正文
Spring Security进阶
小程序：扫一扫查出行【扫一扫了解最新限行尾号】
复制小程序
Spring Security进阶
1.连接数据库进行数据的验证
Spring Security进行身份验证或者权限控制时，用户名和密码应该要和数据库的进行比较才行，用户的各种信息我们从数据库中去获取，不用自己在代码或者配置文件中写。
案例
1）创建项目
自己创建一个Maven项目
2）导入依赖
<parent>
<!--Spring boot-->
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-parent</artifactId>
<version>2.0.6.RELEASE</version>
</parent>
<dependencies>
<!--Spring boot Web-->
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-web</artifactId>
</dependency>
<!--Spring Security-->
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-security</artifactId>
</dependency>
<!--mysql驱动-->
<dependency>
<groupId>mysql</groupId>
<artifactId>mysql-connector-java</artifactId>
</dependency>
<!--数据库连接框架JPA-->
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-data-jpa</artifactId>
</dependency>
</dependencies>
3）创建启动类
@SpringBootApplication
public class SecurityApplication2 {
public static void main(String[] args) {
SpringApplication.run(SecurityApplication2.class, args);
}
}
4）配置文件
在项目的resources文件的目录下创建一个配置文件： application.properties
#连接数据库
spring.datasource.driver-class-name=com.mysql.jdbc.Driver
spring.datasource.url=jdbc:mysql://localhost:3306/你的数据库?useUnicode=true&characterEncoding=utf-8&useSSL=false
spring.datasource.username=用户名
spring.datasource.password=密码
#数据库表的生成
spring.jpa.generate-ddl=true
#显示执行的sql语句
spring.jpa.show-sql=true
#使用的数据库
spring.jpa.database=mysql
5）创建类
来创建一个实体层类、dao层接口、service层、控制层
实体类
//这个注解表示这个是实体类，对应数据库中的表，默认实体名就是类名
@Entity
public class UserInfo {
//这个属性的表中的主键
@Id
//主键的生成策略,IDENTITY 主键自增长
@GeneratedValue(strategy = GenerationType.IDENTITY)
private Long id;
//用户名
private String username;
//密码
private String password;
//角色
private String roles;
public Long getId() {
return id;
}
public void setId(Long id) {
this.id = id;
}
public String getUsername() {
return username;
}
public void setUsername(String username) {
this.username = username;
}
public String getPassword() {
return password;
}
public void setPassword(String password) {
this.password = password;
}
public String getRoles() {
return roles;
}
public void setRoles(String roles) {
this.roles = roles;
}
}
dao层接口
/*
* 继承JpaRepository<UserInfo,Long>接口，泛型一个是实体类，一个是主键类型
* */
public interface UserInfoDao extends JpaRepository<UserInfo,Long> {
//根据用户名查找用户
//(温馨提示：想要查找的话方法名要为 findBy属性字段 删除的话 deleteBy属性字段 ...以此类推这样才不报错)
UserInfo findByUsername(String username);
}
service层
public interface UserInfoService {
//根据用户名查找用户
UserInfo findByUsername(String username);
}
@Service
public class UserInfoServiceImpl implements UserInfoService {
@Autowired
private UserInfoDao userInfoDao;
//根据用户名返回用户
@Override
public UserInfo findByUsername(String username) {
UserInfo user = userInfoDao.findByUsername(username);
return user;
}
}
controller层
@RestController
@RequestMapping("/userInfo")
public class UserInfoController {
@RequestMapping("common")
//方法执行前验证用户是否有该角色
@PreAuthorize(value = "hasAnyRole('normal','admin')")
public String commonUserInfo() {
return "==测试数据库 有两个角色==";
}
@RequestMapping("admin")
//方法执行前验证是否有该角色
@PreAuthorize(value = "hasAnyRole('admin')")
public String adminUserInfo() {
return "==测试数据库 有一个角色==";
}
}
这些准备工作都做完之后，我们可以往数据库中插入一些数据，创建一个类，用来往数据库中添加数据的。
@Component
public class InitJdbc {
