Spring Boot整合Spring Security(简单数据库连接)

╰+攻爆jí腚メ 2022-11-20 05:52 200阅读 0赞

1.引入pom依赖

<dependency>
    			<groupId>org.springframework.boot</groupId>
    			<artifactId>spring-boot-starter-security</artifactId>
    		</dependency>
    		
    		
    		<dependency>
    			<groupId>com.alibaba</groupId>
    			<artifactId>fastjson</artifactId>
    			<version>1.2.4</version>
    		</dependency>
    		<dependency>
    			<groupId>cn.hutool</groupId>
    			<artifactId>hutool-all</artifactId>
    			<version>5.4.3</version>
    		</dependency>

2.实现自定义配置，首先要创建一个继承于WebSecurityConfigurerAdapter的配置类。

(1)实现自定义拦截配置，首先得告诉Spring Security，用户信息从哪里获取，以及用户对应的角色等信息。这里就需要重写WebSecurityConfigurerAdapter的configure (AuthenticationManagerBuilder auth)方法了。  
(2)这个方法将指使Spring Security去找到用户列表，然后再与想要通过拦截器的用户进行比对。

import com.example.springboot.filter.CustomAuthenticationFilter;
    import com.example.springboot.handler.FailureHandler;
    import com.example.springboot.handler.OutSuccessHandler;
    import com.example.springboot.handler.PermissionHandler;
    import com.example.springboot.handler.SuccessHandler;
    import com.example.springboot.service.impl.UserLoginServiceImpl;
    import org.springframework.beans.factory.annotation.Autowired;
    import org.springframework.context.annotation.Bean;
    import org.springframework.context.annotation.Configuration;
    import org.springframework.security.authentication.AuthenticationManager;
    import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
    import org.springframework.security.config.annotation.web.builders.HttpSecurity;
    import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
    import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
    import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
    import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
    
    /** * security config. * * @author lxp * @date 2020 -10-19 17:11:48 */
    @Configuration
    //@EnableWebSecurity注解是Spring Security用于启用web安全的注解
    @EnableWebSecurity
    public class SpringSecurityConfig extends WebSecurityConfigurerAdapter { 
    
        @Autowired
        private SuccessHandler successHandler;
    
        @Autowired
        private FailureHandler failureHandler;
    
        @Autowired
        private OutSuccessHandler outSuccessHandler;
    
        @Autowired
        private PermissionHandler permissionHandler;
    
        @Bean
        @Override
        protected AuthenticationManager authenticationManager() throws Exception { 
            return super.authenticationManager();
        }
    
        /** * 注册自定义过滤器 * @return * @throws Exception the exception * @author lxp * @date 2020 -10-23 10:39:28 */
        @Bean
        CustomAuthenticationFilter customAuthenticationFilter() throws Exception { 
            CustomAuthenticationFilter filter = new CustomAuthenticationFilter();
            filter.setAuthenticationSuccessHandler(successHandler);
            filter.setAuthenticationFailureHandler(failureHandler);
            //过滤器拦截的url要和登录的url一致，否则不生效
            filter.setFilterProcessesUrl("/login");
    
            //重用WebSecurityConfigurerAdapter配置的AuthenticationManager，不加要自己组装AuthenticationManager
            filter.setAuthenticationManager(authenticationManagerBean());
            return filter;
        }
    
        /** * 密码加密方式 */
        @Bean
        public BCryptPasswordEncoder passwordEncoder(){ 
            return new BCryptPasswordEncoder();
        }
    
        /** * 自定义UserDetailsService，从数据库中读取用户信息 * @return */
        @Bean
        public UserLoginServiceImpl userLoginService(){ 
            return new UserLoginServiceImpl();
        }
    
        /** * 关联用户认证 * @param auth * @throws Exception the exception * @author lxp * @date 2020 -10-20 10:45:59 */
        @Autowired
        public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception { 
        //告诉Spring Security你的UserDetailsService实现类是哪个就可以了，它会去调用loadUserByUsername()来查找用户
            auth
                    .userDetailsService(userLoginService())
                    .passwordEncoder(passwordEncoder());
    
