day08【后台】权限控制-上

今天药忘吃喽~ 2022-12-08 14:26 148阅读 0赞

# day08【后台】权限控制-上 #

## 1、密码加密 ##

### 1.1、PasswordEncoder接口 ###

*  `PasswordEncoder`接口的代码如下：
    
     *  将明文密码加密为密文密码
     *  判断明文密码是否与密文密码一致

public interface PasswordEncoder {
        
    
    	/**
    	 * Encode the raw password. Generally, a good encoding algorithm applies a SHA-1 or
    	 * greater hash combined with an 8-byte or greater randomly generated salt.
    	 */
    	String encode(CharSequence rawPassword);
    
    	/**
    	 * Verify the encoded password obtained from storage matches the submitted raw
    	 * password after it too is encoded. Returns true if the passwords match, false if
    	 * they do not. The stored password itself is never decoded.
    	 *
    	 * @param rawPassword the raw password to encode and match
    	 * @param encodedPassword the encoded password from storage to compare with
    	 * @return true if the raw password, after encoding, matches the encoded password from
    	 * storage
    	 */
    	boolean matches(CharSequence rawPassword, String encodedPassword);
    
    }

### 1.2、自定义加密规则 ###

*  自定义加密规则：`MyPasswordEncoder.java`

![image-20200617210026056][]

@Component
    public class MyPasswordEncoder implements PasswordEncoder {
        
    
    	@Override
    	public String encode(CharSequence rawPassword) {
        
    		
    		return privateEncode(rawPassword);
    		
    	}
    
    	@Override
    	public boolean matches(CharSequence rawPassword, String encodedPassword) {
        
    		
    		// 1.对明文密码进行加密
    		String formPassword = privateEncode(rawPassword);
    		
    		// 2.声明数据库密码
    		String databasePassword = encodedPassword;
    		
    		// 3.比较
    		return Objects.equals(formPassword, databasePassword);
    	}
    	
    	private String privateEncode(CharSequence rawPassword) {
        
    		try {
        
    			// 1.创建MessageDigest对象
    			String algorithm = "MD5";
    			MessageDigest messageDigest = MessageDigest.getInstance(algorithm);
    			
    			// 2.获取rawPassword的字节数组
    			byte[] input = ((String)rawPassword).getBytes();
    			
    			// 3.加密
    			byte[] output = messageDigest.digest(input);
    			
    			// 4.转换为16进制数对应的字符
    			String encoded = new BigInteger(1, output).toString(16).toUpperCase();
    			
    			return encoded;
    			
    		} catch (NoSuchAlgorithmException e) {
        
    			e.printStackTrace();
    			return null;
    		}
    	}
    
    }

### 1.3、注入自定义加密规则 ###

*  在`WebAppSecurityConfig.java`配置类中注入自定义加密规则

![image-20200617210929062][]

@Autowired
    private MyPasswordEncoder myPasswordEncoder;
    
    @Override
    protected void configure(AuthenticationManagerBuilder builder) throws Exception {
        
        /*
    		builder
    			.inMemoryAuthentication()			// 在内存中完成账号、密码的检查
    			.withUser("tom")					// 指定账号
    			.password("123123")					// 指定密码
    			.roles("ADMIN","学徒")				// 指定当前用户的角色
    			.and()
    			.withUser("jerry")					// 指定账号
    			.password("123123")					// 指定密码
    			.authorities("UPDATE","内门弟子")		// 指定当前用户的权限
    			;
    		*/
    
        // 装配userDetailsService对象
        builder
            .userDetailsService(myUserDetailsService)
            .passwordEncoder(myPasswordEncoder)
            ;
    
    }

### 1.4、测试 ###

*  将数据库密码修改为密文

![image-20200617211145976][]

*  成功登陆~

![image-20200617211250409][]

## 2、带盐值的加密 ##

### 2.1、概念 ###

借用生活中烹饪时加盐值不同， 菜肴的味道不同这个现象， 在加密时每次使用一个随机生成的盐值， 让加密结果不固定

![image-20200919195949522][]

### 2.2、测试BCryptPasswordEncoder ###

*  新建测试类`SecurityTest.java`，测试带盐值的加密

![image-20200617222634183][]

public class SecurityTest {
        
    	
    	public static void main(String[] args) {
        
    		
    		// 1.创建BCryptPasswordEncoder对象
    		BCryptPasswordEncoder passwordEncoder = new BCryptPasswordEncoder();
    		
    		// 2.准备明文字符串
    		String rawPassword = "123123";
    		
    		// 3.加密
    		String encode = passwordEncoder.encode(rawPassword);
    		System.out.println(encode);
    		// $2a$10$3YODojJmtbcOzHqB6bjZhO2CR7l9pPDfxBsnYz2voBHw5Ro.5bMAm
    		// $2a$10$UeZXBF9bPMipZuFp0djjj.vnShI2J097JtgGHAZX5mtJ49FMiP6XK
    		// $2a$10$ucdma3RFSGVgNc30nGxu9Oku66A4zHNbaxTgxRq4ucpbw7ZmeK.8m
    		// $2a$10$kpGqUaCvRGA5rE0.GNyvGugHBPZPM8bKQ96KJl9vxyx/N3bif72OS
    		// $2a$10$MSDMkdzhHGIj8o6A7RUa7Oe3Iww13jy7IQRCEG.aOJa6/uI2U/Pem
    	}
    
    }
    
    class EncodeTest {
        
    	
    	public static void main(String[] args) {
        
    		
    		// 1.准备明文字符串
    		String rawPassword = "123123";
    		
    		// 2.准备密文字符串
    		String encodedPassword = "$2a$10$ucdma3RFSGVgNc30nGxu9Oku66A4zHNbaxTgxRq4ucpbw7ZmeK.8m";
    		
    		// 3.创建BCryptPasswordEncoder对象
    		BCryptPasswordEncoder passwordEncoder = new BCryptPasswordEncoder();
    		
