限控制成功**

[http_localhost_8080_login]: http://localhost:8080/login
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3pzeDE4MjczMTE3MDAz_size_16_color_FFFFFF_t_70]: /images/20220112/683c75967cad4bc395b64e0aa63cf9d4.png
[http_localhost_8080_userRole]: http://localhost:8080/userRole
[20190617232910367.png]: /images/20220112/45a1d509880b4b6e9be1fb4578549e7f.png
[http_localhost_8080_vipRole]: http://localhost:8080/vipRole
[20190617233530226.png]: /images/20220112/069f84c1bff54edd928b23468f683155.png
[http_localhost_8080_adminRole]: http://localhost:8080/adminRole
[20190617233629408.png]: /images/20220112/ece8a2eebe0f4c1fae2ba4a7c0110452.png
[http_localhost_8080_dbaRole]: http://localhost:8080/vip/info
[20190617234653238.png]: /images/20220112/6b1f0161a35e4ce18c8a1d12630c474e.png
[20190617233850418.png]: /images/20220112/c836b4bceb5c4ca3beb0f78e30923874.png
[http_localhost_8080_admin_manager]: http://localhost:8080/admin/manager
[20190617234810989.png]: /images/20220112/210c473d1f564742bd942c0ad380fc18.png