@Autowired
private UserInfoDao userInfoDao;
//Java自带的注解，程序启动的时候执行该方法,每启动一次执行一次,
//插入成功了，再启动项目的时候不想再重复插入，可以把@PostConstruct注释掉
@PostConstruct
public void init() {
//密码要加密
PasswordEncoder pe = new BCryptPasswordEncoder();
//添加一个用户
UserInfo userInfo = new UserInfo();
userInfo.setUsername("wangwu");
userInfo.setPassword(pe.encode("123456"));
userInfo.setRoles("normal");
userInfoDao.save(userInfo);
//添加一个用户
UserInfo userInfo1 = new UserInfo();
userInfo1.setUsername("admin");
userInfo1.setPassword(pe.encode("admin"));
userInfo1.setRoles("admin");
userInfoDao.save(userInfo1);
}
}
现在就可以启动项目看看数据库中是否插入成功数据了。
接下来做权限的验证 ==========
来写一个类，实现UserDetailService并实现它的方法
//把类交给spring容器管理
@Component
public class SecurityDetail implements UserDetailsService {
@Autowired
private UserInfoDao userInfoDao;
@Override
public UserDetails loadUserByUsername(String s) throws UsernameNotFoundException {
UserInfo userInfo = null;
//UserDetails接口的实现类
User user = null;
//判断用户名不为空
if (s != null) {
//根据用户名查找用户
userInfo = userInfoDao.findByUsername(s);
//判断用户不为空
if (userInfo != null) {
//User类的第三个参数是集合，所有创建一个集合，获取用户的角色
List<GrantedAuthority> list = new ArrayList<>();
//获取用户的角色，获取到的角色开头一定要以"ROLE_"开头
GrantedAuthority authority = new SimpleGrantedAuthority("ROLE_" + userInfo.getRoles());
list.add(authority);
//User的构造器要返回三个参数：用户名、密码、集合的角色
user = new User(userInfo.getUsername(), userInfo.getPassword(), list);
}
}
return user;
}
}
再写一个配置类，解析密码的加密方式
@Configuration
@EnableWebSecurity
//开启方法级别的验证
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class SecurityConfig extends WebSecurityConfigurerAdapter {
@Autowired
private SecurityDetail securityDetail;
@Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
//密码加密的方式
auth.userDetailsService(securityDetail).passwordEncoder(new BCryptPasswordEncoder());
}
}
现在可以进行测试了，启动项目，访问控制层的方法，只有方法上标记的角色才能访问该方法
2.认证和授权
authentication:认证 ，认证访问的用户是不是有效的用户，他是谁。
authorization:授权 ，访问的用户在系统中能干什么
RBAC:基于角色的访问控制（Role-Based Access Control） ，用户属于某个角色，而角色拥有某些权限。
权限： 能对资源进行操作，比如增删改查
角色： 自定义的，表示权限的聚合，一个角色可以有多个权限。
举例说明 ：
设计角色： 经理 具有数据的修改、删除、查看等； 员工 只能查看数据。
一个公司中如果想把一个用户设置为经理，只需把他设置为经理这个角色，他就能有修改、删除、查看等操作了，如果公司新来普通员工，只需把他加入到员工这个角色里面就好了。这样，想让什么用户用户什么权限，只需把他加入到相应的角色里就OK了。
UserDetailService: 这是一个接口，里面只有一个方法 UserDetails loadUserByUsername(String var1) ，是根据用户名来获取数据库中信息的
主要的实现有：
InMemoryUserDetailsManager 在内存中维护用户信息的，使用很方便，可是数据不是持久的
JdbcUserDetailsManager 对数据库信息进行操作的，底层是基于jdbcTemplate的，可以使用这个类的方法来操作数据库数据。
UserDetails: 提供用户信息的核心接口
// 权限的集合
Collection<? extends GrantedAuthority> getAuthorities();
//获取密码
String getPassword();
//获取用户名
String getUsername();
//用户是否存在
boolean isAccountNonExpired();
//用户是否锁定
boolean isAccountNonLocked();
//证书是否过期
boolean isCredentialsNonExpired();
//账户是否启用
boolean isEnabled();
UserDetails 有一个实现类 User
//他有两个构造器，参数和UserDetails的字段属性一样
public User(String username, String password, Collection<? extends GrantedAuthority> authorities) {
this(username, password, true, true, true, true, authorities);
} public User(String username, String password, boolean enabled, boolean accountNonExpired, boolean credentialsNonExpired, boolean accountNonLocked, Collection<? extends GrantedAuthority> authorities) {
if (username != null && !"".equals(username) && password != null) {