    		// 4.比较
    		boolean matcheResult = passwordEncoder.matches(rawPassword, encodedPassword);
    		
    		// 一致
    		System.out.println(matcheResult ? "一致" : "不一致");
    	}
    	
    }

### 2.3、带盐值的验证 ###

*  重写`configure`方法：使用`BCryptPasswordEncoder`进行加密

// 每次调用这个方法时会检查IOC容器中是否有了对应的bean，如果有就不会真正执行这个函数，因为bean默认是单例的
    // 也可以使用@Scope(value="")注解控制是否单例
    @Bean
    public BCryptPasswordEncoder getBCryptPasswordEncoder() {
        
        return new BCryptPasswordEncoder();
    }
    
    @Override
    protected void configure(AuthenticationManagerBuilder builder) throws Exception {
        
        /*
    		builder
    			.inMemoryAuthentication()			// 在内存中完成账号、密码的检查
    			.withUser("tom")					// 指定账号
    			.password("123123")					// 指定密码
    			.roles("ADMIN","学徒")				// 指定当前用户的角色
    			.and()
    			.withUser("jerry")					// 指定账号
    			.password("123123")					// 指定密码
    			.authorities("UPDATE","内门弟子")		// 指定当前用户的权限
    			;
    		*/
    
        // 装配userDetailsService对象
        builder
            .userDetailsService(myUserDetailsService)
            .passwordEncoder(getBCryptPasswordEncoder())
            ;
    
    }

*  修改`Heygo`的密码（注意：如果`userpswd`长度一定要 `>=` 密码长度）

![image-20200617223435942][]

*  照样能正常访问~~~

![image-20200617224041799][]

## 3、项目加入SpringSecurity环境 ##

### 3.1、引入依赖 ###

#### 3.1.1、父工程中统一管理版本 ####

*  在父工程`parent`中，添加统一的依赖版本

![image-20200617225512695][]

<properties>
        
        <atguigu.spring.version>4.3.20.RELEASE</atguigu.spring.version>
        
        <atguigu.spring.security.version>4.2.10.RELEASE</atguigu.spring.security.version>
    </properties>
    
    <dependencies>
        
        
        
        
        <dependency>
            <groupId>org.springframework.security</groupId>
            <artifactId>spring-security-web</artifactId>
            <version>${atguigu.spring.security.version}</version>
        </dependency>
        
        <dependency>
            <groupId>org.springframework.security</groupId>
            <artifactId>spring-security-config</artifactId>
            <version>${atguigu.spring.security.version}</version>
        </dependency>
        
        <dependency>
            <groupId>org.springframework.security</groupId>
            <artifactId>spring-security-taglibs</artifactId>
            <version>${atguigu.spring.security.version}</version>
        </dependency>
    </dependencies>

#### 3.1.2、子工程中引入依赖 ####

*  在`component`工程中引入`SpringSecurity`的依赖

![image-20200617225852001][]

<dependency>
        <groupId>org.springframework.security</groupId>
        <artifactId>spring-security-web</artifactId>
    </dependency>
    
    <dependency>
        <groupId>org.springframework.security</groupId>
        <artifactId>spring-security-config</artifactId>
    </dependency>
    
    <dependency>
        <groupId>org.springframework.security</groupId>
        <artifactId>spring-security-taglibs</artifactId>
    </dependency>

### 3.2、配置DelegatingFilterProxy ###

*  在`web.xml`中配置`DelegatingFilterProxy`

![image-20200617225938179][]

<filter>
        <filter-name>springSecurityFilterChain</filter-name>
        <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
    </filter>
    <filter-mapping>
        <filter-name>springSecurityFilterChain</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>

### 3.3、创建基注解的配置类 ###

*  在`component`工程下创建`SpringSecurity`的配置类

![image-20200617230150789][]

// 表示当前类是一个配置类
    @Configuration
    
    // 启用Web环境下权限控制功能
    @EnableWebSecurity
    public class WebAppSecurityConfig extends WebSecurityConfigurerAdapter {
        
    	
    }

### 3.4、谁来扫描WebAppSecurityConfig？ ###

*  结论： 为了让 `SpringSecurity` 能够针对浏览器请求进行权限控制， 需要让`SpringMVC` 来扫描 `WebAppSecurityConfig` 类。
 *  衍生问题： `DelegatingFilterProxy` 初始化`Filter`时需要一个 `bean`，这就需要到 `IOC` 容器中去查找，至于去哪个`IOC`容器查找，这就要看是谁扫描了 `WebAppSecurityConfig`。
    
     *  如果是 `Spring` 扫描了 `WebAppSecurityConfig`， 那么 `Filter` 需要的 `bean` 就在`Spring` 的 `IOC` 容器。
     *  如果是 `SpringMVC` 扫描了 `WebAppSecurityConfig`， 那么 `Filter` 需要的 `bean`就在 `SpringMVC` 的 `IOC` 容器。

### 3.5、当头一棒 ###

#### 3.5.1、找不到bean ####

*  启动`web`应用，抛出异常：`org.springframework.beans.factory.NoSuchBeanDefinitionException: No bean named 'springSecurityFilterChain' available`

![image-20200618104939591][]

#### 3.5.2、分析原因 ####

*  明确三大组件启动顺序
    
     *  首先： `ContextLoaderListener` 初始化， 创建 `Spring` 的 `IOC` 容器
     *  其次： `DelegatingFilterProxy` 初始化， 查找 `IOC` 容器、 查找 `bean`
     *  最后： `DispatcherServlet` 初始化， 创建 `SpringMVC` 的 IOC 容器
 *  `DelegatingFilterProxy` 查找 `IOC` 容器，然后在 `IOC` 容器中查找 `bean` 的工作机制

![image-20200618105700854][]

### 3.6、看源码 ###

#### 3.6.1、在Spring ICO容器中查找 ####

*  在`DelegatingFilterProxy`类中的如下代码处打上断点，`initFilterBean()`方法负责初始化`Filter`

![image-20200618110828514][]

private volatile Filter delegate;
    
