spring boot+spring security 使用随笔
本人最近接受的新任务是从零搭一个管理系统的权限管理模块,从零开始学习了spring security,已完成绝大部分设计和开发,和大家分享一些学习和开发心得.
首先是数据库的设计,这里是
按照产品的需求,本权限管理模块,权限同时与角色和用户关联,要求角色有普通用户和管理员,用户和权限之间做直接的关联,我采用的是在权限校验时,先查询是否是管理员,如果不是则查询"用户--权限表".
接下来用Spring Boot配置Spring Security.
自定义一个SecurityConfig实现WebSecurityConfigurerAdapter,做权限核心控制类
@Configuration
@EnableWebSecurity //启用web权限
@EnableGlobalMethodSecurity(prePostEnabled = true) //启用方法验证
public class SecurityConfig extends WebSecurityConfigurerAdapter {
// @Autowired
// private CasProperties casProperties;
@Autowired
CustomUserDetailsService customUserDetailsService;
@Autowired
MyFilterInvocationSecurityMetadataSource myFilterInvocationSecurityMetadataSource;
@Autowired
MyAccessDecisionManager myAccessDecisionManager;
@Autowired
AuthenticationAccessDeniedHandler authenticationAccessDeniedHandler;
@Autowired
CustomizeAuthenticationEntryPoint authenticationEntryPoint;
@Autowired
CustomizeAuthenticationFailureHandler authenticationFailureHandler;
@Autowired
CustomizeSessionInformationExpiredStrategy sessionInformationExpiredStrategy;
/**定义认证用户信息获取来源，密码校验规则等*/
@Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
super.configure(auth);
}
/**
* 定义安全策略
* @param http
* @throws Exception
*/
@Override
protected void configure(HttpSecurity http) throws Exception {
http.authorizeRequests()//配置安全策略
.withObjectPostProcessor(new ObjectPostProcessor<FilterSecurityInterceptor>() {
@Override
public <O extends FilterSecurityInterceptor> O postProcess(O o) {
o.setSecurityMetadataSource(myFilterInvocationSecurityMetadataSource);
o.setAccessDecisionManager(myAccessDecisionManager);
return o;
}
})
.anyRequest().authenticated()//其余的所有请求都需要验证
.and()
.logout()
.permitAll()//定义logout不需要验证
.and()
//把自定义的验证码过滤器添加到验证用户名密码的过滤器前
// .addFilterBefore(new VerifyFilter(), UsernamePasswordAuthenticationFilter.class)
.formLogin()
// .loginProcessingUrl("/login")
.loginProcessingUrl(UrlConstant.LOGIN_URL)
.usernameParameter("userId").passwordParameter("password")
.defaultSuccessUrl(UrlConstant.DEFAULT_SUCCESS_Url)
.permitAll().//允许所有用户
failureHandler(authenticationFailureHandler);
//登录失败处理逻辑
//异常处理(权限拒绝、登录失效等)
http.exceptionHandling().
authenticationEntryPoint(authenticationEntryPoint)//匿名用户访问无权限资源时的异常处理and()
.and()
.cors()//新加入
.and()
.csrf().disable();
http.cors()
.and()
.exceptionHandling().accessDeniedHandler(authenticationAccessDeniedHandler)
//会话管理
.and().sessionManagement().
maximumSessions(3).//同一账号同时登录最大用户数
expiredSessionStrategy(sessionInformationExpiredStrategy);//会话信息过期策略会话信息过期策略(账号被挤下线)
// http.csrf().disable();//关闭CSRF保护
}
/**
* 默认的账号登录认证策略
* @return
*/
@Bean
public AbstractUserDetailsAuthenticationProvider usernameAndPasswordAuthenticationProvider(){
DaoAuthenticationProvider daoAuthenticationProvider = new DaoAuthenticationProvider();
daoAuthenticationProvider.setUserDetailsService( accountDetailsService() );
daoAuthenticationProvider.setPasswordEncoder( bCryptPasswordEncoder() );//设置密码策略
return daoAuthenticationProvider;
}
/**
* 注册获取用户权限Bean
* @return
*/
@Bean
public CustomUserDetailsService accountDetailsService(){
return new CustomUserDetailsService();
}
/**
* 注册md5加密Bean
* @return
*/
@Bean
public MessageDigestPasswordEncoder bCryptPasswordEncoder(){
return new MessageDigestPasswordEncoder("MD5");
}
}
在这个类中configure(HttpSecurity http)方法是最核心的方法,我在这个方法中配置了,登录访问的路径
登录访问的路径
.loginProcessingUrl(UrlConstant.LOGIN_URL)
,登录成功的调用的方法
.defaultSuccessUrl(UrlConstant.DEFAULT_SUCCESS_Url)
,失败调用的方法
failureHandler(authenticationFailureHandler);
,无权限时调用的方法
.exceptionHandling().accessDeniedHandler(authenticationAccessDeniedHandler)
匿名用户访问无权限资源时的异常处理
.exceptionHandling().authenticationEntryPoint(authenticationEntryPoint)
//会话管理
.and().sessionManagement().