this.username = username;
this.password = password;
this.enabled = enabled;
this.accountNonExpired = accountNonExpired;
this.credentialsNonExpired = credentialsNonExpired;
this.accountNonLocked = accountNonLocked;
this.authorities = Collections.unmodifiableSet(sortAuthorities(authorities));
} else {
throw new IllegalArgumentException("Cannot pass null or empty values to constructor");
}
}
2.1设置表
基于RBAC设置三张表，用户表，角色表，用户和角色的关联表 密码明文分别是 123 456 admin
-- 角色表
SET NAMES utf8mb4;
SET FOREIGN_KEY_CHECKS = 0;
-- ----------------------------
-- Table structure for sys_role
-- ----------------------------
DROP TABLE IF EXISTS `sys_role`;
CREATE TABLE `sys_role` (
`id` int(11) NOT NULL,
`rolename` varchar(100) CHARACTER SET utf8 COLLATE utf8_general_ci NULL DEFAULT NULL COMMENT '角色名称',
`rolememo` varchar(255) CHARACTER SET utf8 COLLATE utf8_general_ci NULL DEFAULT NULL COMMENT '角色描述',
PRIMARY KEY (`id`) USING BTREE
) ENGINE = InnoDB CHARACTER SET = utf8 COLLATE = utf8_general_ci ROW_FORMAT = Dynamic;
-- ----------------------------
-- Records of sys_role
-- ----------------------------
INSERT INTO `sys_role` VALUES (1, 'USER', '普通用户');
INSERT INTO `sys_role` VALUES (2, 'READ', '只读');
INSERT INTO `sys_role` VALUES (3, 'ADMIN', '管理员');
SET FOREIGN_KEY_CHECKS = 1;
-- 用户表
SET NAMES utf8mb4;
SET FOREIGN_KEY_CHECKS = 0;
-- ----------------------------
-- Table structure for sys_user
-- ----------------------------
DROP TABLE IF EXISTS `sys_user`;
CREATE TABLE `sys_user` (
`id` int(11) NOT NULL AUTO_INCREMENT,
`username` varchar(100) CHARACTER SET utf8 COLLATE utf8_general_ci NULL DEFAULT NULL,
`password` varchar(100) CHARACTER SET utf8 COLLATE utf8_general_ci NULL DEFAULT NULL,
`realname` varchar(200) CHARACTER SET utf8 COLLATE utf8_general_ci NULL DEFAULT NULL COMMENT '真实名字',
`isenable` int(11) NULL DEFAULT NULL COMMENT '是否开启认证',
`islock` int(11) NULL DEFAULT NULL COMMENT '是否锁定',
`isexpire` int(11) NULL DEFAULT NULL,
`incredentials` int(255) NULL DEFAULT NULL COMMENT '是否过期',
`createtime` date NULL DEFAULT NULL,
`logintime` date NULL DEFAULT NULL,
PRIMARY KEY (`id`) USING BTREE
) ENGINE = InnoDB AUTO_INCREMENT = 9 CHARACTER SET = utf8 COLLATE = utf8_general_ci ROW_FORMAT = Dynamic;
-- ----------------------------
-- Records of sys_user 密码明文分别是 123 456 admin
-- ----------------------------
INSERT INTO `sys_user` VALUES (6, 'zs', '$2a$10$EGMo2XSdh49cDgXa0OzXYu36HfNssUf7zUDaNIz83AgWveA3GORYq', '张三', 1, 1, 1, 1, '2021-09-02', '2021-09-02');
INSERT INTO `sys_user` VALUES (7, 'lisi', '$2a$10$r9iLBYZzIIt/gyOngvPnZOBZaP4EW58etU1tLPoEh7hlYpydIaM6u', '李四', 1, 1, 1, 1, '2021-09-02', '2021-09-02');
INSERT INTO `sys_user` VALUES (8, 'admin', '$2a$10$P.I3zf7bEAmLmlSwaDOdMOdrxEyTT1QvbqfKC5YGQ7zHk5zUR/dCG', '管理员', 1, 1, 1, 1, '2021-09-02', '2021-09-02');
SET FOREIGN_KEY_CHECKS = 1;
--关联表
SET NAMES utf8mb4;
SET FOREIGN_KEY_CHECKS = 0;
-- ----------------------------
-- Table structure for sys_user_role
-- ----------------------------
DROP TABLE IF EXISTS `sys_user_role`;
CREATE TABLE `sys_user_role` (
`userid` int(11) NOT NULL,
`roleid` int(11) NULL DEFAULT NULL
) ENGINE = InnoDB CHARACTER SET = utf8 COLLATE = utf8_general_ci ROW_FORMAT = Dynamic;
-- ----------------------------
