Spring Boot Security + MyBatis 实现登录的安全控制机制

àì夳堔傛蜴生んèń 2022-04-16 03:42 166阅读 0赞

## 篇幅有限,前端的页面代码就不赘述了,直接分享后端逻辑代码: ##

### 1.Maven项目对象依赖文件Pom.xml ###

<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    	xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
    	<modelVersion>4.0.0</modelVersion>
    
    	<groupId>com.weichai</groupId>
    	<artifactId>SpringBootSecurity</artifactId>
    	<version>0.0.1-SNAPSHOT</version>
    	<packaging>jar</packaging>
    
    	<name>SpringBootSecurity</name>
    	<url>http://maven.apache.org</url>
    
    	
    	<parent>
    		<groupId>org.springframework.boot</groupId>
    		<artifactId>spring-boot-starter-parent</artifactId>
    		<version>2.0.0.RELEASE</version>
    		<relativePath />
    	</parent>
    
    	<properties>
    		<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
    		<project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
    		<java.version>1.8</java.version>
    	</properties>
    
    	<dependencies>
    
    		
    		<dependency>
    			<groupId>org.springframework.boot</groupId>
    			<artifactId>spring-boot-starter-web</artifactId>
    		</dependency>
    
    		
    		<dependency>
    			<groupId>org.springframework.boot</groupId>
    			<artifactId>spring-boot-starter-thymeleaf</artifactId>
    		</dependency>
    
    		
    		<dependency>
    			<groupId>org.springframework.boot</groupId>
    			<artifactId>spring-boot-starter-security</artifactId>
    		</dependency>
    
    		
    		<dependency>
    			<groupId>mysql</groupId>
    			<artifactId>mysql-connector-java</artifactId>
    		</dependency>
    
    		
    		<dependency>
    			<groupId>org.mybatis.spring.boot</groupId>
    			<artifactId>mybatis-spring-boot-starter</artifactId>
    			<version>1.3.1</version>
    		</dependency>
    
    		<dependency>
    			<groupId>junit</groupId>
    			<artifactId>junit</artifactId>
    			<version>3.8.1</version>
    			<scope>test</scope>
    		</dependency>
    	</dependencies>
    </project>

## 2.数据接口核心代码 ##

### 2.1 数据表对应实体类 ###

package com.weichai.SpringBootSecurity.entity;
    
    import java.io.Serializable;
    import java.util.List;
    
    /**
     * 用户实体类
     * @author lhy
     * @date 2018.11.15
     */
    public class User implements Serializable {
    
    	private static final long serialVersionUID = 1L;
    	
    	private Long id;
    	private String loginName;
    	private String username;
        private String password;
    
        private List<Role> roles;
    
    	public Long getId() {
    		return id;
    	}
    
    	public void setId(Long id) {
    		this.id = id;
    	}
    
    	public String getLoginName() {
    		return loginName;
    	}
    
    	public void setLoginName(String loginName) {
    		this.loginName = loginName;
    	}
    
    	public String getUsername() {
    		return username;
    	}
    
    	public void setUsername(String username) {
    		this.username = username;
    	}
    
    	public String getPassword() {
    		return password;
    	}
    
    	public void setPassword(String password) {
    		this.password = password;
    	}
    
    	public List<Role> getRoles() {
    		return roles;
    	}
    
    	public void setRoles(List<Role> roles) {
    		this.roles = roles;
    	}
    
    	@Override
    	public String toString() {
    		return "User [id=" + id + ", loginName=" + loginName + ", username=" + username + ", password=" + password
    				+ ", roles=" + roles + "]";
    	}
        
    }

package com.weichai.SpringBootSecurity.entity;
    
    import java.io.Serializable;
    
