SpringBoot + Spring Security + Thymeleaf 实现权限管理登录

末蓝、 2022-03-27 10:54 448阅读 0赞

这个是一个后台管理系统的实现方式。

SpringBoot + Spring Security + Thymeleaf 实现权限管理登录。 这里没有使用前后端分离。 主要是

## **1、数据库** ##

用户表、角色表、这里都不写了。 如果你知道自己在做什么你就应该知道怎么搞。

## **2、Maven 依赖** ##

<!– Thymeleaf –>
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-thymeleaf</artifactId>
    </dependency>
    
    <!– Spring Security 依赖 –>
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-security</artifactId>
    </dependency>
    <dependency>
        <groupId>org.thymeleaf.extras</groupId>
        <artifactId>thymeleaf-extras-springsecurity5</artifactId>
        <version>3.0.4.RELEASE</version>
    </dependency>

这里主要是Thymeleaf、Spring Security 的依赖, SpringBoot 的依赖自己去加吧、  
注意：这里使用的是thymeleaf-extras-springsecurity5. 这个和4还是有一些区别。注意别踩坑；

## 3、定义一个鉴权对象（UserDetailsImpl ），实现UserDetails预定义的接口 ##

这里UserDetailsImpl 实现UserDetails接口。 用于自定义UserDetailsService验证接口的返回值（如：public UserDetails loadUserByUsername(String userName)） 。 这里可以自定义一些需要接受和保存的信息。

import org.springframework.security.core.GrantedAuthority;
    import org.springframework.security.core.authority.SimpleGrantedAuthority;
    import org.springframework.security.core.userdetails.UserDetails;
    
    import java.io.Serializable;
    import java.util.Collection;
    import java.util.List;
    
    /**
     * @Auther: shiguanghui
     * @Date: 2019/01/13 10:42
     * @ClassName: UserDetailsImpl
     * @Description:  定义UserDetails的鉴权对象。 需要实现UserDetails的基本信息
     */
    public class UserDetailsImpl implements UserDetails, Serializable {
        private static final long serialVersionUID = 7171722954972237961L;
    
        private String username;
        private String password;
        private List<SimpleGrantedAuthority> roles;
        private Collection<? extends GrantedAuthority> authorities;
    
        public UserDetailsImpl() {
        }
        public UserDetailsImpl(String username, List<SimpleGrantedAuthority> roles, Collection<? extends GrantedAuthority> authorities) {
            this.username = username;
            this.roles = roles;
            this.authorities = authorities;
        }
    
        @Override
        public Collection<? extends GrantedAuthority> getAuthorities() {
            return this.authorities;
        }
    
        public void setAuthorities(Collection<? extends GrantedAuthority> authorities) {
            this.authorities = authorities;
        }
    
        @Override
        public String getPassword() { // 最重点Ⅰ
            return this.password;
        }
    
        @Override
        public String getUsername() { // 最重点Ⅱ
            return this.username;
        }
    
        public void setUsername(String username) {
            this.username = username;
        }
    
        public void setPassword(String password) {
            this.password = password;
        }
    
        //账号是否过期
        @Override
        public boolean isAccountNonExpired() {
            return true;
        }
    
        //账号是否锁定
        @Override
        public boolean isAccountNonLocked() {
            return true;
        }
    
        //账号凭证是否未过期
        @Override
        public boolean isCredentialsNonExpired() {
            return true;
        }
    
        @Override
        public boolean isEnabled() {
            return true;
        }
    
        public List<SimpleGrantedAuthority> getRoles() {
            return roles;
        }
    
        public void setRoles(List<SimpleGrantedAuthority> roles) {
            this.roles = roles;
        }
    }

## 4、实现鉴权服务（UserDetailsServiceImpl） ##

package com.weipaiku.security.service;
    
    import com.weipaiku.model.SysUserInfo;
    import com.weipaiku.sys.service.SysUserInfoService;
    import org.springframework.beans.factory.annotation.Autowired;
    import org.springframework.security.core.userdetails.UserDetails;
    import org.springframework.security.core.userdetails.UserDetailsService;
    import org.springframework.security.core.userdetails.UsernameNotFoundException;
    import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
    import org.springframework.stereotype.Component;
    