    @Override
    protected void initFilterBean() throws ServletException {
        
        synchronized (this.delegateMonitor) {
        
            if (this.delegate == null) {
        
                // If no target bean name specified, use filter name.
                if (this.targetBeanName == null) {
        
                    this.targetBeanName = getFilterName();
                }
                // Fetch Spring root application context and initialize the delegate early,
                // if possible. If the root application context will be started after this
                // filter proxy, we'll have to resort to lazy initialization.
                WebApplicationContext wac = findWebApplicationContext();
                if (wac != null) {
        
                    this.delegate = initDelegate(wac);
                }
            }
        }
    }

*  `Step into`进入`findWebApplicationContext()`方法：寻找`IOC`容器
    
     *  `if (this.webApplicationContext != null) {`成立
     *  `if (attrName != null) {`成立

![image-20200618111022162][]

protected WebApplicationContext findWebApplicationContext() {
        
        if (this.webApplicationContext != null) {
        
            // The user has injected a context at construction time -> use it...
            if (this.webApplicationContext instanceof ConfigurableApplicationContext) {
        
                ConfigurableApplicationContext cac = (ConfigurableApplicationContext) this.webApplicationContext;
                if (!cac.isActive()) {
        
                    // The context has not yet been refreshed -> do so before returning it...
                    cac.refresh();
                }
            }
            return this.webApplicationContext;
        }
        String attrName = getContextAttribute();
        if (attrName != null) {
        
            return WebApplicationContextUtils.getWebApplicationContext(getServletContext(), attrName);
        }
        else {
        
            return WebApplicationContextUtils.findWebApplicationContext(getServletContext());
        }
    }

*  `Step into`进入`WebApplicationContextUtils.findWebApplicationContext(getServletContext())`方法：寻找`IOC`容器

![image-20200618111440279][]

public static WebApplicationContext findWebApplicationContext(ServletContext sc) {
        
        WebApplicationContext wac = getWebApplicationContext(sc);
        if (wac == null) {
        
            Enumeration<String> attrNames = sc.getAttributeNames();
            while (attrNames.hasMoreElements()) {
        
                String attrName = attrNames.nextElement();
                Object attrValue = sc.getAttribute(attrName);
                if (attrValue instanceof WebApplicationContext) {
        
                    if (wac != null) {
        
                        throw new IllegalStateException("No unique WebApplicationContext found: more than one " +
                                                        "DispatcherServlet registered with publishContext=true?");
                    }
                    wac = (WebApplicationContext) attrValue;
                }
            }
        }
        return wac;
    }

*  `Step into`进入`getWebApplicationContext(sc)`方法中：从`ServletContext`中获取`IOC`容器

![image-20200618111502379][]

String ROOT_WEB_APPLICATION_CONTEXT_ATTRIBUTE = WebApplicationContext.class.getName() + ".ROOT";
    
    public static WebApplicationContext getWebApplicationContext(ServletContext sc) {
        
        return getWebApplicationContext(sc, WebApplicationContext.ROOT_WEB_APPLICATION_CONTEXT_ATTRIBUTE);
    }

*  `Step into`进入`getWebApplicationContext(sc, WebApplicationContext.ROOT_WEB_APPLICATION_CONTEXT_ATTRIBUTE)`方法中：获取整个`Web`应用的父容器
    
     *  形参`attrName = org.springframework.web.context.WebApplicationContext.ROOT`
     *  其中`attr`为`Root WebApplicationContext`，即`Spring IOC`容器（父容器）

![image-20200618111913427][]

public static WebApplicationContext getWebApplicationContext(ServletContext sc, String attrName) {
        
        Assert.notNull(sc, "ServletContext must not be null");
        Object attr = sc.getAttribute(attrName);
        if (attr == null) {
        
            return null;
        }
        if (attr instanceof RuntimeException) {
        
            throw (RuntimeException) attr;
        }
        if (attr instanceof Error) {
        
            throw (Error) attr;
        }
        if (attr instanceof Exception) {
        
            throw new IllegalStateException((Exception) attr);
        }
        if (!(attr instanceof WebApplicationContext)) {
        
            throw new IllegalStateException("Context attribute is not of type WebApplicationContext: " + attr);
        }
        return (WebApplicationContext) attr;
    }

*  得到`IOC`容器之后，就会使用`IOC`容器中的`Bean`初始化`Filter`；如果找不到`IOC`容器，就放弃

![image-20200618112545068][]

*  `Step into`进入`initDelegate(wac)`：从`IOC`容器中获取`Filter Bean`

![image-20200618113057953][]

protected Filter initDelegate(WebApplicationContext wac) throws ServletException {
        
        Filter delegate = wac.getBean(getTargetBeanName(), Filter.class);
        if (isTargetFilterLifecycle()) {
        
            delegate.init(getFilterConfig());
        }
        return delegate;
    }

*  找不到`springSecurityFilterChain`这个`Bean`便会抛异常

![image-20200618113323441][]

public boolean filterStart() {
        
    
        if (getLogger().isDebugEnabled()) {
        
            getLogger().debug("Starting filters");
        }
        // Instantiate and record a FilterConfig for each defined filter
        boolean ok = true;
        synchronized (filterConfigs) {
        
            filterConfigs.clear();
            for (Entry<String,FilterDef> entry : filterDefs.entrySet()) {
        
                String name = entry.getKey();
                if (getLogger().isDebugEnabled()) {
        
                    getLogger().debug(" Starting filter '" + name + "'");
                }
                try {
        
                    ApplicationFilterConfig filterConfig =
                        new ApplicationFilterConfig(this, entry.getValue());
                    filterConfigs.put(name, filterConfig);
                } catch (Throwable t) {
        
                    t = ExceptionUtils.unwrapInvocationTargetException(t);
                    ExceptionUtils.handleThrowable(t);
                    getLogger().error(sm.getString(
                        "standardContext.filterStart", name), t);
                    ok = false;
                }
            }
        }
    
        return ok;
    }

*  如果初始化`Filter`时，没有找到`Spring IOC`父容器；则在第一次请求时，如果发现`Filter`为`null`，也会尝试使用`IOC`容器去初始化它