    /**
     * 用户角色类
     * @author lhy
     * @date 2018.11.15
     */
    public class Role implements Serializable {
    
    	private static final long serialVersionUID = 1L;
    	
    	private Long id;
        private String authority;
    	public Role() {
    		super();
    		// TODO Auto-generated constructor stub
    	}
    	public Long getId() {
    		return id;
    	}
    	public void setId(Long id) {
    		this.id = id;
    	}
    	public String getAuthority() {
    		return authority;
    	}
    	public void setAuthority(String authority) {
    		this.authority = authority;
    	}
    	@Override
    	public String toString() {
    		return "Role [id=" + id + ", authority=" + authority + "]";
    	}
        
    }

package com.weichai.SpringBootSecurity.entity;
    
    import java.io.Serializable;
    
    /**
     * 用户-角色关联类
     * @author lhy
     * @date 2018.11.15
     */
    public class User_role implements Serializable {
    
    	private static final long serialVersionUID = 1L;
    	
    	private Long user_id;
    	private Long role_id;
    	public Long getUser_id() {
    		return user_id;
    	}
    	public void setUser_id(Long user_id) {
    		this.user_id = user_id;
    	}
    	public Long getRole_id() {
    		return role_id;
    	}
    	public void setRole_id(Long role_id) {
    		this.role_id = role_id;
    	}
    	@Override
    	public String toString() {
    		return "User_role [user_id=" + user_id + ", role_id=" + role_id + "]";
    	}
    	
    }

### 2.2 数据访问持久层 ###

package com.weichai.SpringBootSecurity.dao;
    
    import java.util.List;
    
    import org.apache.ibatis.annotations.Many;
    import org.apache.ibatis.annotations.Result;
    import org.apache.ibatis.annotations.Results;
    import org.apache.ibatis.annotations.Select;
    import org.apache.ibatis.mapping.FetchType;
    
    import com.weichai.SpringBootSecurity.entity.Role;
    import com.weichai.SpringBootSecurity.entity.User;
    
    /**
     * 用户数据访问持久层
     * @author lhy
     * @date 2018.11.15
     */
    public interface UserDao {
    
    	// 根据loginName查询用户信息，同时关联查询出用户的权限
    	@Select("select * from tb_user where login_name = #{loginName}")
    	@Results({
    		@Result(id=true,column="id",property="id"),
    		@Result(column="login_name",property="loginName"),  
            @Result(column="password",property="password"),  
            @Result(column="username",property="username"),  
            @Result(column="id",property="roles",
            many=@Many(select="findRoleByUser",
            		fetchType=FetchType.EAGER))
    	})
    	User findByLoginName(String loginName);
    	
    	// 根据用户id关联查询用户的所有权限
    	@Select("select id,authority from tb_role r,tb_user_role ur "
    			+ "where r.id = ur.role_id and user_id = #{id}")
    	List<Role> findRoleByUser(Long id);
    }

### 2.3 服务层 ###

package com.weichai.SpringBootSecurity.service;
    
    import java.util.ArrayList;
    import java.util.List;
    
    import org.springframework.beans.factory.annotation.Autowired;
    import org.springframework.security.core.GrantedAuthority;
    import org.springframework.security.core.authority.SimpleGrantedAuthority;
    import org.springframework.security.core.userdetails.UserDetails;
    import org.springframework.security.core.userdetails.UserDetailsService;
    import org.springframework.security.core.userdetails.UsernameNotFoundException;
    import org.springframework.stereotype.Service;
    
    import com.weichai.SpringBootSecurity.dao.UserDao;
    import com.weichai.SpringBootSecurity.entity.Role;
    import com.weichai.SpringBootSecurity.entity.User;
    
    /**
     * 需要实现UserDetailsService接口
     * 因为在Spring Security中我们配置相关参数需要UserDetailsService类型的数据
     * @author lhy
     * @date 2018.11.15
     */
    @Service
    public class UserService implements UserDetailsService {
    
    	//注入持久层接口UserDao
    	@Autowired
    	UserDao userDao;
    	
