SpringBoot 整合 SpringSecurity 实现安全管理

朴灿烈づ我的快乐病毒、 2023-07-04 03:25 9阅读 0赞

### 文章目录 ###

*  什么是 Spring Security？
 *  Spring Security 的基本配置
 *   *  基本用法
     *   *  创建项目，添加依赖
         *  创建 Controller
         *  启动项目测试
     *  配置用户名和密码
     *  基于内存的认证
     *  解决 java.lang.IllegalArgumentException: There is no PasswordEncoder mapped for the id "null"
     *   *  创建 PasswordEncoder 的实现类
 *  HttpSecurity
 *   *  测试

# 什么是 Spring Security？ #

在 Java 开发领域常见的安全框架有 Shiro 和 Spring Security。Shiro 是一个轻量级的安全管理框架，提供了认证、授权、会话管理、密码管理、缓存管理等功能，Spring Security 是一个相对复杂的安全管理框架，功能比 Shiro 更加强大，权限控制细粒度更高，对 OAuth 2 的支持也更友好，又因为 Spring Security 源自 Spring 家族，因此可以和 Spring 框架无缝整合，特别是在 SpringBoot 中又提供了自动化配置方案，可以让 Spring Security 的使用更加便捷

# Spring Security 的基本配置 #

SpringBoot 针对 Spring Security 提供了自动化配置方案，因此可以使 Spring Security 非常容易地整合进 SpringBoot 项目中，这也是在 SpringBoot 项目中使用 Spring Security 的优势

## 基本用法 ##

基本整合步骤如下：

### 创建项目，添加依赖 ###

创建一个 SpringBoot Web 项目，然后添加依赖即可，如下所示：

<dependency>
    	<groupId>org.springframework.boot</groupId>
    	<artifactId>spring-boot-starter-web</artifactId>
    </dependency>
    
    
    <dependency>
    	<groupId>org.springframework.boot</groupId>
    	<artifactId>spring-boot-starter-security</artifactId>
    </dependency>

只要开发者在项目中添加了 spring-boot-starter-security 依赖，项目中所有的资源都会被保护起来，这个是什么意思呢？比如我们创建一个简单的控制器来测试一下：

### 创建 Controller ###

Controller 的代码如下：

### 启动项目测试 ###

以上步骤搞定之后启动项目测试下，访问 /hello 接口会自动跳转到一个登录页面，但是我们并没有写过登录页面，其实这个登录页面是由 Spring Security 提供的  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L1dvb19ob21l_size_16_color_FFFFFF_t_70]  
用户名默认是 user  
而密码则是每次启动项目时在控制台的日志中随机生成的  
![在这里插入图片描述][20200207174302539.png]  
登录成功之后我们才可以访问 Controller 返回的数据  
![在这里插入图片描述][20200207174352806.png]

## 配置用户名和密码 ##

如果我们对默认的用户名和密码不满意，则可以在 application.properties 中配置默认的用户名、密码以及用户角色，配置方式如下：

# 配置用户名
    spring.security.user.name = admin123
    # 配置密码
    spring.security.user.password = 123

当我们在 application.properties 中配置了默认的用户名和密码之后，再次启动项目时，控制台的日志中就不会打印出随机生成的密码了，我们就可以直接使用在 application.properties 中配置好的用户名和密码登录了

## 基于内存的认证 ##

当然，我们还可以自己定义一个类继承 WebSecurityConfigurerAdapter，进而实现对 Spring Security 更多的自定义配置，例如基于内存的认证，配置方式如下：

在 Spring Security 5.x 版本中引入了多种密码加密方式，开发者必须指定一种加密方式，这里使用的 Spring Security 的版本是 5.2.1 版本，在该版本中 NoOpPasswordEncoder 类（表示不对密码进行加密）已经被弃用