![image-20200618113844354][]

public void doFilter(ServletRequest request, ServletResponse response, FilterChain filterChain)
        throws ServletException, IOException {
        
    
        // Lazily initialize the delegate if necessary.
        Filter delegateToUse = this.delegate;
        if (delegateToUse == null) {
        
            synchronized (this.delegateMonitor) {
        
                delegateToUse = this.delegate;
                if (delegateToUse == null) {
        
                    WebApplicationContext wac = findWebApplicationContext();
                    if (wac == null) {
        
                        throw new IllegalStateException("No WebApplicationContext found: " +
                                                        "no ContextLoaderListener or DispatcherServlet registered?");
                    }
                    delegateToUse = initDelegate(wac);
                }
                this.delegate = delegateToUse;
            }
        }
    
        // Let the delegate perform the actual doFilter operation.
        invokeDelegate(delegateToUse, request, response, filterChain);
    }

*  结论：`Spring IOC`容器为整个`Web`应用的父容器，然后在`Spring IOC`容器中并没有`springSecurityFilterChain`这个`Bean`，所以程序便会抛异常

### 3.7、解决方案一： IOC容器合二为一 ###

*  不使用 `ContextLoaderListener`， 让 `DispatcherServlet` 加载所有 `Spring` 配置文件。
    
     *  `DelegatingFilterProxy` 在初始化时查找 `IOC` 容器， 找不到， 放弃。
     *  第一次请求时再次查找。
     *  找到 `SpringMVC` 的 `IOC` 容器。
     *  从这个 `IOC` 容器中找到所需要的 `bean`。
 *  遗憾： 会破坏现有程序的结构。 原本是 `ContextLoaderListener` 和 `DispatcherServlet` 两个组件创建两个 `IOC` 容器， 现在改成只有一个。

### 3.8、解决方案二：改源码 ###

#### 3.8.1、思路 ####

*  `Web`应用启动时，不让`DelegatingFilterProxy`在`Spring IOC`容器中去找`springSecurityFilterChain`
 *  第一次请求时，让`DelegatingFilterProxy`在`SpringMVC IOC`容器中去找`springSecurityFilterChain`

#### 3.8.2、改源码 ####

*  在`component`工程下创建与`DelegatingFilterProxy`同包名、同类名的类

![image-20200618140809664][]

*  `Web`应用启动时不加载`Spring IOC`容器

@Override
    protected void initFilterBean() throws ServletException {
        
        synchronized (this.delegateMonitor) {
        
            if (this.delegate == null) {
        
                // If no target bean name specified, use filter name.
                if (this.targetBeanName == null) {
        
                    this.targetBeanName = getFilterName();
                }
                // Fetch Spring root application context and initialize the delegate early,
                // if possible. If the root application context will be started after this
                // filter proxy, we'll have to resort to lazy initialization.
                /*
    				WebApplicationContext wac = findWebApplicationContext();
    				if (wac != null) {
    					this.delegate = initDelegate(wac);
    				}*/
            }
        }
    }

*  第一次请求时，去`SpringMVC IOC`容器中获取`springSecurityFilterChain`这个`Bean`

![image-20200618141236041][]

@Override
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain filterChain)
        throws ServletException, IOException {
        
    
        // Lazily initialize the delegate if necessary.
        Filter delegateToUse = this.delegate;
        if (delegateToUse == null) {
        
            synchronized (this.delegateMonitor) {
        
                delegateToUse = this.delegate;
                if (delegateToUse == null) {
        
    
                    // 把原来的查找IOC容器的代码注释掉
                    // WebApplicationContext wac = findWebApplicationContext();
    
                    // 按我们自己的需要重新编写
                    // 1.获取ServletContext对象
                    ServletContext sc = this.getServletContext();
    
                    // 2.拼接SpringMVC将IOC容器存入ServletContext域的时候使用的属性名
                    String servletName = "springDispatcherServlet";
    
                    String attrName = FrameworkServlet.SERVLET_CONTEXT_PREFIX + servletName;
    
                    // 3.根据attrName从ServletContext域中获取IOC容器对象
                    WebApplicationContext wac = (WebApplicationContext) sc.getAttribute(attrName);
    
                    if (wac == null) {
        
                        throw new IllegalStateException("No WebApplicationContext found: " +
                                                        "no ContextLoaderListener or DispatcherServlet registered?");
                    }
                    delegateToUse = initDelegate(wac);
                }
                this.delegate = delegateToUse;
            }
        }
    
        // Let the delegate perform the actual doFilter operation.
        invokeDelegate(delegateToUse, request, response, filterChain);
    }

#### 3.8.3、为什么可以这样改？ ####

*  `IOC`容器初始化好了之后就会被放在`ServletContext`中
    
     *  在`ContextLoaderListener`中的`contextInitialized(ServletContextEvent event)`方法中会执行`IOC`容器的初始化
    
    ![image-20200618141528845][]
    
        @Override
        public void contextInitialized(ServletContextEvent event) {
              
            initWebApplicationContext(event.getServletContext());
        }
    
     *  `contextInitialized(ServletContextEvent event)`方法中会将`IOC`容器放到`servletContext`域中
    
    ![image-20200618141909245][]
    
        public WebApplicationContext initWebApplicationContext(ServletContext servletContext) {
              
            if (servletContext.getAttribute(WebApplicationContext.ROOT_WEB_APPLICATION_CONTEXT_ATTRIBUTE) != null) {
              
                throw new IllegalStateException(
                    "Cannot initialize context because there is already a root application context present - " +
                    "check whether you have multiple ContextLoader* definitions in your web.xml!");
            }
        