    	// 实现接口中的loadUserByUsername方法，通过该方法查询到对应的用户
    	public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
    		// TODO Auto-generated method stub
    		// 调用持久层接口findByLoginName方法查找用户，此处的传进来的参数实际是loginName
    		User user = userDao.findByLoginName(username);
    		System.out.println("登录用户信息 : " + user );
    		if(user == null){
    			System.out.println("不存在该用户");
    			throw new UsernameNotFoundException("用户名不存在");
    		}
    		
    		//创建List集合，用来保存用户权限，GrantedAuthority对象代表赋予给当前用户的权限
    		List<GrantedAuthority> authorities = new ArrayList<GrantedAuthority>();
    		// 获得当前用户权限集合
    		List<Role> roles = user.getRoles();
    		for(Role role : roles){
    			// 将关联对象Role的authority属性保存为用户的认证权限
    			authorities.add(new SimpleGrantedAuthority(role.getAuthority()));
    		}
            // 此处返回的是org.springframework.security.core.userdetails.User类，该类是Spring Security内部的实现
    		 return new org.springframework.security.core.userdetails.User(user.getUsername(), user.getPassword(), authorities);
    	}
    
    }

### 2.4 控制层 ###

package com.weichai.SpringBootSecurity.controller;
    
    import java.util.ArrayList;
    import java.util.List;
    
    import javax.servlet.http.HttpServletRequest;
    import javax.servlet.http.HttpServletResponse;
    
    import org.springframework.security.core.Authentication;
    import org.springframework.security.core.GrantedAuthority;
    import org.springframework.security.core.context.SecurityContextHolder;
    import org.springframework.security.web.authentication.logout.SecurityContextLogoutHandler;
    import org.springframework.stereotype.Controller;
    import org.springframework.ui.Model;
    import org.springframework.web.bind.annotation.RequestMapping;
    
    @Controller
    public class AppController {
    
    	@RequestMapping("/")
    	public String index() {
    		return "index";
    	}
    
    	@RequestMapping(value = "/login")
    	public String login() {
    		return "login";
    	}
    
    	 @RequestMapping("/home")
    	 public String homePage(Model model) {
    		 model.addAttribute("user", getUsername());
    		 model.addAttribute("role", getAuthority());
    	     return "home";
    	 }
    	 
    	@RequestMapping(value = "/admin")
    	public String adminPage(Model model) {
    		model.addAttribute("user", getUsername());
    		model.addAttribute("role", getAuthority());
    		return "admin";
    	}
    
    	@RequestMapping(value = "/dba")
    	public String dbaPage(Model model) {
    		model.addAttribute("user", getUsername());
    		model.addAttribute("role", getAuthority());
    		return "dba";
    	}
    	
        @RequestMapping(value = "/accessDenied")
    	public String accessDeniedPage(Model model) {
    		model.addAttribute("user", getUsername());
    		model.addAttribute("role", getAuthority());
    		return "accessDenied";
    	}
        
        @RequestMapping(value="/logout")
    	public String logoutPage(HttpServletRequest request, HttpServletResponse response) {
    		// Authentication是一个接口，表示用户认证信息
    		Authentication auth = SecurityContextHolder.getContext().getAuthentication();
    		// 如果用户认知信息不为空，注销
    		if (auth != null) {
    			new SecurityContextLogoutHandler().logout(request, response, auth);
    		}
    		// 重定向到login页面
    		return "redirect:/login?logout";
    	}
        
    	/**
    	 * 获得当前用户名称
    	 * @return
    	 */
    	private String getUsername(){
    		// 从SecurityContex中获得Authentication对象代表当前用户的信息
    		String userName = SecurityContextHolder.getContext().getAuthentication().getName();
    		System.out.println("username = " + userName);
    		return userName;
    	}
    	
    	/**
    	 * 获得当前用户权限
    	 * @return
    	 */
    	private String getAuthority() {
    		// 获得Authentication对象，表示用户认证信息。
    		Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
    		List<String> roles = new ArrayList<String>();
    		// 将角色名称添加到List集合
    		for (GrantedAuthority a : authentication.getAuthorities()) {
    			roles.add(a.getAuthority());
    		}
    		System.out.println("role = " + roles);
    		return roles.toString();
    	}
    }

