Spring Security 为用户示例添加角色

谁借莪１个温暖的怀抱￠ 2023-09-27 10:47 105阅读 0赞

在这个 Spring Security 教程中，我很乐意与您分享如何通过在 Java Web 应用程序中为用户添加角色来实现授权——从数据库设计到实体类；从单元测试到在用户注册中添加默认角色；以 Web 形式更新用户的角色。

技术：Spring Web MVC、Spring Data JPA、Hibernate 框架、Spring Security、Spring Boot Test、JUnit 5、AssertJ、Thymeleaf 和 MySQL 数据库。

基本上，我们需要在数据库中有 3 个表，如下所示：

![501581ffa3fe984bdde38687ee210e78.png][]

一个用户可以有一个或多个角色，一个角色可以分配给一个或多个用户，因此*用户*和*角色*表之间的实体关系是多对多的。users\_roles是实现这种关系的中间表*。*

### **1. 用户和角色实体类和存储库的代码** ###

将User实体类编码如下：

package net.codejava;
    
    import java.util.HashSet;
    import java.util.Set;
    
    import javax.persistence.*;
    
    @Entity
    @Table(name = "users")
    public class User {
    	
    	@Id
    	@GeneratedValue(strategy = GenerationType.IDENTITY)
    	private Long id;
    	
    	@Column(nullable = false, unique = true, length = 45)
    	private String email;
    	
    	@Column(nullable = false, length = 64)
    	private String password;
    	
    	@Column(name = "first_name", nullable = false, length = 20)
    	private String firstName;
    	
    	@Column(name = "last_name", nullable = false, length = 20)
    	private String lastName;
    	
    	@ManyToMany(fetch = FetchType.EAGER)
    	@JoinTable(
    			name = "users_roles",
    			joinColumns = @JoinColumn(name = "user_id"),
    			inverseJoinColumns = @JoinColumn(name = "role_id")
    	)
    	private Set<Role> roles = new HashSet<>();
    
    	public void addRole(Role role) {
    		this.roles.add(role);
    }
    
    	// getters and setters are not shown for brevity
    }

并像这样对Role实体类进行编码：

package net.codejava;
     
    import javax.persistence.*;
     
    @Entity
    @Table(name = "roles")
    public class Role {
        @Id
        @GeneratedValue(strategy = GenerationType.IDENTITY)
        private Integer id;
         
        @Column(nullable = false, length = 45)
        private String name;
     
        public Role() { }
         
        public Role(String name) {
            this.name = name;
        }
         
        public Role(Integer id, String name) {
            this.id = id;
            this.name = name;
        }
     
        public Role(Integer id) {
            this.id = id;
        }
         
     
        @Override
        public String toString() {
            return this.name;
        }
     
        // getters and setters are not shown for brevity   
    }

如您所见，User类有一组角色，但Role类没有任何对 User 的引用。默认情况下， @ManyToMany关系上没有级联操作——这意味着更新User对象不会更改关联的Role对象。

###    **2. 单元测试——创建角色** ###

接下来，让我们编写以下测试类，用于将一些Role对象持久化到数据库中：

package net.codejava;
     
    import static org.assertj.core.api.Assertions.assertThat;
     
    import java.util.List;
     
    import org.junit.jupiter.api.Test;
    import org.springframework.beans.factory.annotation.Autowired;
    import org.springframework.boot.test.autoconfigure.jdbc.AutoConfigureTestDatabase;
    import org.springframework.boot.test.autoconfigure.jdbc.AutoConfigureTestDatabase.Replace;
    import org.springframework.boot.test.autoconfigure.orm.jpa.DataJpaTest;
    import org.springframework.test.annotation.Rollback;
     
    @DataJpaTest
    @AutoConfigureTestDatabase(replace = Replace.NONE)
    @Rollback(false)
    public class RoleRepositoryTests {
     
        @Autowired private RoleRepository repo;
         
        @Test
        public void testCreateRoles() {
            Role user = new Role("User");
            Role admin = new Role("Admin");
            Role customer = new Role("Customer");
             
            repo.saveAll(List.of(user, admin, customer));
             
            List<Role> listRoles = repo.findAll();
             
            assertThat(listRoles.size()).isEqualTo(3);
        }
         
    }

运行testCreateRoles()方法，我们最终将根据 3 个角色将 3 个新行插入到*角色表中：用户、管理员和客户。*

###    **3. 单元测试——给用户添加角色** ###

要测试向用户添加角色，请使用以下初始代码创建UserRepositoryTests类：

package net.codejava;
     
    import static org.assertj.core.api.Assertions.assertThat;
     
    import org.junit.jupiter.api.Test;
    import org.springframework.beans.factory.annotation.Autowired;
    import org.springframework.boot.test.autoconfigure.jdbc.AutoConfigureTestDatabase;
    import org.springframework.boot.test.autoconfigure.jdbc.AutoConfigureTestDatabase.Replace;
    import org.springframework.boot.test.autoconfigure.orm.jpa.DataJpaTest;
    import org.springframework.boot.test.autoconfigure.orm.jpa.TestEntityManager;
    import org.springframework.test.annotation.Rollback;
     