            Log logger = LogFactory.getLog(ContextLoader.class);
            servletContext.log("Initializing Spring root WebApplicationContext");
            if (logger.isInfoEnabled()) {
              
                logger.info("Root WebApplicationContext: initialization started");
            }
            long startTime = System.currentTimeMillis();
        
            try {
              
                // Store context in local instance variable, to guarantee that
                // it is available on ServletContext shutdown.
                if (this.context == null) {
              
                    this.context = createWebApplicationContext(servletContext);
                }
                if (this.context instanceof ConfigurableWebApplicationContext) {
              
                    ConfigurableWebApplicationContext cwac = (ConfigurableWebApplicationContext) this.context;
                    if (!cwac.isActive()) {
              
                        // The context has not yet been refreshed -> provide services such as
                        // setting the parent context, setting the application context id, etc
                        if (cwac.getParent() == null) {
              
                            // The context instance was injected without an explicit parent ->
                            // determine parent for root web application context, if any.
                            ApplicationContext parent = loadParentContext(servletContext);
                            cwac.setParent(parent);
                        }
                        configureAndRefreshWebApplicationContext(cwac, servletContext);
                    }
                }
                servletContext.setAttribute(WebApplicationContext.ROOT_WEB_APPLICATION_CONTEXT_ATTRIBUTE, this.context);
        
                ClassLoader ccl = Thread.currentThread().getContextClassLoader();
                if (ccl == ContextLoader.class.getClassLoader()) {
              
                    currentContext = this.context;
                }
                else if (ccl != null) {
              
                    currentContextPerThread.put(ccl, this.context);
                }
        
                if (logger.isDebugEnabled()) {
              
                    logger.debug("Published root WebApplicationContext as ServletContext attribute with name [" +
                                 WebApplicationContext.ROOT_WEB_APPLICATION_CONTEXT_ATTRIBUTE + "]");
                }
                if (logger.isInfoEnabled()) {
              
                    long elapsedTime = System.currentTimeMillis() - startTime;
                    logger.info("Root WebApplicationContext: initialization completed in " + elapsedTime + " ms");
                }
        
                return this.context;
            }
            catch (RuntimeException ex) {
              
                logger.error("Context initialization failed", ex);
                servletContext.setAttribute(WebApplicationContext.ROOT_WEB_APPLICATION_CONTEXT_ATTRIBUTE, ex);
                throw ex;
            }
            catch (Error err) {
              
                logger.error("Context initialization failed", err);
                servletContext.setAttribute(WebApplicationContext.ROOT_WEB_APPLICATION_CONTEXT_ATTRIBUTE, err);
                throw err;
            }
        }

### 3.9、实验效果 ###

*  启动`Web`应用并没有抛异常，并且我们还发现了 `SpringSecurity` 的工作原理： 在初始化时或第一次请求时准备好过滤器链。具体任务由具体过滤器来完成。

org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter
    org.springframework.security.web.context.SecurityContextPersistenceFilter
    org.springframework.security.web.header.HeaderWriterFilter
    org.springframework.security.web.csrf.CsrfFilter
    org.springframework.security.web.authentication.logout.LogoutFilter
    org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter
    org.springframework.security.web.authentication.ui.DefaultLoginPageGeneratingFilter
    org.springframework.security.web.authentication.www.BasicAuthenticationFilter
    org.springframework.security.web.savedrequest.RequestCacheAwareFilter
    org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter
    org.springframework.security.web.authentication.AnonymousAuthenticationFilter
    org.springframework.security.web.session.SessionManagementFilter
    org.springframework.security.web.access.ExceptionTranslationFilter
    org.springframework.security.web.access.intercept.FilterSecurityInterceptor

*  访问登录页面。又是这熟悉的页面

![image-20200618142832128][]

## 4、目标一：放行登录页和静态资源 ##

### 4.1、重写configure方法 ###

*  重写`WebAppSecurityConfig`配置类中的`configure`方法

![image-20200617230150789][]

### 4.2、实验效果 ###

*  又是这熟悉的首页

![image-20200618143840613][]

## 5、目标二：登录认证（内存验证） ##

### 5.1、修改表单 ###

*  修改登录页面的表单
    
     *  `form`表单的提交地址：`action="security/do/login.html"`
     *  登录异常信息：`${SPRING_SECURITY_LAST_EXCEPTION.message }`

![image-20200618144502366][]

<form action="security/do/login.html" method="post" class="form-signin" role="form">
    	<h2 class="form-signin-heading">
    		<i class="glyphicon glyphicon-log-in"></i> 管理员登录
    	</h2>
    	<p>${requestScope.exception.message }</p>
    	<p>${SPRING_SECURITY_LAST_EXCEPTION.message }</p>
    	<div class="form-group has-success has-feedback">
    		<input type="text" name="loginAcct" value="Heygo" class="form-control" id="inputSuccess4"
    			placeholder="请输入登录账号" autofocus> <span
    			class="glyphicon glyphicon-user form-control-feedback"></span>
    	</div>
    	<div class="form-group has-success has-feedback">
    		<input type="text" name="userPswd" value="123123" class="form-control" id="inputSuccess4"
    			placeholder="请输入登录密码" style="margin-top: 10px;"> <span
    			class="glyphicon glyphicon-lock form-control-feedback"></span>
    	</div>
    	<button type="submit" class="btn btn-lg btn-success btn-block">登录</button>
    </form>

### 5.2、重写configure方法 ###

*  重写配置类中的`configure`方法
    
     *  指定登录页面地址
     *  指定提交登录请求的地址
     *  指定登陆成功后要去的页面
     *  指定用户名和密码的字段名称
     *  配置内存版的`tom`用户

// 表示当前类是一个配置类
    @Configuration
    
    // 启用Web环境下权限控制功能
    @EnableWebSecurity
    public class WebAppSecurityConfig extends WebSecurityConfigurerAdapter {
        