        }
    
    	//Spring Security的请求拦截配置方法是用户存储配置方法的重载方法
        @Override
        protected void configure(HttpSecurity http) throws Exception { 
            http.authorizeRequests()
                    // 所有用户均可访问的资源（开放的）
                    .antMatchers( "/favicon.ico","/css/**","/common/**","/js/**","/images/**","/druid/**","/login","/logout").permitAll()
                    // hasAnyRole鉴权(对接口进行User或Admin鉴权)
                    .antMatchers( "/test/**","/user/**").hasAnyRole("USER","ADMIN")
                    // hasRole对admin下的接口 需要ADMIN权限
                    .antMatchers("/admin/**").hasRole("ADMIN")
                    // 任何尚未匹配的URL只需要验证用户即可访问
                    .anyRequest().authenticated()
                    //对于没有配置权限的其他请求允许匿名访问
                    //.and().anonymous()
                    // 配置登录功能,失败跳转error
                    .and()
                    //自定义权限(用于json登录)
                    .addFilterAt(customAuthenticationFilter(), UsernamePasswordAuthenticationFilter.class)
    
                    .formLogin()
                    .loginProcessingUrl("/login")
                    // 登陆成功后的处理动作
                    .successHandler(successHandler)
                    // 登陆失败后的处理动作
                    .failureHandler(failureHandler)
    
                    // 配置退出登录页面
                    .and().logout()
                    .logoutUrl("/logout")
                    .logoutSuccessHandler(outSuccessHandler)
    
                    // 权限拒绝的页面
                    .and().exceptionHandling().accessDeniedHandler(permissionHandler)
                    .and().cors()
    
                    // 禁用 csrf,防止跨站（必须要禁用csrf才能使用ajax登录方式）
                    .and().csrf().disable();
        }
    
    }

Spring Security的用户存储配置有多个方案：  
(1)内存用户存储  
(2)数据库用户存储  
(3)LDAP用户存储  
(4)自定义用户存储

下面只介绍自定义用户存储：  
自定义用户存储，就是自行使用认证名称来查找对应的用户数据，然后交给Spring Security使用。我们需要定义一个实现UserDetailsService的service类：

import com.example.springboot.entity.SysUser;
    import com.example.springboot.mapper.SysUserMapper;
    import org.springframework.beans.factory.annotation.Autowired;
    import org.springframework.security.authentication.BadCredentialsException;
    import org.springframework.security.core.AuthenticationException;
    import org.springframework.security.core.GrantedAuthority;
    import org.springframework.security.core.authority.SimpleGrantedAuthority;
    import org.springframework.security.core.userdetails.User;
    import org.springframework.security.core.userdetails.UserDetails;
    import org.springframework.security.core.userdetails.UserDetailsService;
    import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
    import org.springframework.stereotype.Service;
    
    import java.util.ArrayList;
    import java.util.Collection;
    import java.util.List;
    
    /** * User login service. * * @author lxp * @date 2020 -10-20 10:43:53 */
    @Service
    public class UserLoginServiceImpl implements UserDetailsService { 
    
        @Autowired
        private SysUserMapper sysUserMapper;
    
        @Override
        public UserDetails loadUserByUsername(String username) throws AuthenticationException { 
            SysUser query = new SysUser();
            query.setUsername(username);
            SysUser user = sysUserMapper.selectOne(query);
    
            //权限集合
            Collection<GrantedAuthority> collection = new ArrayList<>();
    
            if (user == null) { 
                throw new BadCredentialsException("用户" + username +"不存在！");
            }
    
            // hasRole方法拼接ROLE_
            List<GrantedAuthority> grantedAuthorities = new ArrayList<>();
            GrantedAuthority grantedAuthority = new SimpleGrantedAuthority("ROLE_"+user.getUsername().toUpperCase());
            grantedAuthorities.add(grantedAuthority);
    
            // 把获得的账号密码传给security的User
            //注意自定义配置类对密码什么加密方式，这里就调用什么加密方式。
            return new User(user.getUsername(),new BCryptPasswordEncoder().encode(user.getPassword()),grantedAuthorities);
        }
    }

说明：  
该类只需要实现一个方法：loadUserByUsername()。该方法需要做的是使用传过来的username来匹配一个带有密码等信息的用户实体。需要注意的是这里的User类需要实现UserDetails，也就是说，查到的信息里，必须得有Spring Security所需要的信息。