    /**
     * @Auther: shiguanghui
     * @Date: 2018/01/13 10:15
     * @ClassName: UserDetailsServiceImpl
     * @Description:用户认证、权限。
     */
    @Component
    public class UserDetailsServiceImpl implements UserDetailsService {
    
        @Autowired
        private SysUserInfoService sysUserInfoService;
    
        /**
         * 验证通过
         * @param userName
         * @return
         * @throws UsernameNotFoundException
         */
        @Override
        public UserDetails loadUserByUsername(String userName) throws UsernameNotFoundException {
    
            BCryptPasswordEncoder bCryptPasswordEncoder = new BCryptPasswordEncoder();
            UserDetailsImpl uao = new UserDetailsImpl();
            //通过userName查询用户
            SysUserInfo user = sysUserInfoService.selectByPrimaryKey(userName);
            if(user == null){
                throw new UsernameNotFoundException("该用户不存在");
            }
            uao.setUsername(user.getUsername());
            uao.setPassword(user.getPassword());       
            return uao;
        }
    }

## 6、spring security 配置 ##

package com.weipaiku.security;
    
    import com.weipaiku.Constants;
    import com.weipaiku.security.service.UserDetailsServiceImpl;
    import org.springframework.beans.factory.annotation.Autowired;
    import org.springframework.context.annotation.Bean;
    import org.springframework.context.annotation.Configuration;
    import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
    import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
    import org.springframework.security.config.annotation.web.builders.HttpSecurity;
    import org.springframework.security.config.annotation.web.builders.WebSecurity;
    import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
    import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
    import org.springframework.security.core.session.SessionRegistry;
    import org.springframework.security.core.session.SessionRegistryImpl;
    import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
    import org.springframework.security.crypto.password.PasswordEncoder;
    
    /**
     * @Auther: shiguanghui
     * @Date: 2019/1/13 12:21
     * @ClassName: WebSecurityConfig
     * @Description: TODO
     */
    @Configuration
    @EnableWebSecurity
    @EnableGlobalMethodSecurity(prePostEnabled = true)
    public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
    
        /**
         * 需要放行的URL
         */
        private static final String[] AUTH_WHITELIST = {
                "/v2/api-docs", "/swagger-resources","/swagger-resources/**","/swagger-ui.html","/configuration/ui","/configuration/security",
                "/webjars/**",
                "/druid/**",
                "/login",
                "/",
                "/test"
        };
    
        /**
         * 需要admin权限的授权的URLS
         */
        private static final String[] MANAGE_AUTHLIST = {"/manage/**"};
    
        @Autowired
        SessionRegistry sessionRegistry;
    
        @Autowired
        UserDetailsServiceImpl userDetailsServiceImpl;
    
        @Bean
        public SessionRegistry getSessionRegistry() {
            return new SessionRegistryImpl();
        }
    
        /**
         * 认证信息管理
         * 使用：UserDetails loadUserByUsername(String userName) 模式的认证
         * @param auth
         * @throws Exception
         */
        @Autowired
        public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
            PasswordEncoder passwordEncoder = new BCryptPasswordEncoder();
            auth.eraseCredentials(false).userDetailsService(userDetailsServiceImpl).passwordEncoder(passwordEncoder);
        }
    
        /**
         * 忽略要被拦截的资源。
         * eg: 解决静态资源被拦截的问题：ignoring().antMatchers("/static/**");
         * @param web
         * @throws Exception
         */
        @Override
        public void configure(WebSecurity web) throws Exception {
            web.ignoring().antMatchers("/static/**");
        }
    
        @Override
        protected void configure(HttpSecurity http) throws Exception {
            http.csrf().disable()
                    //认证： 1.白名单、 2.管理目录的特殊权限、 3.其他需求都需要验证
                    .authorizeRequests()
                    .antMatchers(AUTH_WHITELIST).permitAll()
                    .antMatchers(MANAGE_AUTHLIST).hasRole(Constants.USER_ROLE_ADMIN)
                    .anyRequest().authenticated()  // 放行：authenticated() --> permitAll()
                    .and() //登录
                    .formLogin()
                    .usernameParameter("username").passwordParameter("password")
                    .loginPage("/login")
                    .loginProcessingUrl("/loginValidate")
    //                    .defaultSuccessUrl("/loginSuccess")     //登陆成功后跳转的请求,要自己写一个controller转发
    //                    .failureUrl("/loginFailed")             //验证失败后跳转的url
                    .and()
                    //登出
                    .logout().permitAll()
    //                    .logoutUrl("/logout").logoutSuccessUrl("/login")
    //                    .logoutSuccessHandler(logoutSuccessHandler)
    //                    .addLogoutHandler(logoutHandler)
    //                    .invalidateHttpSession(true)  //使session失效
    //                    .clearAuthentication(true)    //清除认证信息
    //                    .deleteCookies(new String[] { "cookie名字" })
                    .and()  //  记住我
                    .rememberMe()
    //                    .rememberMeParameter("remember-me")
    //                    .tokenValiditySeconds(1000)
                    .and() //session管理
                    .sessionManagement()
                    .maximumSessions(1)                //系统中同一个账号的登陆数量限制
    //                    .expiredUrl("/login")
                    .sessionRegistry(sessionRegistry)
            ;
        }
    