    @DataJpaTest
    @AutoConfigureTestDatabase(replace = Replace.NONE)
    @Rollback(false)
    public class UserRepositoryTests {
     
        @Autowired
        private TestEntityManager entityManager;
         
        @Autowired
        private UserRepository userRepo;
         
        @Autowired
        private RoleRepository roleRepo;
         
        // test methods go here...
    }

以下是第一个测试方法的代码片段，它保留了一个没有任何角色的用户对象：

@Test
    public void testCreateUser() {
        User user = new User();
        user.setEmail("ravikumar@gmail.com");
        user.setPassword("ravi2020");
        user.setFirstName("Ravi");
        user.setLastName("Kumar");
         
        User savedUser = userRepo.save(user);
         
        User existUser = entityManager.find(User.class, savedUser.getId());
         
        assertThat(user.getEmail()).isEqualTo(existUser.getEmail());
         
    }

以下测试方法创建一个具有管理员角色的新用户：

@Test
    public void testAddRoleToNewUser() {
        Role roleAdmin = roleRepo.findByName("Admin");
         
        User user = new User();
        user.setEmail("mikes.gates@gmail.com");
        user.setPassword("mike2020");
        user.setFirstName("Mike");
        user.setLastName("Gates");
        user.addRole(roleAdmin);       
         
        User savedUser = userRepo.save(user);
         
        assertThat(savedUser.getRoles().size()).isEqualTo(1);
    }

以下测试将通过添加两个角色 User 和 Customer 来更新现有用户：

@Test
    public void testAddRoleToExistingUser() {
        User user = userRepo.findById(1L).get();
        Role roleUser = roleRepo.findByName("User");
        Role roleCustomer = new Role(3);
         
        user.addRole(roleUser);
        user.addRole(roleCustomer);
         
        User savedUser = userRepo.save(user);
         
        assertThat(savedUser.getRoles().size()).isEqualTo(2);      
    }

运行这些测试方法，您将看到插入到*users*和*users\_roles*表中的行。*角色*表不受影响。

###    **4. 为注册用户设置默认角色** ###

用户注册中的一个常见场景是为新注册的用户设置默认角色，例如用户或客户角色。以下是服务层的示例代码片段：

package net.codejava;
     
    @Service
    public class UserService {
     
        @Autowired
        private UserRepository userRepo;
         
        @Autowired RoleRepository roleRepo;
         
        @Autowired PasswordEncoder passwordEncoder;
         
        public void registerDefaultUser(User user) {
            Role roleUser = roleRepo.findByName("User");
            user.addRole(roleUser);
     
            userRepo.save(user);
        }
         
    }

以及控制器层的代码：

package net.codejava;
     
    @Controller
    public class AppController {
     
        @Autowired
        private UserService service;
             
        @PostMapping("/register")
        public String processRegister(User user) {
            service.registerDefaultUser(user);
             
            return "register_success";
        }  
    }

如您所见，这非常简单——感谢 Spring Data JPA 和 Hibernate 框架，极大地简化了数据访问层的编码。

### **5. 在 Web 表单中为用户分配角色** ###

现在，我将向您展示如何使用 Web 用户界面编写编辑用户功能的代码，我们可以在其中更改分配给用户的角色。

首先，在UserService类中实现如下方法：

public List<User> listAll() {
        return userRepo.findAll();
    }

在控制器类中：

@GetMapping("/users")
    public String listUsers(Model model) {
        List<User> listUsers = service.listAll();
        model.addAttribute("listUsers", listUsers);
         
        return "users";
    }

此处理程序方法将显示从数据库中检索到的用户列表。并将以下相关代码放入视图页面（HTML）：

<table class="table table-striped table-bordered">
        <thead class="thead-dark">
            <tr>
                <th>User ID</th>
                <th>E-mail</th>
                <th>First Name</th>
                <th>Last Name</th>
                <th>Roles</th>
                <th></th>
            </tr>
        </thead>
        <tbody>
            <tr th:each="user: ${listUsers}">
                <td th:text="${user.id}">User ID</td>
                <td th:text="${user.email}">E-mail</td>
                <td th:text="${user.firstName}">First Name</td>
                <td th:text="${user.lastName}">Last Name</td>
                <td th:text="${user.roles}">Roles</td>
                <td><a th:href="/@{'/users/edit/' + ${user.id}}">Edit</a></td>
            </tr>
        </tbody>
    </table>