## 3.Spring Boot Security认证处理类 ##

package com.weichai.SpringBootSecurity.security;
    
    import java.io.IOException;
    import java.util.ArrayList;
    import java.util.Collection;
    import java.util.List;
    
    import javax.servlet.http.HttpServletRequest;
    import javax.servlet.http.HttpServletResponse;
    
    import org.springframework.security.core.Authentication;
    import org.springframework.security.core.GrantedAuthority;
    import org.springframework.security.web.DefaultRedirectStrategy;
    import org.springframework.security.web.RedirectStrategy;
    import org.springframework.security.web.authentication.SimpleUrlAuthenticationSuccessHandler;
    import org.springframework.stereotype.Component;
    
    /**
     * 认证处理成功类，验证用户成功后处理不同用户跳转到不同的页面
     * @author lhy
     * @date 2018.11.15
     */
    @Component
    public class AppAuthenticationSuccessHandler extends SimpleUrlAuthenticationSuccessHandler {
    
    	// Spring Security 通过RedirectStrategy对象负责所有重定向事务
    	private RedirectStrategy redirectStrategy = new DefaultRedirectStrategy();
    	
    	/**
    	 * 重写handle方法，方法中通过RedirectStrategy对象重定向到指定的url
    	 */
    	protected void handle(HttpServletRequest request, HttpServletResponse response,Authentication authentication) throws IOException{
    		//通过determineTargetUrl方法返回需要跳转的url 
    		String targetUrl = determineTargetUrl(authentication);
    		// 重定向请求到指定的url
    		redirectStrategy.sendRedirect(request, response, targetUrl);
    	}
        
    	/**
    	 * 从Authentication对象中提取角色提取当前登录用户的角色，并根据其角色返回适当的URL。
    	 * @param authentication
    	 * @return
    	 */
    	private String determineTargetUrl(Authentication authentication) {
    		// TODO Auto-generated method stub
    		String url = "";
    		
    		// 获取当前登录用户的角色权限集合
    		Collection<? extends GrantedAuthority> authorities = authentication.getAuthorities();
    		
    		//定义一个集合保存角色信息
    		List<String> roles = new ArrayList<String>();
    		
    		//将角色名称添加到List集合
    		for(GrantedAuthority a : authorities){
    			roles.add(a.getAuthority());
    		}
    		
    		//判断不同角色跳转到不同的url
    		if(isAdmin(roles)){
    			url = "/admin";
    		}else if(isUser(roles)){
    			url = "/home";
    		}else{
    			url = "/accessDenied";
    		}
    		System.out.println("url = " + url);
    		return url;
    	}
    	
    	/**
    	 * 判断用户角色是否为ROLE_USER
    	 * @param roles
    	 * @return
    	 */
    	private boolean isUser(List<String> roles) {
    		if (roles.contains("ROLE_USER")) {
    			return true;
    		}
    		return false;
    	}
    
    	/**
    	 * 判断用户角色是否为ROLE_ADMIN
    	 * @param roles
    	 * @return
    	 */
    	private boolean isAdmin(List<String> roles) {
    		if (roles.contains("ROLE_ADMIN")) {
    			return true;
    		}
    		return false;
    	}
    
    	public RedirectStrategy getRedirectStrategy() {
    		return redirectStrategy;
    	}
    
    	public void setRedirectStrategy(RedirectStrategy redirectStrategy) {
    		this.redirectStrategy = redirectStrategy;
    	}
    	
    }

package com.weichai.SpringBootSecurity.security;
    
    import org.springframework.beans.factory.annotation.Autowired;
    import org.springframework.context.annotation.Bean;
    import org.springframework.context.annotation.Configuration;
    import org.springframework.security.authentication.AuthenticationProvider;
    import org.springframework.security.authentication.dao.DaoAuthenticationProvider;
    import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
    import org.springframework.security.config.annotation.web.builders.HttpSecurity;
    import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
    import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
    import org.springframework.security.crypto.password.PasswordEncoder;
    
    import com.weichai.SpringBootSecurity.service.UserService;
    