所以当我们启动项目使用 MyWebSecurityConfig 配置类的用户名和密码进行登录的时候回报错，报错如下：

java.lang.IllegalArgumentException: There is no PasswordEncoder mapped for the id "null"
    	at org.springframework.security.crypto.password.DelegatingPasswordEncoder$UnmappedIdPasswordEncoder.matches(DelegatingPasswordEncoder.java:250) ~[spring-security-core-5.2.1.RELEASE.jar:5.2.1.RELEASE]
    	at org.springframework.security.crypto.password.DelegatingPasswordEncoder.matches(DelegatingPasswordEncoder.java:198) ~[spring-security-core-5.2.1.RELEASE.jar:5.2.1.RELEASE]
    	at org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter$LazyPasswordEncoder.matches(WebSecurityConfigurerAdapter.java:592) ~[spring-security-config-5.2.1.RELEASE.jar:5.2.1.RELEASE]
    	at org.springframework.security.authentication.dao.DaoAuthenticationProvider.additionalAuthenticationChecks(DaoAuthenticationProvider.java:90) ~[spring-security-core-5.2.1.RELEASE.jar:5.2.1.RELEASE]
    	at org.springframework.security.authentication.dao.AbstractUserDetailsAuthenticationProvider.authenticate(AbstractUserDetailsAuthenticationProvider.java:166) ~[spring-security-core-5.2.1.RELEASE.jar:5.2.1.RELEASE]
    	at org.springframework.security.authentication.ProviderManager.authenticate(ProviderManager.java:175) ~[spring-security-core-5.2.1.RELEASE.jar:5.2.1.RELEASE]
    	at org.springframework.security.authentication.ProviderManager.authenticate(ProviderManager.java:195) ~[spring-security-core-5.2.1.RELEASE.jar:5.2.1.RELEASE]
    	at org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter.attemptAuthentication(UsernamePasswordAuthenticationFilter.java:95) ~[spring-security-web-5.2.1.RELEASE.jar:5.2.1.RELEASE]
    	at org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter.doFilter(AbstractAuthenticationProcessingFilter.java:212) ~[spring-security-web-5.2.1.RELEASE.jar:5.2.1.RELEASE]
    	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334) ~[spring-security-web-5.2.1.RELEASE.jar:5.2.1.RELEASE]
    	at org.springframework.security.web.authentication.logout.LogoutFilter.doFilter(LogoutFilter.java:116) ~[spring-security-web-5.2.1.RELEASE.jar:5.2.1.RELEASE]
    	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334) ~[spring-security-web-5.2.1.RELEASE.jar:5.2.1.RELEASE]
    	at org.springframework.security.web.csrf.CsrfFilter.doFilterInternal(CsrfFilter.java:141) ~[spring-security-web-5.2.1.RELEASE.jar:5.2.1.RELEASE]
    	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119) ~[spring-web-5.2.2.RELEASE.jar:5.2.2.RELEASE]
    	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334) ~[spring-security-web-5.2.1.RELEASE.jar:5.2.1.RELEASE]
    	at org.springframework.security.web.header.HeaderWriterFilter.doHeadersAfter(HeaderWriterFilter.java:92) ~[spring-security-web-5.2.1.RELEASE.jar:5.2.1.RELEASE]
    	at org.springframework.security.web.header.HeaderWriterFilter.doFilterInternal(HeaderWriterFilter.java:77) ~[spring-security-web-5.2.1.RELEASE.jar:5.2.1.RELEASE]
    	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119) ~[spring-web-5.2.2.RELEASE.jar:5.2.2.RELEASE]
    	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334) ~[spring-security-web-5.2.1.RELEASE.jar:5.2.1.RELEASE]
    	at org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:105) ~[spring-security-web-5.2.1.RELEASE.jar:5.2.1.RELEASE]
    	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334) ~[spring-security-web-5.2.1.RELEASE.jar:5.2.1.RELEASE]
    	at org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter.doFilterInternal(WebAsyncManagerIntegrationFilter.java:56) ~[spring-security-web-5.2.1.RELEASE.jar:5.2.1.RELEASE]
    	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119) ~[spring-web-5.2.2.RELEASE.jar:5.2.2.RELEASE]
