SpringSecurity学习笔记(二)——访问数据库（二）

男娘i 2021-09-26 05:48 303阅读 0赞

在上篇访问数据库（一）中，我们是将sql代码写入到spring-security.xml中，在实际项目中是否可以这样呢？答案是肯定的，但是对于程序原来是xml配置实在是麻烦，远不如java代码来的方便，本篇讲的就是如何通过java代码来查询数据库（整合mybatis）。

## 一.结构目录 ##

![Center][]

## 二.pom.xml引入相应jar包 ##

## 三.service中写一个方法实现UserDetailsService接口 ##

package com.springsecurity.service;
    
    import java.util.HashSet;
    import java.util.List;
    import java.util.Set;
    
    import org.springframework.beans.factory.annotation.Autowired;
    import org.springframework.security.core.GrantedAuthority;
    import org.springframework.security.core.authority.SimpleGrantedAuthority;
    import org.springframework.security.core.userdetails.User;
    import org.springframework.security.core.userdetails.UserDetails;
    import org.springframework.security.core.userdetails.UserDetailsService;
    import org.springframework.security.core.userdetails.UsernameNotFoundException;
    import org.springframework.stereotype.Service;
    import org.springframework.transaction.annotation.Transactional;
    
    import com.springsecurity.bean.UserRole;
    import com.springsecurity.dto.UserDto;
    import com.springsecurity.mapper.RoleMapper;
    import com.springsecurity.mapper.UserMapper;
    import com.springsecurity.mapper.UserRoleMapper;
    
    
    /**
     * 该类是用户信息的定义和验证  
     * 这个类主要是处理用户登录信息，在用户输入用户名和密码后，  
     * spring security会带着用户名调用类里面的loadUserByUsername(usrename)方法，  
     * 通过用户名查出用户信息，然后把数据库中查出的用户密码和刚刚用户输入的存储在session中的密码做比较，然后判断该用户是否合法！
     * @作者：JackHisen(GWD)
     * @项目名：core
     * @时间：2017-6-29 下午3:38:15
     * @version 1.0
     */
    @Service("myUserDetailsService")
    public class MyUserDetailsService implements UserDetailsService	{
    
    	@Autowired
    	private UserMapper userMapper;
    	@Autowired
    	private UserRoleMapper userRoleMapper;
    	@Autowired
    	private RoleMapper roleMapper;
    	
    	@Transactional
    	public UserDetails loadUserByUsername(String username)
    			throws UsernameNotFoundException {
    		UserDto userDto=userMapper.selectByUserName(username);
    		if(userDto==null){
    			throw new UsernameNotFoundException("用户："+username+"不存在");
    		}
    		Set<GrantedAuthority> authorities=new HashSet<GrantedAuthority>();
    		List<UserRole> userRole=userRoleMapper.selectByUserId(userDto.getId());
    		for(int i=0;i<userRole.size();i++){
    			authorities.add(new SimpleGrantedAuthority(roleMapper.selectByPrimaryKey(userRole.get(i).getRoleId()).getRoleName()));
    		}
    		return new User(userDto.getUsername(),userDto.getPassword(),authorities);
    	}
    
    }

## 四.配置spring-security.xml ##

<?xml version="1.0" encoding="UTF-8"?>
    <beans:beans xmlns="http://www.springframework.org/schema/security"
        xmlns:beans="http://www.springframework.org/schema/beans"
        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
        xsi:schemaLocation="http://www.springframework.org/schema/beans
        http://www.springframework.org/schema/beans/spring-beans.xsd
        http://www.springframework.org/schema/security
        http://www.springframework.org/schema/security/spring-security.xsd">
    
        <http auto-config='true'>
            <intercept-url pattern="/admin.jsp" access="hasRole('ROLE_ADMIN')" />
            <intercept-url pattern="/**" access="hasRole('ROLE_USER')" />
        </http>
    	<authentication-manager alias="authenticationManager">  
    	    <authentication-provider ref="authenticationProvider" />  
    	</authentication-manager>  
    	<beans:bean id="authenticationProvider"  
    	    class="org.springframework.security.authentication.dao.DaoAuthenticationProvider">  
    	    <beans:property name="userDetailsService" ref="myUserDetailsService" />  
    	    <beans:property name="hideUserNotFoundExceptions" value="false" />   
    	</beans:bean>  
    </beans:beans>

## 五.配置web.xml ##

<?xml version="1.0" encoding="UTF-8"?>
    <web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    	xmlns="http://java.sun.com/xml/ns/javaee"
    	xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd"
    	version="2.5">
      <display-name>spring-security测试</display-name>
      
      <context-param>
            <param-name>contextConfigLocation</param-name>
            <param-value>
            	classpath:spring-mybatis.xml,
            	classpath:spring-security.xml
            </param-value>
        </context-param>
       
    	<context-param>
      		<param-name>log4jConfigLocation</param-name>
    	  	<param-value>classpath:log4j.properties</param-value>
     	</context-param> 
     	
    	<filter>
    		<filter-name>encodingFilter</filter-name>
    		<filter-class>org.springframework.web.filter.CharacterEncodingFilter</filter-class>
    		<init-param>
    			<param-name>encoding</param-name>
    			<param-value>UTF-8</param-value>
    		</init-param>
    	</filter>
    	<filter-mapping>
    		<filter-name>encodingFilter</filter-name>
    		<url-pattern>/*</url-pattern>
    	</filter-mapping> 
    	
    	
    	<filter>
    		<filter-name>springSecurityFilterChain</filter-name>
    		<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
    	</filter>
    	<filter-mapping>
    		<filter-name>springSecurityFilterChain</filter-name>
    		<url-pattern>/*</url-pattern>
    	</filter-mapping>
    	
    	
    	<listener>
    		<listener-class>org.springframework.web.util.Log4jConfigListener</listener-class>
    	</listener>
    	
    	<listener>
    		<listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
    	</listener>
    	<listener>
        	<listener-class>org.springframework.web.context.request.RequestContextListener</listener-class>
       	</listener>
       	<listener>
       		<listener-class>org.springframework.security.web.session.HttpSessionEventPublisher</listener-class>
       	</listener>
    	
    	<listener>
    		<listener-class>org.springframework.web.util.IntrospectorCleanupListener</listener-class>
    	</listener>
      
    	
    	<session-config>
    		<session-timeout>15</session-timeout>
    	</session-config>
    </web-app>

## 六.注意点 ##

1.spring-security.xml中角色必须<intercept-url pattern="/\*\*" access="hasRole('ROLE\_USER')" />，不能<intercept-url pattern="/\*\*" access="ROLE\_USER" />，如果缺少hasRole，会报权限错误

[Center]: /images/20210923/171efb16ff184665a3bb23f3881cfbc2.png