-- Records of sys_user_role
-- ----------------------------
INSERT INTO `sys_user_role` VALUES (6, 1);
INSERT INTO `sys_user_role` VALUES (7, 2);
INSERT INTO `sys_user_role` VALUES (8, 1);
INSERT INTO `sys_user_role` VALUES (8, 3);
SET FOREIGN_KEY_CHECKS = 1;
2.2创建项目
2.3 导入依赖
把上一个项目的依赖导入进来，再加多一个spring整合mybatis的包
<dependency>
<groupId>org.mybatis.spring.boot</groupId>
<artifactId>mybatis-spring-boot-starter</artifactId>
<version>2.1.0</version>
</dependency>
2.4创建相关类
2.4.1实体类
创建User和Role的实体类，要继承UserDetails
public class SysUser implements UserDetails {
private Integer id;
private String username;
private String password;
private String realName;
private boolean isEnable;
private boolean isExpired;
private boolean isLock;
private boolean isCredentials;
private List<GrantedAuthority> grantedAuthorities;
private Date createTime;
private Date loginTime;
public SysUser() {
}
public SysUser(String username, String password, String realName,
boolean isEnable, boolean isExpired, boolean isLock,
boolean isCredentials, List<GrantedAuthority> grantedAuthorities,
Date createTime, Date loginTime) {
this.username = username;
this.password = password;
this.realName = realName;
this.isEnable = isEnable;
this.isExpired = isExpired;
this.isLock = isLock;
this.isCredentials = isCredentials;
this.grantedAuthorities = grantedAuthorities;
this.createTime = createTime;
this.loginTime = loginTime;
}
//角色的集合
@Override
public Collection<? extends GrantedAuthority> getAuthorities() {
return grantedAuthorities;
}
//密码
@Override
public String getPassword() {
return password;
}
//用户名
@Override
public String getUsername() {
return username;
}
//账号是否存在
@Override
public boolean isAccountNonExpired() {
return isExpired;
}
//账号是否锁定
@Override
public boolean isAccountNonLocked() {
return isLock;
}
//是否过期
@Override
public boolean isCredentialsNonExpired() {
return isCredentials;
}
//是否启用
@Override
public boolean isEnabled() {
return isEnable;
}
public void setId(Integer id) {
this.id = id;
}
public void setUsername(String username) {
this.username = username;
}
public void setPassword(String password) {
this.password = password;
}
public void setRealName(String realName) {
this.realName = realName;
}
public void setEnable(boolean enable) {
isEnable = enable;
}
public void setExpired(boolean expired) {
isExpired = expired;
}
public void setLock(boolean lock) {
isLock = lock;
}
public void setCredentials(boolean credentials) {
isCredentials = credentials;
}
public void setGrantedAuthorities(List<GrantedAuthority> grantedAuthorities) {
this.grantedAuthorities = grantedAuthorities;
}
public void setCreateTime(Date createTime) {
this.createTime = createTime;
}
public void setLoginTime(Date loginTime) {
this.loginTime = loginTime;
}
public Integer getId() {
return id;
}
public String getRealName() {
return realName;
}
public Date getCreateTime() {
return createTime;
}
public Date getLoginTime() {
return loginTime;
}
@Override
public String toString() {
return "SysUser{" +
"id=" + id +
", username='" + username + '\'' +
", password='" + password + '\'' +
", realName='" + realName + '\'' +
", isEnable=" + isEnable +
", isExpired=" + isExpired +
", isLock=" + isLock +
", isCredentials=" + isCredentials +