4.自定义配置类SpringSecurityConfig 请求拦截说明：  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM5NjI5Mjc3_size_16_color_FFFFFF_t_70_pic_center]  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM5NjI5Mjc3_size_16_color_FFFFFF_t_70_pic_center 1]  
5.如果需要json登录需要配置过滤器：

import com.fasterxml.jackson.databind.ObjectMapper;
    import lombok.extern.slf4j.Slf4j;
    import org.springframework.http.MediaType;
    import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
    import org.springframework.security.core.Authentication;
    import org.springframework.security.core.AuthenticationException;
    import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
    
    import javax.servlet.http.HttpServletRequest;
    import javax.servlet.http.HttpServletResponse;
    import java.io.IOException;
    import java.io.InputStream;
    import java.util.Map;
    
    /** * 自定义过滤器 * * @author lxp * @date 2020 -10-23 10:17:58 */
    @Slf4j
    public class CustomAuthenticationFilter extends UsernamePasswordAuthenticationFilter { 
    
        @Override
        public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response) throws AuthenticationException { 
    // if (request.getContentType() == null) { 
    // throw new AuthenticationServiceException("未登录");
    // }
    
            if (request.getContentType().equals(MediaType.APPLICATION_JSON_UTF8_VALUE)
                    || request.getContentType().equals(MediaType.APPLICATION_JSON_VALUE)) { 
                ObjectMapper mapper = new ObjectMapper();
                UsernamePasswordAuthenticationToken authRequest = null;
                try (InputStream is = request.getInputStream()) { 
                    Map<String,String> authenticationBean = mapper.readValue(is, Map.class);
                    authRequest = new UsernamePasswordAuthenticationToken(
                            authenticationBean.get("username"), authenticationBean.get("password"));
                } catch (IOException e) { 
                    e.printStackTrace();
                    authRequest = new UsernamePasswordAuthenticationToken(
                            "", "");
                } finally { 
                    setDetails(request, authRequest);
                    return this.getAuthenticationManager().authenticate(authRequest);
                }
            }
            else { 
                return super.attemptAuthentication(request, response);
            }
        }
    }

6.自定义配置类SpringSecurityConfig中登录成功、失败、权限、退出登录处理：

(1)登录成功处理类：

import cn.hutool.core.lang.Dict;
    import cn.hutool.core.util.CharsetUtil;
    import cn.hutool.extra.servlet.ServletUtil;
    import cn.hutool.http.ContentType;
    import cn.hutool.json.JSONUtil;
    import lombok.extern.slf4j.Slf4j;
    import org.springframework.security.core.Authentication;
    import org.springframework.security.core.context.SecurityContextHolder;
    import org.springframework.security.web.authentication.AuthenticationSuccessHandler;
    import org.springframework.stereotype.Component;
    
    import javax.servlet.ServletException;
    import javax.servlet.http.HttpServletRequest;
    import javax.servlet.http.HttpServletResponse;
    import java.io.IOException;
    
    /** * The type Success handler. * * @author lxp * @date 2020 -10-22 14:59:38 */
    @Slf4j
    @Component
    public class SuccessHandler implements AuthenticationSuccessHandler { 
        @Override
        public void onAuthenticationSuccess(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, Authentication authentication) throws IOException, ServletException { 
    
            // authentication 登录成功的对象，默认用户名
            log.info("登录成功，{}", authentication);
    
            // 跨域处理
            httpServletResponse.setHeader("Access-Control-Allow-Origin", "*");
            // 允许的请求方法
            httpServletResponse.setHeader("Access-Control-Allow-Methods", "GET,POST,OPTIONS,PUT,DELETE");
            // 允许的请求头
            httpServletResponse.setHeader("Access-Control-Allow-Headers", httpServletRequest.getHeader("Access-Control-Request-Headers"));
            // 设置响应头
            httpServletResponse.setContentType("application/json;charset=utf-8");
    
            authentication = SecurityContextHolder.getContext().getAuthentication();
    
            // 返回值
            // 拼装数据返回对象
            Dict res = Dict.create().set("code", 0).set("msg", "登录成功").set("data", authentication);
    
            // 设置一下输出json字符串时的编码
            String contentType = ContentType.JSON.toString(CharsetUtil.CHARSET_UTF_8);
    
            // 响应json字符串
            ServletUtil.write(httpServletResponse, JSONUtil.toJsonStr(res), contentType);
        }
    }