    /**
     * 自定义Spring Security认证处理类的时候
     * 我们需要继承自WebSecurityConfigurerAdapter来完成，相关配置重写对应 方法即可。 
     * @author lhy
     * @date 2018.11.15
     */
    @Configuration
    public class AppSecurityConfigurer extends WebSecurityConfigurerAdapter {
    
    	// 依赖注入用户服务类
    	@Autowired
    	private UserService userService;
    	
    	// 依赖注入加密接口
    	@Autowired
    	private PasswordEncoder passwordEncoder;
    	
    	//依赖注入用户认证接口
    	@Autowired 
    	private AuthenticationProvider authenticationProvider;
    	
    	// 依赖注入认证处理成功类，验证用户成功后处理不同用户跳转到不同的页面
    	@Autowired
    	AppAuthenticationSuccessHandler appAuthenticationSuccessHandler;
    	
    	/**
    	 * BCryptPasswordEncoder是Spring Security提供的PasswordEncoder接口是实现类
    	 * 用来创建密码的加密程序，避免明文存储密码到数据库
    	 * @return
    	 */
    	@Bean
        public PasswordEncoder passwordEncoder() {
            return new BCryptPasswordEncoder();
        }
    	
    	/**
    	 * DaoAuthenticationProvider是Spring Security提供AuthenticationProvider的实现
    	 * @return
    	 */
    	@Bean
        public AuthenticationProvider authenticationProvider() {
    		// 创建DaoAuthenticationProvider对象
    		DaoAuthenticationProvider provider = new DaoAuthenticationProvider();
    		// 不要隐藏"用户未找到"的异常
    		provider.setHideUserNotFoundExceptions(false);
    		// 通过重写configure方法添加自定义的认证方式。
    		provider.setUserDetailsService(userService);
    		// 设置密码加密程序认证(此处需在添加用户时对数据进行加密,校验才有效)
    		provider.setPasswordEncoder(passwordEncoder);
    		return provider;
    	}
    	
    	protected void configure(AuthenticationManagerBuilder auth) throws Exception {
    		System.out.println("AppSecurityConfigurer configure auth......");
        	// 设置认证方式。
    		auth.authenticationProvider(authenticationProvider);
    	}
    	
    	/**
    	 * 设置了登录页面，而且登录页面任何人都可以访问，然后设置了登录失败地址，也设置了注销请求，注销请求也是任何人都可以访问的。 
         * permitAll表示该请求任何人都可以访问，.anyRequest().authenticated(),表示其他的请求都必须要有权限认证。
    	 */
        protected void configure(HttpSecurity http) throws Exception {
        	System.out.println("开始页面拦截...");
        	System.out.println("AppSecurityConfigurer configure http......");
        	http.authorizeRequests()                                               //开始请求权限配置
        	// spring-security 5.0 之后需要过滤静态资源
        	.antMatchers("/login","/css/**","/js/**","/img/*").permitAll()         //请求匹配"/login",所有用户都可以访问
        	.antMatchers("/", "/home").hasRole("USER")                             //请求匹配"/"和"/home",拥有"USER"角色的用户可以访问
        	.antMatchers("/admin/**").hasAnyRole("ADMIN", "DBA")                   //请求匹配/admin/**,拥有"ADMIN"和"DBA"角色的用户可以访问
    	  	.anyRequest().authenticated()                                          //其余所有请求都需要认证(用户登录)之后才可以访问 
    	  	.and()
    	  	.formLogin().loginPage("/login").successHandler(appAuthenticationSuccessHandler)   //开始设置登录操作
    	  	.usernameParameter("loginName").passwordParameter("password")                      //登录时接收传递的参数,用户名和密码
    	  	.and()
    	  	.logout().permitAll()                                                              //设置注销操作
    	  	.and() 
    	  	.exceptionHandling().accessDeniedPage("/accessDenied");                            //指定异常处理页面
        }
    }