    	
    	@Override
    	protected void configure(HttpSecurity security) throws Exception {
        
    		
    		security
    			.authorizeRequests()						// 对请求进行授权
    			.antMatchers("/admin/to/login/page.html")	// 针对登录页进行设置
    			.permitAll()								// 无条件访问
    			
    			// 放行静态资源
    			.antMatchers("/bootstrap/**")	
    			.permitAll()                    
    			.antMatchers("/crowd/**")       
    			.permitAll()                    
    			.antMatchers("/css/**")         
    			.permitAll()                    
    			.antMatchers("/fonts/**")       
    			.permitAll()                    
    			.antMatchers("/img/**")         
    			.permitAll()                    
    			.antMatchers("/jquery/**")      
    			.permitAll()                    
    			.antMatchers("/layer/**")       
    			.permitAll()                    
    			.antMatchers("/script/**")      
    			.permitAll()                    
    			.antMatchers("/ztree/**")       
    			.permitAll()
    			.anyRequest()					// 其他任意请求
    			.authenticated()				// 认证后访问
    			.and()
    			.csrf()							// 防跨站请求伪造功能
    			.disable()						// 禁用
    			.formLogin()					// 开启表单登录的功能
    			.loginPage("/admin/to/login/page.html")			// 指定登录页面
    			.loginProcessingUrl("/security/do/login.html")	// 指定处理登录请求的地址
    			.defaultSuccessUrl("/admin/to/main/page.html")	// 指定登录成功后前往的地址
    			.usernameParameter("loginAcct")	// 账号的请求参数名称
    			.passwordParameter("userPswd")	// 密码的请求参数名称
    			;
    		
    	}
    	
    	@Override
    	protected void configure(AuthenticationManagerBuilder builder) throws Exception {
        
    		
    		// 临时使用内存版登录的模式测试代码
    		builder
    			.inMemoryAuthentication()
    			.withUser("Heygo")
    			.password("123123")
    			.roles("ADMIN");
    		
    	}
    	
    }

### 5.3、干掉拦截器 ###

*  在`SpringMVC`配置文件中干掉`Interceptor`，因为`Interceptor`会拦截用户的请求
    
     *  注释如下代码
    
    ![image-20200618152126681][]
    
    ![image-20200618152351884][]
    
     *  `Interceptor`代码如下
    
        public class LoginInterceptor extends HandlerInterceptorAdapter {
              
        
        	@Override
        	public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler)
        			throws Exception {
              
        		// 1.通过request对象获取Session对象
        		HttpSession session = request.getSession();
        		
        		// 2.尝试从Session域中获取Admin对象
        		Admin admin = (Admin) session.getAttribute(CrowdConstant.ATTR_NAME_LOGIN_ADMIN);
        
        		// 3.判断admin对象是否为空
        		if (admin == null) {
              
        			// 4.抛出异常
        			throw new AccessForbiddenException(CrowdConstant.MESSAGE_ACCESS_FORBIDEN);
        		}
        
        		// 5.如果Admin对象不为null，则返回true放行
        		return true;
        	}
        
        }

### 5.4、实验效果 ###

*  又是这熟悉的控制面板

![image-20200618152556010][]

## 6、目标三：退出登录 ##

### 6.1、修改请求地址 ###

*  修改顶部导航栏退出登录的请求地址

![image-20200618153123799][]

### 6.2、重写configure方法 ###

*  重写`configure`方法：
    
     *  开启退出登录功能
     *  制定退出登录的请求地址
     *  指定退出登录成功后。需要重定向至哪个页面

@Override
    protected void configure(HttpSecurity security) throws Exception {
        
    
        security
            .authorizeRequests()						// 对请求进行授权
            .antMatchers("/admin/to/login/page.html")	// 针对登录页进行设置
            .permitAll()								// 无条件访问
    
            // 放行静态资源
            .antMatchers("/bootstrap/**")	
            .permitAll()                    
            .antMatchers("/crowd/**")       
            .permitAll()                    
            .antMatchers("/css/**")         
            .permitAll()                    
            .antMatchers("/fonts/**")       
            .permitAll()                    
            .antMatchers("/img/**")         
            .permitAll()                    
            .antMatchers("/jquery/**")      
            .permitAll()                    
            .antMatchers("/layer/**")       
            .permitAll()                    
            .antMatchers("/script/**")      
            .permitAll()                    
            .antMatchers("/ztree/**")       
            .permitAll()
            .anyRequest()					// 其他任意请求
            .authenticated()				// 认证后访问
            .and()
            .csrf()							// 防跨站请求伪造功能
            .disable()						// 禁用
            .formLogin()					// 开启表单登录的功能
            .loginPage("/admin/to/login/page.html")			// 指定登录页面
            .loginProcessingUrl("/security/do/login.html")	// 指定处理登录请求的地址
            .defaultSuccessUrl("/admin/to/main/page.html")	// 指定登录成功后前往的地址
            .usernameParameter("loginAcct")	// 账号的请求参数名称
            .passwordParameter("userPswd")	// 密码的请求参数名称
            .and()
            .logout()						// 开启退出登录功能
            .logoutUrl("/seucrity/do/logout.html")			// 指定退出登录地址
            .logoutSuccessUrl("/admin/to/login/page.html")	// 指定退出成功以后前往的地址
            ;
    
    }

### 6.3、实验效果 ###

*  乌拉~

![image-20200618153329287][]

## 7、目标四：登录认证（数据库验证） ##

### 7.1、思路 ###

![image-20200919200415416][]

### 7.2、根据adminId查询管理员信息 ###

#### 7.2.1、Service层 ####

*  在`AdminServiceImpl`中实现此方法

![image-20200618191410829][]

@Override
    public Admin getAdminByLoginAcct(String username) {
        
        // 查询条件
        AdminExample example = new AdminExample();
        Criteria criteria = example.createCriteria();
        criteria.andLoginAcctEqualTo(username);
    
        // 执行查询
        List<Admin> list = adminMapper.selectByExample(example);
        Admin admin = list.get(0);
    