(2)登录失败处理类：

import cn.hutool.core.lang.Dict;
    import cn.hutool.core.util.CharsetUtil;
    import cn.hutool.extra.servlet.ServletUtil;
    import cn.hutool.http.ContentType;
    import cn.hutool.json.JSONUtil;
    import lombok.extern.slf4j.Slf4j;
    import org.springframework.security.authentication.*;
    import org.springframework.security.core.AuthenticationException;
    import org.springframework.security.core.userdetails.UsernameNotFoundException;
    import org.springframework.security.web.authentication.AuthenticationFailureHandler;
    import org.springframework.stereotype.Component;
    
    import javax.servlet.ServletException;
    import javax.servlet.http.HttpServletRequest;
    import javax.servlet.http.HttpServletResponse;
    import java.io.IOException;
    
    /** * The type Failure handler. * * @author lxp * @date 2020 -10-22 14:59:41 */
    @Slf4j
    @Component
    public class FailureHandler implements AuthenticationFailureHandler { 
        @Override
        public void onAuthenticationFailure(
                HttpServletRequest request, HttpServletResponse response,
                AuthenticationException exception
        ) throws IOException, ServletException { 
            log.info("登录失败，{}", exception);
            Dict res = Dict.create().set("code", 1000).set("msg", "登录失败");
    
            // 根据返回的异常类，确定登录失败的原因
            if (exception instanceof UsernameNotFoundException) { 
                res.set("data", "用户名不存在");
            } else if (exception instanceof LockedException) { 
                res.set("data", "账号被锁定");
            } else if (exception instanceof DisabledException) { 
                res.set("data", "账号被禁用");
            } else if (exception instanceof CredentialsExpiredException) { 
                res.set("data", "密码过期");
            } else if (exception instanceof AccountExpiredException) { 
                res.set("data", "账号过期");
            } else if (exception instanceof BadCredentialsException) { 
                res.set("data", "账号密码输入有误");
            } else { 
                res.set("data", "登录失败（" + exception.getMessage() + "）");
            }
    
            // 响应json字符串
            String contentType = ContentType.JSON.toString(CharsetUtil.CHARSET_UTF_8);
            ServletUtil.write(response, JSONUtil.toJsonStr(res), contentType);
        }
    }

(3)权限不足处理类：

import com.alibaba.fastjson.JSON;
    import com.example.springboot.common.Response;
    import org.springframework.security.access.AccessDeniedException;
    import org.springframework.security.web.access.AccessDeniedHandler;
    import org.springframework.stereotype.Component;
    
    import javax.servlet.ServletException;
    import javax.servlet.http.HttpServletRequest;
    import javax.servlet.http.HttpServletResponse;
    import java.io.IOException;
    
    /** * Created by Administrator on 2020/10/23. */
    @Component
    public class PermissionHandler implements AccessDeniedHandler { 
        @Override
        public void handle(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, AccessDeniedException e) throws IOException, ServletException { 
            // 设置响应头
            httpServletResponse.setContentType("application/json;charset=utf-8");
            // 返回值
            Response result = Response.createBySuccessWithoutData("权限不足，无法登陆");
            httpServletResponse.getWriter().write(JSON.toJSONString(result));
        }
    }

(4)退出登录处理类：

import com.alibaba.fastjson.JSON;
    import com.example.springboot.common.Response;
    import org.springframework.security.core.Authentication;
    import org.springframework.security.web.authentication.logout.LogoutSuccessHandler;
    import org.springframework.stereotype.Component;
    
    import javax.servlet.ServletException;
    import javax.servlet.http.HttpServletRequest;
    import javax.servlet.http.HttpServletResponse;
    import java.io.IOException;
    
    /** * The type Out success handler. * * @author lxp * @date 2020 -10-22 14:59:33 */
    @Component
    public class OutSuccessHandler implements LogoutSuccessHandler { 
        @Override
        public void onLogoutSuccess(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, Authentication authentication) throws IOException, ServletException { 
            // 设置响应头
            httpServletResponse.setContentType("application/json;charset=utf-8");
            // 返回值
            Response result = Response.createBySuccessWithoutData("退出登陆成功");
            httpServletResponse.getWriter().write(JSON.toJSONString(result));
        }
    }

7.实体类SysUser：

import lombok.Data;
    import org.springframework.security.core.GrantedAuthority;
    import org.springframework.security.core.userdetails.UserDetails;
    
    import javax.persistence.GeneratedValue;
    import javax.persistence.GenerationType;
    import javax.persistence.Id;
    import javax.persistence.Table;
    import java.io.Serializable;
    import java.util.Collection;
    import java.util.List;
    