    	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334) ~[spring-security-web-5.2.1.RELEASE.jar:5.2.1.RELEASE]
    	at org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:215) ~[spring-security-web-5.2.1.RELEASE.jar:5.2.1.RELEASE]
    	at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:178) ~[spring-security-web-5.2.1.RELEASE.jar:5.2.1.RELEASE]
    	at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:358) ~[spring-web-5.2.2.RELEASE.jar:5.2.2.RELEASE]
    	at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:271) ~[spring-web-5.2.2.RELEASE.jar:5.2.2.RELEASE]
    	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) ~[tomcat-embed-core-9.0.29.jar:9.0.29]
    	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) ~[tomcat-embed-core-9.0.29.jar:9.0.29]
    	at org.springframework.web.filter.RequestContextFilter.doFilterInternal(RequestContextFilter.java:100) ~[spring-web-5.2.2.RELEASE.jar:5.2.2.RELEASE]
    	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119) ~[spring-web-5.2.2.RELEASE.jar:5.2.2.RELEASE]
    	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) ~[tomcat-embed-core-9.0.29.jar:9.0.29]
    	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) ~[tomcat-embed-core-9.0.29.jar:9.0.29]
    	at org.springframework.web.filter.FormContentFilter.doFilterInternal(FormContentFilter.java:93) ~[spring-web-5.2.2.RELEASE.jar:5.2.2.RELEASE]
    	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119) ~[spring-web-5.2.2.RELEASE.jar:5.2.2.RELEASE]
    	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) ~[tomcat-embed-core-9.0.29.jar:9.0.29]
    	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) ~[tomcat-embed-core-9.0.29.jar:9.0.29]
    	at org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:201) ~[spring-web-5.2.2.RELEASE.jar:5.2.2.RELEASE]
    	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119) ~[spring-web-5.2.2.RELEASE.jar:5.2.2.RELEASE]
    	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) ~[tomcat-embed-core-9.0.29.jar:9.0.29]
    	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) ~[tomcat-embed-core-9.0.29.jar:9.0.29]
    	at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:202) ~[tomcat-embed-core-9.0.29.jar:9.0.29]
    	at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:96) [tomcat-embed-core-9.0.29.jar:9.0.29]
    	at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:526) [tomcat-embed-core-9.0.29.jar:9.0.29]
    	at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:139) [tomcat-embed-core-9.0.29.jar:9.0.29]
    	at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:92) [tomcat-embed-core-9.0.29.jar:9.0.29]
    	at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:74) [tomcat-embed-core-9.0.29.jar:9.0.29]
    	at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:343) [tomcat-embed-core-9.0.29.jar:9.0.29]
    	at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:367) [tomcat-embed-core-9.0.29.jar:9.0.29]
    	at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:65) [tomcat-embed-core-9.0.29.jar:9.0.29]
    	at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:860) [tomcat-embed-core-9.0.29.jar:9.0.29]
    	at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1591) [tomcat-embed-core-9.0.29.jar:9.0.29]
    	at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49) [tomcat-embed-core-9.0.29.jar:9.0.29]
    	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) [na:1.8.0_181]
    	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) [na:1.8.0_181]
    	at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61) [tomcat-embed-core-9.0.29.jar:9.0.29]
    	at java.lang.Thread.run(Thread.java:748) [na:1.8.0_181]