        //返回Admin对象
        return admin;
    }

#### 7.2.2、Mapper层 ####

*  `Mapper`层代码由`Mybatis`逆向生成

### 7.3、根据adminId查询管理员所拥有的角色 ###

#### 7.3.1、Service层 ####

*  这个方法在之前就已经写好啦~

![image-20200618160220166][]

@Override
    public List<Role> getAssignedRole(Integer adminId) {
        
        return roleMapper.selectAssignedRole(adminId);
    }

#### 7.3.2、Mapper层 ####

*  来看看之前写的`SQL`语句（子查询）

![image-20200618160350468][]

<select id="selectAssignedRole" resultMap="BaseResultMap">
        select id,name from t_role where id in (select role_id from inner_admin_role where admin_id=#{adminId})
    </select>

### 7.4、根据adminId查询管理员所拥有的权限名 ###

#### 7.4.1、Service层 ####

*  根据`adminId`的值查询该`Admin`所拥有的权限

![image-20200618160540655][]

@Override
    public List<String> getAssignedAuthNameByAdminId(Integer adminId) {
        
        return authMapper.selectAssignedAuthNameByAdminId(adminId);
    }

#### 7.4.2、Mapper层 ####

*  接口方法声明

![image-20200618160646021][]

List<String> selectAssignedAuthNameByAdminId(Integer adminId);

*  编写`SQL`语句
    
     *  `t_auth.name`在`t_auth`表中
    
    ![image-20200618161313485][]
    
     *  将`t_auth`表与`inner_role_auth`表左外连接，得到权限与角色的对应关系
    
    ![image-20200618161345541][]
    
     *  将`inner_role_auth`与`inner_admin_role`表左外连接，得到角色管理员的对应关系
    
    ![image-20200618161257172][]
    
     *  最后取出指定`adminId`的权限名称

![image-20200618160705011][]

<select id="selectAssignedAuthNameByAdminId" resultType="string">
        SELECT DISTINCT t_auth.name 
        FROM t_auth 
        LEFT JOIN inner_role_auth ON t_auth.id=inner_role_auth.auth_id
        LEFT JOIN inner_admin_role ON inner_admin_role.role_id=inner_role_auth.role_id
        WHERE inner_admin_role.admin_id=#{adminId} and t_auth.name != "" and t_auth.name is not null
    </select>

*  `SQL`左外连接分析

![image-20200618161923159][]

### 7.5、自定义用户类 ###

*  创建`SecurityAdmin`类，继承自`User`类，用于封装`Admin`的信息

![image-20200618190423315][]

/**
     * 考虑到User对象中仅仅包含账号和密码，为了能够获取到原始的Admin对象，专门创建这个类对User类进行扩展
     * @author Lenovo
     *
     */
    public class SecurityAdmin extends User {
        
    	
    	private static final long serialVersionUID = 1L;
    	
    	// 原始的Admin对象，包含Admin对象的全部属性
    	private Admin originalAdmin;
    	
    	public SecurityAdmin(
    			// 传入原始的Admin对象
    			Admin originalAdmin, 
    			
    			// 创建角色、权限信息的集合
    			List<GrantedAuthority> authorities) {
        
    		
    		// 调用父类构造器
    		super(originalAdmin.getLoginAcct(), originalAdmin.getUserPswd(), authorities);
    		
    		// 给本类的this.originalAdmin赋值
    		this.originalAdmin = originalAdmin;
    		
    	}
    	
    	// 对外提供的获取原始Admin对象的getXxx()方法
    	public Admin getOriginalAdmin() {
        
    		return originalAdmin;
    	}
    
    }

### 7.6、实现UserDetailsService接口 ###

*  在`component`工程下创建`UserDetailsService`接口的实现类：`CrowdUserDetailsService`
    
     *  装配角色信息（注意添加`"ROLE_"`前缀）
     *  装配权限信息
     *  封装成`securityAdmin`对象，并返回此对象

![image-20200618192921708][]

@Component
    public class CrowdUserDetailsService implements UserDetailsService {
        
    	
    	@Autowired
    	private AdminService adminService;
    	
    	@Autowired
    	private RoleService roleService;
    	
    	@Autowired
    	private AuthService authService;
    
    	@Override
    	public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        
    		
    		// 1.根据账号名称查询Admin对象
    		Admin admin = adminService.getAdminByLoginAcct(username);
    		
    		// 2.获取adminId
    		Integer adminId = admin.getId();
    		
    		// 3.根据adminId查询角色信息
    		List<Role> assignedRoleList = roleService.getAssignedRole(adminId);
    		
    		// 4.根据adminId查询权限信息
    		List<String> authNameList = authService.getAssignedAuthNameByAdminId(adminId);
    		
    		// 5.创建集合对象用来存储GrantedAuthority
    		List<GrantedAuthority> authorities = new ArrayList<>();
    		
    		// 6.遍历assignedRoleList存入角色信息
    		for (Role role : assignedRoleList) {
        
    			
    			// 注意：不要忘了加前缀！
    			String roleName = "ROLE_" + role.getName();
    			
    			SimpleGrantedAuthority simpleGrantedAuthority = new SimpleGrantedAuthority(roleName);
    			
    			authorities.add(simpleGrantedAuthority);
    		}
    		
    		// 7.遍历authNameList存入权限信息
    		for (String authName : authNameList) {
        
    			
    			SimpleGrantedAuthority simpleGrantedAuthority = new SimpleGrantedAuthority(authName);
    			
    			authorities.add(simpleGrantedAuthority);
    		}
    		
    		// 8.封装SecurityAdmin对象
    		SecurityAdmin securityAdmin = new SecurityAdmin(admin, authorities);
    		
    		return securityAdmin;
    	}
    
    }

### 7.7、注入UserDetailsService ###

*  在配置类中重写`configure`方法，使用自定义的登录逻辑

![image-20200618192900194][]

@Autowired
    private UserDetailsService userDetailsService;
    