    @Data
    @Table(name = "sys_user")
    public class SysUser implements UserDetails,Serializable { 
        @Id
        @GeneratedValue(strategy = GenerationType.IDENTITY)
        private String id;
    
        private String username;
    
        private String password;
    
        private List<? extends GrantedAuthority> authorities;
    
        @Override
        public Collection<? extends GrantedAuthority> getAuthorities() { 
            return authorities;
        }
    
        @Override
        public boolean isAccountNonExpired() { 
            return true;
        }
    
        @Override
        public boolean isAccountNonLocked() { 
            return true;
        }
    
        @Override
        public boolean isCredentialsNonExpired() { 
            return true;
        }
    
        @Override
        public boolean isEnabled() { 
            return true;
        }
    }

实体类User:

import java.io.Serializable;
    
    import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
    import lombok.Data;
    
    import javax.persistence.Column;
    import javax.persistence.Id;
    import javax.persistence.Table;
    
    /** * The type User. * * @author lxp * @date 2020 -10-19 15:10:03 */
    @Data
    @Table(name = "user")
    @JsonIgnoreProperties(ignoreUnknown = true)
    public class User implements Serializable { 
    
        private static final long serialVersionUID = 1222221L;
    
        @Id
        @Column(name = "id")
        private Integer id;
    
        @Column(name = "user_name")
        private String userName;
    
        @Column(name = "pass_word")
        private String passWord;
    
        @Column(name = "real_name")
        private String realName;
    }

8.其他类：接口、实现类、mapper在上一篇博客。

9.编写测试类：

import com.example.springboot.common.Response;
    import com.example.springboot.entity.User;
    import com.example.springboot.service.UserService;
    import org.springframework.beans.factory.annotation.Autowired;
    import org.springframework.beans.factory.annotation.Value;
    import org.springframework.web.bind.annotation.GetMapping;
    import org.springframework.web.bind.annotation.PostMapping;
    import org.springframework.web.bind.annotation.RequestParam;
    import org.springframework.web.bind.annotation.RestController;
    
    /** * 测试类模块 * * @author lxp * @date 2020 -10-19 14:50:51 */
    @RestController
    public class TestController { 
    
        @Value("${server.port}")
        String port;
    
        @Autowired
        private UserService userService;
    
        @GetMapping(value = "/test")
        public String test(@RequestParam(required = false) Integer id){ 
            User user = userService.getUserInfo(id);
            StringBuilder stringBuilder = new StringBuilder("欢迎进入"+port+"号客户端!"+"<br>"+"人员名称是:"+user.getUserName());
            return stringBuilder.toString();
        }
    
        @PostMapping(value = "/user/testUser")
        public String testUser(){ 
            StringBuilder stringBuilder = new StringBuilder("欢迎==员工==登录！");
            return stringBuilder.toString();
        }
    
        @PostMapping(value = "/admin/testAdmin")
        public String testAdmin(){ 
            StringBuilder stringBuilder = new StringBuilder("欢迎==管理员==登录！");
            return stringBuilder.toString();
        }
    
    }

管理员登录：  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM5NjI5Mjc3_size_16_color_FFFFFF_t_70_pic_center 2]  
管理员权限接口成功：  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM5NjI5Mjc3_size_16_color_FFFFFF_t_70_pic_center 3]  
用户登录成功：  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM5NjI5Mjc3_size_16_color_FFFFFF_t_70_pic_center 4]  
用户登录管理员权限接口：  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM5NjI5Mjc3_size_16_color_FFFFFF_t_70_pic_center 5]

[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM5NjI5Mjc3_size_16_color_FFFFFF_t_70_pic_center]: /images/20221120/01a3b079f16e41f0be0912639a3ea529.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM5NjI5Mjc3_size_16_color_FFFFFF_t_70_pic_center 1]: /images/20221120/0ac13c13778144c9a7e62c5d352ce298.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM5NjI5Mjc3_size_16_color_FFFFFF_t_70_pic_center 2]: /images/20221120/fe8377d03c394daa9d6c4d63155cc058.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM5NjI5Mjc3_size_16_color_FFFFFF_t_70_pic_center 3]: /images/20221120/eff5aebe46c2480d8907f3e0513d4859.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM5NjI5Mjc3_size_16_color_FFFFFF_t_70_pic_center 4]: /images/20221120/25b2a035ac3043318a8f231e04f900dc.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM5NjI5Mjc3_size_16_color_FFFFFF_t_70_pic_center 5]: /images/20221120/1234dca2116b4e138b4fd602857dd0b1.png