SSM整合SpringSecurity

1.pom.xml配置

<project xmlns="http://maven.apache.org/POM/4.0.0"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>
    <groupId>com.qingfeng</groupId>
    <artifactId>SpringSecurity</artifactId>
    <version>0.0.1-SNAPSHOT</version>
    <packaging>war</packaging>
 
    <properties>
        <spring.security.version>5.1.3.RELEASE</spring.security.version>
    </properties>
 
    <dependencies>
 
 
        <!--引入Servlet支持 -->
        <dependency>
            <groupId>javax.servlet</groupId>
            <artifactId>javax.servlet-api</artifactId>
            <version>3.1.0</version>
            <scope>provided</scope>
        </dependency>
 
 
        <!--引入Spring Security支持 -->
        <!-- https://mvnrepository.com/artifact/org.springframework.security/spring-security-core -->
        <dependency>
            <groupId>org.springframework.security</groupId>
            <artifactId>spring-security-core</artifactId>
            <version>${spring.security.version}</version>
        </dependency>
 
        <!-- https://mvnrepository.com/artifact/org.springframework.security/spring-security-web -->
        <dependency>
            <groupId>org.springframework.security</groupId>
            <artifactId>spring-security-web</artifactId>
            <version>${spring.security.version}</version>
        </dependency>
 
        <!-- https://mvnrepository.com/artifact/org.springframework.security/spring-security-config -->
        <dependency>
            <groupId>org.springframework.security</groupId>
            <artifactId>spring-security-config</artifactId>
            <version>${spring.security.version}</version>
        </dependency>
    </dependencies>   
     
    <build>
        <plugins>
            <plugin>
                <groupId>org.apache.tomcat.maven</groupId>
                <artifactId>tomcat7-maven-plugin</artifactId>
                <configuration>
                    <!-- 指定端口 -->
                    <port>9001</port>
                    <!-- 请求路径 -->
                    <path>/</path>
                </configuration>
            </plugin>
        </plugins>
    </build>
 
</project>

2.web.xml配置

<?xml version="1.0" encoding="UTF-8"?>
<web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xmlns="http://java.sun.com/xml/ns/javaee"
         xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd"
         version="2.5">
    <context-param>
        <param-name>contextConfigLocation</param-name>
        <param-value>classpath:spring-security.xml</param-value>
    </context-param>
     
    <listener>
        <listener-class>
            org.springframework.web.context.ContextLoaderListener
        </listener-class>
    </listener>
     
    <filter>
        <filter-name>springSecurityFilterChain</filter-name>
        <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
    </filter>
    <filter-mapping>
        <filter-name>springSecurityFilterChain</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>
</web-app>

3.spring-security.xml配置

<?xml version="1.0" encoding="UTF-8"?>
<beans:beans
    xmlns="http://www.springframework.org/schema/security"
    xmlns:beans="http://www.springframework.org/schema/beans"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
                        http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security.xsd">
 
    <!--以下页面不被拦截 -->
    <http pattern="/login.html" security="none"></http>
    <http pattern="/login_error.html" security="none"></http> 
 
    <!--页面拦截规则 -->
    <http>
        <!-- intercept-url:表示拦截规则 pattern：页码的匹配规则，在webapp下面的 access：资源的控制规则，需要什么的条件 -->
        <!-- 所有的资源都需要是ROLE_ADMIN的角色可以访问 -->
        <intercept-url pattern="/**"
            access="hasRole('ROLE_ADMIN')" />
        <!-- 表单登录 
                login-page：登录页面
                default-target-url：默认跳转页面
                authentication-failure-url：登录错误，跳转错误页面
        -->
        <form-login  login-page="/login.html"  default-target-url="/index.html"  authentication-failure-url="/login_error.html"/>
        <!-- 退出登录 -->
        <logout />
        <!--  关闭跨域请求伪造控制。因为静态页无法动态生成token，所以将此功能关闭。一般静态页采用图形验证码的方式实现防止跨域请求伪造的功能。-->
        <csrf  disabled="true" />
    </http>
 
    <!-- 认证管理器 -->
    <!-- <authentication-manager> 认证管理器 <authentication-provider> 认证的提供者，就是用来配置用户名和密码 
        <user-service> 用户的服务 <user /> 配置用户和密码 -->
    <authentication-manager>
        <authentication-provider   user-service-ref="userDetailsService">
            <!-- <user-service>
                name：用户名，password:用户密码 authorities：指定用户的角色
                <user name="admin"
                    password="$2a$10$rIxa8dDL8F8Bf.TeC5rOeev96e0wTo0FIuLmtdJ6T/a8CptHlAlga"
                    authorities="ROLE_ADMIN" />
            </user-service> -->
 
            <!-- 密码使用bcrypt加密 -->
            <password-encoder ref="bcryptEncoder" />
        </authentication-provider>
    </authentication-manager>
 
    <!-- bcrypt加密 -->
    <beans:bean id="bcryptEncoder"
        class="org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder"></beans:bean>
 
    <beans:bean id="userDetailsService"  class="com.qingfeng.service.UserDetailsServiceImpl"></beans:bean>
 
</beans:beans>

4.UserDetailsServiceImpl.java类

package com.qingfeng.service;
 
import java.util.ArrayList;
import java.util.List;
 
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.authority.SimpleGrantedAuthority;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.core.userdetails.UsernameNotFoundException;
 
public class UserDetailsServiceImpl implements UserDetailsService {
 
    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        //构建角色集合 ，项目中此处应该是根据用户名查询用户的角色列表
        List<GrantedAuthority> geAuthorities = new ArrayList<GrantedAuthority>();
        //添加角色ROLE_ADMIN
        geAuthorities.add(new SimpleGrantedAuthority("ROLE_ADMIN"));
        /**
         * 第一参数：username
         * 第二参数："$2a$10$rIxa8dDL8F8Bf.TeC5rOeev96e0wTo0FIuLmtdJ6T/a8CptHlAlga"是BCrypt加密的密码
         * 第三参数：geAuthorities是它的角色
         */
        return new User(username,"$2a$10$rIxa8dDL8F8Bf.TeC5rOeev96e0wTo0FIuLmtdJ6T/a8CptHlAlga",geAuthorities);
    }
 
}

5.编写登录login.html页面

<!DOCTYPE html>
<html>
<head>
<meta charset="UTF-8">
<title>登录</title>
</head>
<body>
 
    <form action="/login" method="post">
        <table>
            <tr>
                <td>用户名
                <td />
                <td><input name="username" />
                <td />
            <tr />
            <tr>
                <td>密码
                <td />
                <td><input type="password" name="password" />
                <td />
            <tr />
        </table>
        <button>登录</button>
    </form>
 
</body>
</html>

6.编写登录login_error.html页面

<!DOCTYPE html>
<html>
<head>
<meta charset="UTF-8">
<title>登录错误</title>
</head>
<body>
<h1 >用户名和密码错误！</h1>
</body>
</html>

7.编写登录index.html页面

<!DOCTYPE html>
<html>
<head>
<meta charset="UTF-8">
<title>欢迎来到 SpringSecurity</title>
</head>
<body>
    <h1>欢迎来到 SpringSecurity</h1>
</body>
</html>