它将在 URL http://localhost.../users 处显示用户列表，如下所示：

![de9440e0c92a6b07b7e0c8a48e00c8ff.png][]

在此用户列表页面上，我们可以单击编辑超链接来编辑用户。所以像这样编写处理程序方法：

@GetMapping("/users/edit/{id}")
    public String editUser(@PathVariable("id") Long id, Model model) {
        User user = service.get(id);
        List<Role> listRoles = service.listRoles();
        model.addAttribute("user", user);
        model.addAttribute("listRoles", listRoles);
        return "user_form";
    }

并在服务类中实现以下两个方法：

public User get(Long id) {
        return userRepo.findById(id).get();
    }
     
    public List<Role> listRoles() {
        return roleRepo.findAll();
    }

在视图层，为编辑用户表单编写如下代码：

<form th:action="@{/users/save}" th:object="${user}"
        method="post" style="max-width: 600px; margin: 0 auto;">
        <input type="hidden" th:field="*{id}" />
    <div class="m-3">
        <div class="form-group row">
            <label class="col-4 col-form-label">E-mail: </label>
            <div class="col-8">
                <input type="email" th:field="*{email}" class="form-control" required />
            </div>
        </div>
         
        <div class="form-group row">
            <label class="col-4 col-form-label">Password: </label>
            <div class="col-8">
                <input type="password" th:field="*{password}" class="form-control"
                        required minlength="6" maxlength="10"/>
            </div>
        </div>
         
        <div class="form-group row">
            <label class="col-4 col-form-label">First Name: </label>
            <div class="col-8">
                <input type="text" th:field="*{firstName}" class="form-control"
                        required minlength="2" maxlength="20"/>
            </div>
        </div>
         
        <div class="form-group row">
            <label class="col-4 col-form-label">Last Name: </label>
            <div class="col-8">
                <input type="text" th:field="*{lastName}" class="form-control"
                        required minlength="2" maxlength="20" />
            </div>
        </div>
         
        <div class="form-group row">
            <label class="col-4 col-form-label">Roles: </label>
            <div class="col-8">
                <th:block th:each="role: ${listRoles}">
                <input type="checkbox" th:field="*{roles}"
                    th:text="${role.name}" th:value="${role.id}" class="m-2" />
                </th:block>
            </div>
        </div>           
         
        <div>
            <button type="submit" class="btn btn-primary">Update</button>
        </div>
    </div>
    </form>

此页面中最重要的是显示角色列表并检查分配给当前用户的角色的代码：

<th:block th:each="role: ${listRoles}">
    <input type="checkbox" th:field="*{roles}"
        th:text="${role.name}" th:value="${role.id}" class="m-2" />
    </th:block>

然后编辑用户表单将如下所示：

![9415b67de9fddec27e431405a3b9003c.png][]

这里很酷的是，Thymeleaf 会根据分配给用户的角色自动显示选择的角色。此外，您可以在此处简单地选中/取消选中角色来更新用户的角色。

并编写处理表单提交的处理程序方法，如下所示：

@PostMapping("/users/save")
    public String saveUser(User user) {
        service.save(user);
         
        return "redirect:/users";
    }

以及服务层的相关代码：

public void save(User user) {
        userRepo.save(user);
    }

这是一些关于在 Spring Boot Web 应用程序中向用户添加角色的代码示例。我希望您发现这个书面教程对您有所帮助。

#### **相关 Spring Security 教程：** ####

*  [Spring Security 忘记密码教程][Spring Security]
 *  [Spring Security 限制登录尝试示例][Spring Security 1]
 *  [Spring Security OTP 电子邮件教程][Spring Security OTP]
 *  [使用 JPA、Hibernate 和 MySQL 进行 Spring Security 身份验证][JPA_Hibernate _ MySQL _ Spring Security]
 *  [Spring Security 基于角色的授权教程][Spring Security 2]
 *  [Spring Security 自定义登录和注销][Spring Security 3]
 *  [如何使用 Spring Security 获取登录用户的详细信息][Spring Security 4]
 *  [Spring Security：如果用户已经登录，则阻止用户返回登录页面][Spring Security 5]
 *  [Spring Security 身份验证成功处理程序示例][Spring Security 6]
 *  [Spring Security 身份验证失败处理程序示例][Spring Security 7]
 *  [Spring Security 注销成功处理程序示例][Spring Security 8]
 *  [身份验证过滤器示例之前的 Spring Security][Spring Security 9]

