SpringBoot集成Spring Security（授权与认证）

⒈添加starter依赖

 1         <dependency>
 2             <groupId>org.springframework.boot</groupId>
 3             <artifactId>spring-boot-starter-web</artifactId>
 4         </dependency>
 5 
 6         <dependency>
 7             <groupId>org.springframework.boot</groupId>
 8             <artifactId>spring-boot-starter-security</artifactId>
 9         </dependency>
10 
11         <dependency>
12             <groupId>org.springframework.boot</groupId>
13             <artifactId>spring-boot-starter-thymeleaf</artifactId>
14         </dependency>
15 
16         <!--添加Thymeleaf Spring Security依赖-->
17         <dependency>
18             <groupId>org.thymeleaf.extras</groupId>
19             <artifactId>thymeleaf-extras-springsecurity4</artifactId>
20             <version>3.0.4.RELEASE</version>
21         </dependency>

⒉使用配置类定义授权与定义规则

 1 package cn.coreqi.config;
 2 
 3 import org.springframework.context.annotation.Configuration;
 4 import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
 5 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
 6 import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
 7 import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
 8 
 9 //@Configuration
10 @EnableWebSecurity
11 public class SecurityConfig extends WebSecurityConfigurerAdapter {
12 
13     //定义授权规则
14     @Override
15     protected void configure(HttpSecurity http) throws Exception {
16         //定制请求授权规则
17         http.authorizeRequests()
18                 .antMatchers("/css/**","/js/**","/fonts/**","index").permitAll()    //不拦截，直接访问
19                 .antMatchers("/vip1/**").hasRole("VIP1")
20                 .antMatchers("/vip2/**").hasRole("VIP2")
21                 .antMatchers("/vip3/**").hasRole("VIP3");
22         //开启登陆功能（自动配置）
23         //如果没有登陆就会来到/login（自动生成）登陆页面
24         //如果登陆失败就会重定向到/login?error
25         //默认post形式的/login代表处理登陆
26         http.formLogin().loginPage("/userLogin").failureUrl("/login-error");
27         //开启自动配置的注销功能
28         //访问/logout表示用户注销，清空session
29         //注销成功会返回/login?logout页面
30         //logoutSuccessUrl()设置注销成功后跳转的页面地址
31         http.logout().logoutSuccessUrl("/");
32         //开启记住我功能
33         //登陆成功以后，将cookie发给浏览器保存，以后访问页面带上这个cookie，只要通过检查就可以免登陆
34         //点击注销会删除cookie
35         http.rememberMe();
36     }
37 
38     //定义认证规则
39     @Override
40     protected void configure(AuthenticationManagerBuilder auth) throws Exception {
41         //jdbcAuthentication()  在JDBC中查找用户
42         //inMemoryAuthentication() 在内存中查找用户
43 
44         auth.inMemoryAuthentication().withUser("fanqi").password("admin").roles("VIP1","VIP2","VIP3")
45                 .and()
46                 .withUser("zhangsan").password("123456").roles("VIP1");
47     }
48 }

⒊编写控制器类（略）

⒋编写相关页面

 1 <!DOCTYPE html>
 2 <html lang="en"
 3       xmlns:th="http://www.thymeleaf.org"
 4       xmlns:layout="http://www.ultraq.net.nz/thymeleaf/layout"
 5       xmlns:sec="http://www.thymeleaf.org/thymeleaf-extras-springsecurity4">
 6 <head>
 7     <meta charset="UTF-8">
 8     <title>登录页面</title>
 9 </head>
10 <body>
11     <div sec:authorize="isAuthenticated()">
12         <p>用户已登录</p>
13         <p>登录的用户名为：<span sec:authentication="name"></span></p>
14         <p>用户角色为：<span sec:authentication="principal.authorities"></span></p>
15     </div>
16     <div sec:authorize="isAnonymous()">
17         <p>用户未登录</p>
18     </div>
19 </body>
20 </html>