    @Override
    protected void configure(AuthenticationManagerBuilder builder) throws Exception {
        
    
        // 临时使用内存版登录的模式测试代码
        /*
    		builder
    			.inMemoryAuthentication()
    			.withUser("Heygo")
    			.password("123123")
    			.roles("ADMIN");
    		*/
    
        builder.userDetailsService(userDetailsService);
    
    }

### 7.8、实验测试 ###

*  由于还没有实现加密功能，我们先将数据库密码改为明文密码

![image-20200618193110679][]

*  `Oneby`登陆成功

![image-20200618193308066][]

[image-20200617210026056]: /images/20221123/fa32b187d4594a04909a3e1719ce3120.png
[image-20200617210929062]: /images/20221123/932d3e16dc234a4c915c9e2f9fbd0e3b.png
[image-20200617211145976]: /images/20221123/f2c1e7b31adf4fc0a745833a5c09dd77.png
[image-20200617211250409]: /images/20221123/71949d1e32ec4e509e7b4062aa6e39ce.png
[image-20200919195949522]: /images/20221123/d2e394f1bc374c2494d28e09352c64e5.png
[image-20200617222634183]: /images/20221123/b81879a19d054aa986d674c7f379d911.png
[image-20200617223435942]: /images/20221123/3716db3db717400983f76dfdbbb3e4b1.png
[image-20200617224041799]: /images/20221123/a90fc293e59c431db5e0efe2981c18dd.png
[image-20200617225512695]: /images/20221123/0601a8205cbd486c9496a308e875eba5.png
[image-20200617225852001]: /images/20221123/6f6dd67a331c428ea9beb8c63262af95.png
[image-20200617225938179]: /images/20221123/822a849d693f42a8ad0f6710afa1513d.png
[image-20200617230150789]: /images/20221123/6b44046f2a6c4a58997e6afef58346f0.png
[image-20200618104939591]: /images/20221123/328e5ddecb1949b8a4c3d4bd24a1cf11.png
[image-20200618105700854]: /images/20221123/9151862098e049fa88f1bb058bade74a.png
[image-20200618110828514]: /images/20221123/2a6904e6e9064370a514461a4dc8eca7.png
[image-20200618111022162]: /images/20221123/e6d25ae9cf32412992e3df31bd25b488.png
[image-20200618111440279]: /images/20221123/5a61c42a554e4539b6b9c2ae95e0bfd6.png
[image-20200618111502379]: /images/20221123/fba112c163b04922a7ac2fc0bdf5bb11.png
[image-20200618111913427]: /images/20221123/4d87aa21d8a24ba58c14408918e10c6c.png
[image-20200618112545068]: /images/20221123/c5f1a48be30c46038549046ed439d936.png
[image-20200618113057953]: /images/20221123/7bb33364feb94a1bb237e69b216ab561.png
[image-20200618113323441]: /images/20221123/45ef1cd325154e368ff87035566d116d.png
[image-20200618113844354]: /images/20221123/104ec959ab244978a8dc6e89fc55fde4.png
[image-20200618140809664]: /images/20221123/6c1b00679d9c4493a2496a4c9a047703.png
[image-20200618141236041]: /images/20221123/1eae1efcd2c94b7f91ba3bc04499219d.png
[image-20200618141528845]: /images/20221123/1dec680126d04690986d0d32f4636ee0.png
[image-20200618141909245]: /images/20221123/0e361274053a4cf8afc9d629db8c9994.png
[image-20200618142832128]: /images/20221123/07d8b1f095a643a4a6e0550d581b78e9.png
[image-20200618143840613]: /images/20221123/c26d036ba63449afa25679b3888d67e4.png
[image-20200618144502366]: /images/20221123/15b423f763c441afa8175c6ab9b4df2f.png
[image-20200618152126681]: /images/20221123/c9fbf82722f44524a17a0471cf56ad90.png
[image-20200618152351884]: /images/20221123/d116d68966e246f78fc0e7a16dec9b80.png
[image-20200618152556010]: /images/20221123/8f4997554b4e4edab8fa10ce8724d0f1.png
[image-20200618153123799]: /images/20221123/58b7614d4cce4bd6bb3acb21dd876dd8.png
[image-20200618153329287]: /images/20221123/26e5a190a98540769550bbe1dbb37aff.png
[image-20200919200415416]: /images/20221123/bb4d1ca45dcf4f13bed58ac069230375.png
[image-20200618191410829]: /images/20221123/424c08b131a94bfaba13ac421680be25.png
[image-20200618160220166]: /images/20221123/3ce2a018512f43448f64bfb606989996.png
[image-20200618160350468]: /images/20221123/82f9556f77ec4126bc4a19f22c860cd4.png
[image-20200618160540655]: /images/20221123/f0df5c0a13d94c9ba7d841d628b49321.png
[image-20200618160646021]: /images/20221123/b3693798227b43948387b30535de1b3e.png
[image-20200618161313485]: /images/20221123/ba5b0372eecd487987b67fa13bf7a911.png
[image-20200618161345541]: /images/20221123/07741c3e28a64cbd9a1446b26e711c15.png
[image-20200618161257172]: /images/20221123/4aab1bf18d544b02974a0136ef3a341f.png
[image-20200618160705011]: /images/20221123/2a16f4bc65ef4dbfb593838216c4a1b9.png
[image-20200618161923159]: /images/20221123/7ba8fed8f3474c2c9dc2f3537ac33ee2.png
[image-20200618190423315]: /images/20221123/8293997a405842179243c86bad4f5091.png
[image-20200618192921708]: /images/20221123/c1d3db8fc58749ba95f7fde18b31fbf1.png
[image-20200618192900194]: /images/20221123/e3d18b418fb24b86933909b850d93d3d.png
[image-20200618193110679]: /images/20221123/658abf56c06b470f8d005b5f05a60097.png
[image-20200618193308066]: /images/20221123/756c8ab67d0942ac9ba236ec95477710.png