####  ####

#### **其他 Spring Boot 教程：** ####

*  [如何创建 Spring Boot Web 应用程序（带有 JSP/ThymeLeaf 的 Spring MVC）][Spring Boot Web _ JSP_ThymeLeaf _ Spring MVC]
 *  [使用 Spring MVC 的 Spring Boot CRUD 示例 - Spring Data JPA - ThymeLeaf - Hibernate - MySQL][Spring MVC _ Spring Boot CRUD _ - Spring Data JPA - ThymeLeaf - Hibernate - MySQL]
 *  [Spring Boot Hello World RESTful Web 服务教程][Spring Boot Hello World RESTful Web]
 *  [Spring Boot Thymeleaf 表单处理教程][Spring Boot Thymeleaf]
 *  [Spring Data JPA 分页和排序示例][Spring Data JPA]
 *  [Spring Boot 错误处理指南][Spring Boot]
 *  [Spring Boot 日志记录基础][Spring Boot 1]

####  ####

<table>  
 <span style="background-color:#ffffff;"><span style="color:#333333;">附件：</span></span>  
 <tbody> 
  <tr> 
   <td style="text-align:left;"> <p><img alt="" src="https://img-blog.csdnimg.cn/img_convert/5c219e39b79aa2ae89d780e114b07444.gif"></p> <span style="background-color:#ffffff;"><span style="color:#333333;"><a href="https://www.codejava.net/download-attachment?fid=412" title="SpringBootRegistrationLoginAddRoles.zip" rel="nofollow">SpringBootRegistrationLoginAddRoles.zip</a></span></span></td> 
   <td><span style="background-color:#ffffff;"><span style="color:#333333;">[示例 Spring Boot 项目]</span></span></td> 
   <td style="text-align:right;"><span style="background-color:#ffffff;"><span style="color:#333333;">97 KB</span></span></td> 
  </tr> 
 </tbody> 
</table>

[501581ffa3fe984bdde38687ee210e78.png]: https://img-blog.csdnimg.cn/img_convert/501581ffa3fe984bdde38687ee210e78.png
[de9440e0c92a6b07b7e0c8a48e00c8ff.png]: https://img-blog.csdnimg.cn/img_convert/de9440e0c92a6b07b7e0c8a48e00c8ff.png
[9415b67de9fddec27e431405a3b9003c.png]: https://img-blog.csdnimg.cn/img_convert/9415b67de9fddec27e431405a3b9003c.png
[Spring Security]: https://www.codejava.net/frameworks/spring-boot/spring-security-forgot-password-tutorial
[Spring Security 1]: https://www.codejava.net/frameworks/spring-boot/spring-security-limit-login-attempts-example
[Spring Security OTP]: https://www.codejava.net/frameworks/spring-boot/spring-security-otp-email-tutorial
[JPA_Hibernate _ MySQL _ Spring Security]: https://www.codejava.net/frameworks/spring-boot/spring-boot-security-authentication-with-jpa-hibernate-and-mysql
[Spring Security 2]: https://www.codejava.net/frameworks/spring-boot/spring-boot-security-role-based-authorization-tutorial
[Spring Security 3]: https://www.codejava.net/frameworks/spring-boot/spring-boot-security-customize-login-and-logout
[Spring Security 4]: https://www.codejava.net/frameworks/spring-boot/get-logged-in-user-details
[Spring Security 5]: https://www.codejava.net/frameworks/spring-boot/prevent-user-from-going-back-to-login-page-if-already-logged-in
[Spring Security 6]: https://www.codejava.net/frameworks/spring-boot/spring-security-authentication-success-handler-examples
[Spring Security 7]: https://www.codejava.net/frameworks/spring-boot/spring-security-authentication-failure-handler-examples
[Spring Security 8]: https://www.codejava.net/frameworks/spring-boot/spring-security-logout-success-handler-example
[Spring Security 9]: https://www.codejava.net/frameworks/spring-boot/spring-security-before-authentication-filter-examples
[Spring Boot Web _ JSP_ThymeLeaf _ Spring MVC]: https://www.codejava.net/frameworks/spring-boot/how-to-create-a-spring-boot-web-application-spring-mvc-with-jsp-thymeleaf
[Spring MVC _ Spring Boot CRUD _ - Spring Data JPA - ThymeLeaf - Hibernate - MySQL]: https://www.codejava.net/frameworks/spring-boot/spring-boot-crud-example-with-spring-mvc-spring-data-jpa-thymeleaf-hibernate-mysql
[Spring Boot Hello World RESTful Web]: https://www.codejava.net/frameworks/spring-boot/spring-boot-hello-world-restful-web-services-tutorial
[Spring Boot Thymeleaf]: https://www.codejava.net/frameworks/spring-boot/spring-boot-thymeleaf-form-handling-tutorial
[Spring Data JPA]: https://www.codejava.net/frameworks/spring-boot/spring-data-jpa-paging-and-sorting-examples
[Spring Boot]: https://www.codejava.net/frameworks/spring-boot/spring-boot-error-handling-guide
[Spring Boot 1]: https://www.codejava.net/frameworks/spring-boot/spring-boot-logging-basics