springsecurity常见的case

电玩女神 2022-01-23 02:25 138阅读 0赞

首先在pom中引入：

<dependency>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-starter-security</artifactId>
            </dependency>

**为了方便介绍将case1的前两张图片 定义为模块一 和模块二 ；**

case1:只能登陆就可以：

@EnableWebSecurity
    @Configuration
    class  SpringSecurityConfig extends WebSecurityConfigurationAdapter{
            
          @Override  
      protected void configure(AuthenticationManagerBuilder auth) throws Exception {
            auth.inMemoryAuthentication().withUser("admin").password("123456").roles("seller");
        }
    
        @Override
        public void configure(WebSecurity web) throws Exception {
            web.ignoring().antMatchers("/js/**", "/css/**", "images/**");
        }
        @Override
        protected void configure(HttpSecurity http) throws Exception {
            http.authorizeRequests().antMatchers("/").permitAll()
                    .anyRequest().authenticated()
                    .and().logout().permitAll()
                    .and().formLogin();
            http.csrf().disable();
        }
            
    
    
    
    
    
    
    }

package com.yumin.security;
    
    import com.fasterxml.jackson.annotation.JsonInclude;
    import org.springframework.boot.SpringApplication;
    import org.springframework.boot.autoconfigure.EnableAutoConfiguration;
    import org.springframework.boot.autoconfigure.SpringBootApplication;
    import org.springframework.security.access.prepost.PreAuthorize;
    import org.springframework.security.config.annotation.authentication.configuration.EnableGlobalAuthentication;
    import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
    import org.springframework.web.bind.annotation.GetMapping;
    import org.springframework.web.bind.annotation.RequestMapping;
    import org.springframework.web.bind.annotation.RequestParam;
    import org.springframework.web.bind.annotation.RestController;
    
    import javax.jws.HandlerChain;
    
    @SpringBootApplication
    @RestController
    public class SecurityApplication {
    
        public static void main(String[] args) {
            SpringApplication.run(SecurityApplication.class, args);
        }
    
        @GetMapping("/")
        public  String  index(){
            return "hello , home!";
        }
    
        @GetMapping("/plc")
        public String  login(){
            return "hello ,plc !";
        }
    
    
       
    }

case2:

有指定的角色 ，每个角色有不同的权限

首先我们添加几个角色：

在模块一改动为：

@Override
        protected void configure(AuthenticationManagerBuilder auth) throws Exception {
            auth.inMemoryAuthentication().withUser("admin").password("admin").roles("BOSS");
            auth.inMemoryAuthentication().withUser("yumin").password("yumin").roles("BOSS");
            auth.inMemoryAuthentication().withUser("yanyuye").password("yanyuye").roles("WORK");
        }

添加了两个BOSS 一个Work

那么我们处理模块二：

写了一个新方法 ：

@PreAuthorize("hasRole('ROLE_BOSS')")
        @GetMapping("/tolk")
        public  String tolk(){
            return "boss is tolking";
        }

这个方法上面写了@PreAuthorize("hasRole('ROLE\_BOSS')")

注意：

这个注解"ROLE\_BOSS"  ROLE\_XXX 是一个前缀

![20190602095846886.png][]

这样的话是不是就可以了？  No  还差一个启动注解

@EnableGlobalMethodSecurity(prePostEnabled = true)

![20190602100001719.png][]

想使用@PreAuthorize("hasRole('Role\_Boss')")  或者@PostAuthorize()  必须在该类上面加上@EnableGlobalMethodSecurity(prePostEnable=true)

case:3

从数据库里面取出数据(模仿拿出数据)

1.首先实现写一个类实现UserDetailsService

@Component
    public class MyUserService implements UserDetailsService {
        @Override
        public UserDetails loadUserByUsername(String s) throws UsernameNotFoundException {
            Collection<GrantedAuthority> collections = getAuthorities();
            return new User("admin", "admin", true, true, true, true, collections);
        }
    
        private Collection<GrantedAuthority> getAuthorities() {
            List<GrantedAuthority> authList = new ArrayList<GrantedAuthority>();
            authList.add(new SimpleGrantedAuthority("ROLE_USER"));
            return authList;
    
        }
    }

然后吧这个类配置到模块一的configuration方法中

@Override
        protected void configure(AuthenticationManagerBuilder auth) throws Exception {
    //        auth.inMemoryAuthentication().withUser("admin").password("admin").roles("BOSS");
    //        auth.inMemoryAuthentication().withUser("yumin").password("yumin").roles("BOSS");
    //        auth.inMemoryAuthentication().withUser("yanyuye").password("yanyuye").roles("WORK");
            auth.userDetailsService(myUserService).passwordEncoder(myPasswordEncoder) ;
        }

手写的注销掉就可以了

然后这个地方我们用到的是

[20190602095846886.png]: /images/20220123/a3a79f48a7854cdc9b88edb9d563aebf.png
[20190602100001719.png]: /images/20220123/0af1f2e3d1264096907cc75ac6875a7b.png