    
    }

## 7. 设置资源访问控制 ##

package com.weipaiku.config;
    
    import org.springframework.stereotype.Component;
    import org.springframework.web.servlet.config.annotation.ResourceHandlerRegistry;
    import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;
    
    /**
     * @Auther: shiguanghui
     * @Date: 2018/12/18 13:47
     * @ClassName: WebMvcConfig
     * @Description: 设置MVC的可以直接访问的静态资源
     */
    @Component
    public class WebMvcConfig implements WebMvcConfigurer {
    
        /**
         * 添加静态资源文件，外部可以直接访问地址
         * addResourceHandler("/static1/**")：设置访问路径前缀；
         * addResourceLocations("classpath:/static2/")：设置资源路径
         * eg： localhost/static1/aa.png ---> 到static2的目录下面去aa.png
         * @param registry
         */
        @Override
        public void addResourceHandlers(ResourceHandlerRegistry registry) {
            registry.addResourceHandler("/static/**").addResourceLocations("classpath:/static/");
        }
    }

## 8、自定义的登录界面 ##

提交的资源路径一定要和spring security定义的处理请求路径一直。 如：/loginValidate

<!DOCTYPE HTML>
    <html xmlns="http://www.w3.org/1999/xhtml" xmlns:th="http://www.thymeleaf.org"
          xmlns:sec="http://www.thymeleaf.org/thymeleaf-extras-springsecurity5">
    <head>
    <meta charset="utf-8">
    <meta name="renderer" content="webkit|ie-comp|ie-stand">
    <meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1">
    <meta name="viewport" content="width=device-width,initial-scale=1,minimum-scale=1.0,maximum-scale=1.0,user-scalable=no" />
    <meta http-equiv="Cache-Control" content="no-siteapp" />
    <script type="text/javascript" th:src="@{'/static/lib/jquery/1.9.1/jquery.min.js'}"></script>
    
    <link th:href="@{'/static/h-ui/css/H-ui.min.css'}" rel="stylesheet" type="text/css" />
    <link th:href="@{'/static/h-ui.admin/css/H-ui.login.css'}" rel="stylesheet" type="text/css" />
    <link th:href="@{'/static/h-ui.admin/css/style.css'}" rel="stylesheet" type="text/css" />
    <link th:href="@{'/static/lib/Hui-iconfont/1.0.8/iconfont.css'}" rel="stylesheet" type="text/css" />
    
    <title>JOJO后台登录</title>
    </head>
    <body>
    <div class="header"></div>
    <div class="loginWraper">
      <div id="loginform" class="loginBox">
        <form class="form form-horizontal" action="/loginValidate" method="post">
          <div class="row cl">
            <label class="form-label col-xs-3"><i class="Hui-iconfont"></i></label>
            <div class="formControls col-xs-8">
              <input id="username" name="username" type="text" placeholder="账户" class="input-text size-L">
            </div>
          </div>
          <div class="row cl">
            <label class="form-label col-xs-3"><i class="Hui-iconfont"></i></label>
            <div class="formControls col-xs-8">
              <input id="password" name="password" type="password" placeholder="密码" class="input-text size-L">
            </div>
          </div>
          <div class="row cl">
            <div class="formControls col-xs-8 col-xs-offset-3">
              <input name="" type="submit" class="btn btn-success radius size-L" value=" 登    录 ">
              <input name="" type="reset" class="btn btn-default radius size-L" value=" 取    消 ">
            </div>
          </div>
        </form>
      </div>
    </div>
    </body>
    </html>