## 解决 java.lang.IllegalArgumentException: There is no PasswordEncoder mapped for the id “null” ##

这是因为在 SpringBoot 2.0.3 开始引用的 Spring Security 的依赖是 5.x 版本的，此版本需要提供一个 PasswordEncoder 的实例，否则后台会报错

### 创建 PasswordEncoder 的实现类 ###

package com.example.demo.config;
    
    import org.springframework.security.crypto.password.PasswordEncoder;
    
    public class MyPasswordEncoder implements PasswordEncoder { 
        
        @Override
        public String encode(CharSequence charSequence) { 
            return charSequence.toString();
        }
    
        @Override
        public boolean matches(CharSequence charSequence, String s) { 
            return s.equals(charSequence.toString());
        }
    }

然后再修改 MyWebSecurityConfig 的代码，如下：

这时候在登录页面输入 user 和 123 就可进行登录了

# HttpSecurity #

虽然现在可以实现认证功能了，但是受保护的资源都是默认的，而且也不能根据实际情况进行角色管理，如果要实现这些功能，就必须重写 WebSecurityConfigurerAdapter 中的另一个方法，代码如下：

package com.example.demo.config;
    
    import org.springframework.context.annotation.Configuration;
    import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
    import org.springframework.security.config.annotation.web.builders.HttpSecurity;
    import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
    
    @Configuration
    public class MyWebSecurityConfig extends WebSecurityConfigurerAdapter { 
        @Override
        protected void configure(AuthenticationManagerBuilder auth) throws Exception { 
            /** * 配置三个用户，root 用户具备 ADMIN 和 DBA 的角色 * admin 用户具备 ADMIN 和 USER 的角色 * user 用户具备 USER 的角色 */
            auth.inMemoryAuthentication().passwordEncoder(
                    new MyPasswordEncoder()).withUser("root").password("123").roles("ROOT")
                    .and()
                    .withUser("admin").password("123").roles("ADMIN")
                    .and()
                    .withUser("user").password("123").roles("USER");
        }
    
        @Override
        protected void configure(HttpSecurity http) throws Exception { 
            /** * authorizeRequests() 方法开启 HttpSecurity 的配置 */
            http.authorizeRequests()
    
                    // 如果用户访问 "/admin/**" 模式的 URL 必须具备 ADMIN 角色
                    .antMatchers("/admin/**")
                    .hasRole("ADMIN")
    
                    // 如果用户访问 "/user/**" 模式的 URL 必须具备 ADMIN 或者 USER 角色
                    .antMatchers("/user/**")
                    .hasRole("ADMIN")
    
                    // 如果用户访问 "/db/**" 模式的 URL 必须具备 ADMIN 或者 DBA 角色
                    .antMatchers("/db/**")
                    .hasRole("ADMIN")
    
                    // 用户访问其它的 URL 都必须认证后才能访问（登录后才能访问）
                    .anyRequest()
                    .authenticated()
                    .and()
    
                    // 开启表单登录，同时配置了登录接口为 "/login"，即可以直接调用该接口发起一个 POST 请求进行登录
                    .formLogin()
                    .loginProcessingUrl("/login")
    
                    // 表示和登录相关的接口都不需要认证即可访问
                    .permitAll()
                    .and()
                    .csrf()
                    .disable();
        }
    }

## 测试 ##

package com.example.demo.controller;
    
    import org.springframework.web.bind.annotation.GetMapping;
    import org.springframework.web.bind.annotation.RestController;
    
    @RestController
    public class DemoController { 
    
        @GetMapping("/admin/hello")
        public String admin() { 
            return "hello springboot admin";
        }
    
        @GetMapping("/user/hello")
        public String user() { 
            return "hello springboot user";
        }
    
        @GetMapping("/db/hello")
        public String dba() { 
            return "hello springboot dba";
        }
    
        @GetMapping("/hello")
        public String hello() { 
            return "hello springboot";
        }
    }

[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L1dvb19ob21l_size_16_color_FFFFFF_t_70]: https://img-blog.csdnimg.cn/20200207174145155.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L1dvb19ob21l,size_16,color_FFFFFF,t_70
[20200207174302539.png]: https://img-blog.csdnimg.cn/20200207174302539.png
[20200207174352806.png]: https://img-blog.csdnimg.cn/20200207174352806.png