maximumSessions(3).//同一账号同时登录最大用户数
expiredSessionStrategy(sessionInformationExpiredStrategy);//会话信息过期策略会话信息过期策略(账号被挤下线)
接着配置其他的处理类:
/**
* 拒绝访问处理
*/
@Component
public class AuthenticationAccessDeniedHandler implements AccessDeniedHandler {
@Override
public void handle(HttpServletRequest httpServletRequest, HttpServletResponse resp, AccessDeniedException e) throws IOException, ServletException {
resp.setStatus(HttpServletResponse.SC_FORBIDDEN);
resp.setContentType("application/json;charset=UTF-8");
PrintWriter out = resp.getWriter();
out.write("{\"status\":\"error\",\"msg\":\"权限不足，请联系管理员!\"}");
out.flush();
out.close();
}
}
/**
* @Description: 匿名用户访问无权限资源时的异常
* @Date Create in 2019/9/3 21:35
*/
@Component
public class CustomizeAuthenticationEntryPoint implements AuthenticationEntryPoint {
@Override
public void commence(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, AuthenticationException e) throws IOException, ServletException {
JsonResult result = ResultTool.fail(ResultCode.USER_NOT_LOGIN);
httpServletResponse.setContentType("text/json;charset=utf-8");
httpServletResponse.getWriter().write(JSON.toJSONString(result));
}
}
/**
* @Author: cg
* @Description: 登录失败处理逻辑
*/
@Component
public class CustomizeAuthenticationFailureHandler implements AuthenticationFailureHandler {
@Override
public void onAuthenticationFailure(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, AuthenticationException e) throws IOException, ServletException{
//返回json数据
JsonResult result = null;
if (e instanceof VerifyCodeException){
result = ResultTool.fail(ResultCode.USER_VERIFICATION_CODE_ERROR);
}else if (e instanceof AccountExpiredException) {
//账号过期
result = ResultTool.fail(ResultCode.USER_ACCOUNT_EXPIRED);
} else if (e instanceof BadCredentialsException) {
//密码错误
result = ResultTool.fail(ResultCode.USER_CREDENTIALS_ERROR);
} else if (e instanceof CredentialsExpiredException) {
//密码过期
result = ResultTool.fail(ResultCode.USER_CREDENTIALS_EXPIRED);
} else if (e instanceof DisabledException) {
//账号不可用
result = ResultTool.fail(ResultCode.USER_ACCOUNT_DISABLE);
} else if (e instanceof LockedException) {
//账号锁定
result = ResultTool.fail(ResultCode.USER_ACCOUNT_LOCKED);
} else if (e instanceof InternalAuthenticationServiceException) {
//用户不存在
result = ResultTool.fail(ResultCode.USER_ACCOUNT_NOT_EXIST);
}else{
//其他错误
result = ResultTool.fail(ResultCode.COMMON_FAIL);
}
//处理编码方式，防止中文乱码的情况
httpServletResponse.setContentType("text/json;charset=utf-8");
//塞到HttpServletResponse中返回给前台
httpServletResponse.getWriter().write(JSON.toJSONString(result));
}
}
/**
* @Author: cg
* @Description: 会话信息过期策略
*/
@Component
public class CustomizeSessionInformationExpiredStrategy implements SessionInformationExpiredStrategy {
@Override
public void onExpiredSessionDetected(SessionInformationExpiredEvent sessionInformationExpiredEvent) throws IOException, ServletException {
JsonResult result = ResultTool.fail(ResultCode.USER_ACCOUNT_USE_BY_OTHERS);
HttpServletResponse httpServletResponse = sessionInformationExpiredEvent.getResponse();
httpServletResponse.setContentType("text/json;charset=utf-8");
httpServletResponse.getWriter().write(JSON.toJSONString(result));
}
}
MyAccessDecisionManager 是认证核心处理类,校验访问的接口所对应的权限,登录的用户是否拥有
/**
* 认证核心类
*/
@Service
public class MyAccessDecisionManager implements AccessDecisionManager {
/**
* decide 方法是判定是否拥有权限的决策方法，authentication是CustomUserService
* 中循环添加到 GrantedAuthority 对象中的权限信息集合,object 包含客户端发起的请求的requset信息，
* 可转换为 HttpServletRequest request = ((FilterInvocation) object).getHttpRequest();
* configAttributes为MyFilterInvocationSecurityMetadataSource的getAttributes(Object object)
* 这个方法返回的结果.