", grantedAuthorities=" + grantedAuthorities +
", createTime=" + createTime +
", loginTime=" + loginTime +
'}';
}
}
public class SysRole {
private Integer id;
private String role;
private String rolememo;
public Integer getId() {
return id;
}
public void setId(Integer id) {
this.id = id;
}
public String getRole() {
return role;
}
public void setRole(String role) {
this.role = role;
}
public String getRolememo() {
return rolememo;
}
public void setRolememo(String rolememo) {
this.rolememo = rolememo;
}
@Override
public String toString() {
return "SysRole{" +
"id=" + id +
", role='" + role + '\'' +
", rolememo='" + rolememo + '\'' +
'}';
}
}
2.4.2dao层和对应的xml文件
@Repository
public interface SysRoleMapper {
//根据用户id查看角色
List<SysRole> selectByUserId(Integer userId);
}
@Repository
public interface SysUserMapper {
//插入用户
int insertSysUser(SysUser sysUser);
//根据用户名查询用户
SysUser selectByUsername(String username);
}
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE mapper
PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
"http://mybatis.org/dtd/mybatis-3-mapper.dtd">
<mapper namespace="com.huang.security.mapper.SysRoleMapper">
<resultMap id="roleMapper" type="com.huang.security.entity.SysRole">
<id column="id" property="id"/>
<result column="rolename" property="role"/>
<result column="rolememo" property="rolememo"/>
</resultMap>
<select id="selectByUserId" resultMap="roleMapper" >
SELECT sr.id,sr.rolename,sr.rolememo FROM sys_role AS sr
INNER JOIN sys_user_role AS sur ON sr.id = sur.roleid
WHERE sur.userid = #{userid}
</select>
</mapper>
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE mapper
PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
"http://mybatis.org/dtd/mybatis-3-mapper.dtd">
<mapper namespace="com.huang.security.mapper.SysUserMapper">
<resultMap id="userMapper" type="com.huang.security.entity.SysUser">
<id column="id" property="id"/>
<result column="username" property="username"/>
<result column="password" property="password"/>
<result column="realname" property="realName"/>
<result column="isenable" property="isEnable"/>
<result column="islock" property="isLock"/>
<result column="isexpire" property="isExpired"/>
<result column="incredentials" property="isCredentials"/>
<result column="createtime" property="createTime"/>
<result column="logintime" property="loginTime"/>
</resultMap>
<insert id="insertSysUser" parameterType="com.huang.security.entity.SysUser">
insert into sys_user(username,password,realname,isenable,islock,incredentials,createtime,logintime)
values(#{username},#{password},#{realName},#{isEnable},#{isLock},#{isCredentials},
#{createTime},#{loginTime})
</insert>
<select id="selectByUsername" resultMap="userMapper" >
select id,username,password,realname,isenable,islock,isexpire,incredentials,createtime,logintime
from sys_user where username = #{username}
</select>
</mapper>
2.5service层
service层要实现UserDetailService接口，去获取数据库中的信息做返回
@Service
public class UserWnoRoleService implements UserDetailsService {
@Autowired
private SysUserMapper userMapper;
@Autowired
private SysRoleMapper roleMapper;
@Override
public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
//根据用户名获取用户
SysUser user = userMapper.selectByUsername(username);