*
*/
@Override
public void decide(Authentication authentication, Object object, Collection<ConfigAttribute> configAttributes) throws AccessDeniedException, InsufficientAuthenticationException {
if(null== configAttributes || configAttributes.size() <=0) {
return;
}
ConfigAttribute c;
String needRole;
//遍历用户已有的权限中是否有这一个接口所对应的的权限
for(Iterator<ConfigAttribute> iter = configAttributes.iterator(); iter.hasNext(); ) {
c = iter.next();
needRole = c.getAttribute();
for(GrantedAuthority ga : authentication.getAuthorities()) {//authentication 为在注释1 中循环添加到 GrantedAuthority 对象中的权限信息集合
//比较是否是该接口所需的权限
if(needRole.trim().equals(ga.getAuthority())) {
return;
}
}
}
throw new AccessDeniedException("no right");
}
@Override
public boolean supports(ConfigAttribute attribute) {
return true;
}
@Override
public boolean supports(Class<?> clazz) {
return true;
}
}
我通过MyFilterInvocationSecurityMetadataSource加载url权限表,把每一个接口对应的权限存储到数据库,在服务器启动时调用,
把url和对应的权限加载到内存中,在用户每一次访问被 接口时校验该接口是否被存到数据库中,如果被存储到了数据库就得到其对应的权限,
如果数据库中没有这个url的地址,则放行不进行拦截
/**
* 加载权限表及判断url权限类
*/
@Service
public class MyFilterInvocationSecurityMetadataSource implements FilterInvocationSecurityMetadataSource {
@Autowired
PermissionMapper permissionMapper;
private HashMap<String, Collection<ConfigAttribute>> map = null;
/**
* 加载权限表中所有权限
*/
public void loadResourceDefine() {
map = new HashMap<String, Collection<ConfigAttribute>>();
//获取url_auth表中所有的url和权限名
List<AuthUrlPermission> authUrlPermissions = permissionMapper.selectUrlPerm();
//把所有的url和对应的权限名添加到内存的map中,用于后面的权限对比
for (AuthUrlPermission permission : authUrlPermissions) {
ConfigAttribute cfg = new SecurityConfig(permission.getAuthName());
List<ConfigAttribute> list = new ArrayList<>();
list.add(cfg);
//用于restful风格的接口地址和请求方法拼接起来存入内存的map中
map.put(permission.getUrlName()+":"+permission.getMethod(), list);
}
}
/**
* 此方法是为了判定用户请求的url 是否在权限表中，如果在权限表中，则返回给 decide 方法， 用来判定用户
* 是否有此权限。如果不在权限表中则放行。
*/
@Override
public Collection<ConfigAttribute> getAttributes(Object object) throws IllegalArgumentException {
//如果内存中存储url和权限的map为null则去调用加载map方法
if (map == null) {
loadResourceDefine();
}
// object 中包含用户请求的request的信息
HttpServletRequest request = ((FilterInvocation) object).getHttpRequest();
for (Map.Entry<String, Collection<ConfigAttribute>> entry : map.entrySet()) {
String urlAndMethod = entry.getKey();
//把key中的url和请求方法通过:切割开
String url = urlAndMethod.split(":")[0];
String method = urlAndMethod.split(":")[1];
//验证url和请求方法与请求中的是否一致
if (new AntPathRequestMatcher(url).matches(request) &&
request.getMethod().equals(method)) {
//如果url和请求方法与请求中的一致.则返回该请求对应的权限名
return map.get(urlAndMethod);
}
}
//如果请求的地址和方法不在存储的url表中则不做拦截
return null;
}
@Override
public Collection<ConfigAttribute> getAllConfigAttributes() {
return null;
}
@Override
public boolean supports(Class<?> clazz) {
return true;
}
}
从数据库获取用户信息和用户所拥有的的权限,提供给AuthenticationManager进行登录校验
/**
* 从数据库获取用户权限类
*/
@Service("customUserDetailsService")
public class CustomUserDetailsService implements UserDetailsService {
@Autowired
PermissionMapper permissionMapper;
@Autowired
UserMapper userMapper;
@Override
public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
System.out.println("当前的用户名是："+username);
//根据用户名从数据库用户所拥有的权限
AuthUser authUser2 = userMapper.userLogin(username);
if (authUser2 == null){
throw new UsernameNotFoundException("用户名不存在");
}
Set<GrantedAuthority> authorities = new HashSet<>();
List<PermissionCheckVO> permissionCheckVOS = permissionMapper.selectCheckPerm(username);
//添加用户默认开启的权限
authorities.add(new SimpleGrantedAuthority("USER"));
authorities.add(new SimpleGrantedAuthority("processList"));
authorities.add(new SimpleGrantedAuthority("processList_edit"));
authorities.add(new SimpleGrantedAuthority("process_approval_child"));
authorities.add(new SimpleGrantedAuthority("process_approval_child_edit"));
//遍历添加权限
for (PermissionCheckVO r: permissionCheckVOS) {
//添加编辑权限
if (r.getEditStatus()!=null && r.getEditStatus().equals(true)){
authorities.add(new SimpleGrantedAuthority(r.getAuthName()));
r.setAuthName(r.getAuthName()+"_edit");
}
authorities.add(new SimpleGrantedAuthority(r.getAuthName()));
}
//把数据库中的用户名和密码以及权限返回给AuthenticationManager调用
User user = new User(username, authUser2.getPassword(), authorities);
return user;
}
}
以上是我的springboot+spring security的配置