System.out.println("==== Service =====");
String roleName = "";
List<GrantedAuthority> list = new ArrayList<>();
System.out.println("User" + user);
if (!StringUtils.isEmpty(user)) {
//根据用户id获取对应角色
List<SysRole> roles = roleMapper.selectByUserId(user.getId());
for (SysRole role : roles) {
//一个用户可能有多个角色，用集合保存，放到用户的集合里
roleName = role.getRole();
GrantedAuthority authority = new SimpleGrantedAuthority("ROLE_" + roleName);
list.add(authority);
user.setGrantedAuthorities(list);
}
//返回的这个user是包含角色的
return user;
}
//可以返回自定义user，是因为实体类实现了UserDetails这个接口
return user;
}
}
2.6配置文件
spring.datasource.driver-class-name=com.mysql.jdbc.Driver
spring.datasource.url=jdbc:mysql://localhost:3306/库名?useUnicode=true&characterEncoding=utf-8&useSSL=false
spring.datasource.username=用户名
spring.datasource.password=密码
mybatis.mapper-locations=classpath:/mapper/*Mapper.xml
# 包起别名
mybatis.type-aliases-package=com.huang.security.entity
mybatis.configuration.log-impl=org.apache.ibatis.logging.stdout.StdOutImpl
2.7相关的配置类
@Configuration
//@EnableWebSecurity //如果是导入的jar包是spring-boot-starter-security可以不用写
public class MySecurityConfig extends WebSecurityConfigurerAdapter {
@Override
protected void configure(HttpSecurity http) throws Exception {
System.out.println("====== MySecurityConfig configure==============");
//匹配"/index","/login.html","/login" 不用验证（permit 许可）,和登录相关的要放行
http.authorizeRequests().antMatchers("/index","/login.html","/login").permitAll()
//匹配只有相关角色才能访问的路径
.antMatchers("/access/user/**").hasRole("USER")
.antMatchers("/access/read/**").hasRole("READ")
.antMatchers("/access/admin/**").hasRole("ADMIN")
//所有都需要验证
.anyRequest().authenticated()
//执行结束
.and()
//表单的方式登录
.formLogin()
//登录的自定义视图页面
.loginPage("/login.html")
//登录访问的地址，表单中action的值
.loginProcessingUrl("/login")
.and()
//跨域安全的设置，禁用
.csrf().disable();
}
@Qualifier("userWnoRoleService")
@Autowired
private UserDetailsService userDetailsService;
@Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
//super.configure(auth);
// userDetailsService使用的是service层的 UserWnoRoleService，它实现了 UserDetailsService
auth.userDetailsService(userDetailsService).passwordEncoder(new BCryptPasswordEncoder());
}
}
2.8html页面
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<title>Title</title>
</head>
<body>
身份验证 <br>
<a href="/access/user">zs</a> <br>
<a href="/access/read">lisi</a> <br>
<a href="/access/admin">admin</a> <br>
<a href="/logout">退出</a>
</body>
</html>
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<title>Title</title>
</head>
<body>
<p>自定义登录页</p>
<form action="/login" method="post">
用户名:<input type="text" name="username" value=""><br/>
密 码:<input type="password" name="password" value=""><br/>
<input type="submit" value="登录">
</form>
</body>
</html>
2.9controller层测试
@Controller
public class InitController {
@GetMapping("index")
public String toIndex() {
return "forward:/index.html";
}
}
@RestController
@RequestMapping("/access")
public class UserWnoRoleController {
@GetMapping("user")
public String sayUser() {
return "zs 是 user 角色";
}
@GetMapping("read")
public String sayRead() {
return "lisi 是 read 角色";
}
@GetMapping("admin")
public String sayAdmin() {
return "admin 是 user admin 角色";
}
}
个人笔记
