一、Spring Security
1、框架介绍
Spring Security 基于 Spring 框架，提供了一套 Web 应用安全性的完整解决方案。一般来说，Web 应用的安全性包括用户认证（Authentication）和用户授权（Authorization）两个部分。
（1）用户认证指的是：验证某个用户是否为系统中的合法主体，也就是说用户能否访问该系统。用户认证一般要求用户提供用户名和密码。系统通过校验用户名和密码来完成认证过程。
（2）用户授权指的是验证某个用户是否有权限执行某个操作。在一个系统中，不同用户所具有的权限是不同的。比如对一个文件来说，有的用户只能进行读取，而有的用户可以进行修改。一般来说，系统会为不同的用户分配不同的角色，而每个角色则对应一系列的权限。
Spring Security其实就是用filter，多请求的路径进行过滤。
（1）如果是基于Session，那么Spring-security会对cookie里的sessionid进行解析，找到服务器存储的sesion信息，然后判断当前用户是否符合请求的要求。
（2）如果是token，则是解析出token，然后将当前请求加入到Spring-security管理的权限信息中去
2、认证与授权实现思路
如果系统的模块众多，每个模块都需要就行授权与认证，所以我们选择基于token的形式进行授权与认证，用户根据用户名密码认证成功，然后获取当前用户角色的一系列权限值，并以用户名为key，权限列表为value的形式存入redis缓存中，根据用户名相关信息生成token返回，浏览器将token记录到cookie中，每次调用api接口都默认将token携带到header请求头中，Spring-security解析header头获取token信息，解析token获取当前用户名，根据用户名就可以从redis中获取权限列表，这样Spring-security就能够判断当前请求是否有权限访问。
二、整合Spring Security
1、在common下创建spring_security模块
2、在spring_security引入相关依赖
pom.xml
<?xml version="1.0" encoding="UTF-8"?> <project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd"> <parent> <artifactId>common</artifactId> <groupId>com.javaclimb</groupId> <version>0.0.1-SNAPSHOT</version> </parent> <modelVersion>4.0.0</modelVersion> <artifactId>spring_security</artifactId> <dependencies> <dependency> <groupId>com.javaclimb</groupId> <artifactId>common_util</artifactId> <version>0.0.1-SNAPSHOT</version> </dependency> <dependency> <groupId>com.javaclimb</groupId> <artifactId>service_base</artifactId> <version>0.0.1-SNAPSHOT</version> </dependency> <!-- Spring Security依赖 --> <dependency> <groupId>org.springframework.boot</groupId> <artifactId>spring-boot-starter-security</artifactId> </dependency> <dependency> <groupId>io.jsonwebtoken</groupId> <artifactId>jjwt</artifactId> </dependency> </dependencies> </project>
<dependency> <groupId>com.javaclimb</groupId> <artifactId>spring_security</artifactId> <version>0.0.1-SNAPSHOT</version> </dependency>
4、代码结构说明
核心配置类：TokenWebSecurityConfig
用户实体类：User
登录过滤器：TokenLoginFilter
访问过滤器：TokenAuthenticationFilter
密码处理类：DefaultPasswordEncoder
登出业务逻辑类：TokenLogoutHandler
token操作工具类：TokenManager
未授权的统一处理方式：UnauthorizedEntryPoint
5、辅助类
(1) UserService.java
package com.stu.service.acl.service; import com.stu.service.acl.entity.User; import com.baomidou.mybatisplus.extension.service.IService; /** * <p> * 用户表 服务类 * </p> * * @author stu * @since 2022-08-16 */ public interface UserService extends IService<User> { /*********************************** * 用途说明:获取用户详情 * @param username * 返回值说明: * @return com.stu.service.acl.entity.User ***********************************/ User selectByUserName(String username); }
(2) UserServiceImpl.java
package com.stu.service.acl.service.impl; import com.baomidou.mybatisplus.core.conditions.query.QueryWrapper; import com.stu.service.acl.entity.User; import com.stu.service.acl.mapper.UserMapper; import com.stu.service.acl.service.UserService; import com.baomidou.mybatisplus.extension.service.impl.ServiceImpl; import org.springframework.stereotype.Service; /** * <p> * 用户表 服务实现类 * </p> * * @author stu * @since 2022-08-16 */ @Service public class UserServiceImpl extends ServiceImpl<UserMapper, User> implements UserService { /*********************************** * 用途说明:获取用户详情 * @param username * 返回值说明: * @return com.stu.service.acl.entity.User ***********************************/ @Override public User selectByUserName(String username) { return baseMapper.selectOne(new QueryWrapper<User>().eq("username", username)); } }
package com.stu.service.acl.mapper; import com.stu.service.acl.entity.Permission; import com.baomidou.mybatisplus.core.mapper.BaseMapper; import java.util.List; /** * <p> * 权限 Mapper 接口 * </p> * * @author stu * @since 2022-08-16 */ public interface PermissionMapper extends BaseMapper<Permission> { /*********************************** * 用途说明:获取全部菜单的权限 * 返回值说明: * @return java.util.List<java.lang.String> ***********************************/ List<String> selectAllPermissionValue(); /*********************************** * 用途说明:根据用户id查询所有权限 * @param id * 返回值说明: * @return java.util.List<java.lang.String> ***********************************/ List<String> selectPermissionValueByUserId(String id); /*********************************** * 用途说明:根据用户id查询所有菜单 * @param userId * 返回值说明: * @return java.util.List<com.stu.service.acl.entity.Permission> ***********************************/ List<Permission> selectPermissionByUserId(String userId); }
<?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE mapper PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN" "http://mybatis.org/dtd/mybatis-3-mapper.dtd"> <mapper namespace="com.stu.service.acl.mapper.PermissionMapper"> <resultMap id="permissionMap" type="com.stu.service.acl.entity.Permission"> <result property="id" column="id"/> <result property="pid" column="pid"/> <result property="name" column="name"/> <result property="type" column="type"/> <result property="permissionValue" column="permission_value"/> <result property="path" column="path"/> <result property="component" column="component"/> <result property="icon" column="icon"/> <result property="status" column="status"/> <result property="isDeleted" column="is_deleted"/> <result property="gmtCreate" column="gmt_create"/> <result property="gmtModified" column="gmt_modified"/> </resultMap> <!-- 用于select查询公用抽取的列 --> <sql id="columns"> p.id,p.pid,p.name,p.type,p.permission_value,path,p.component,p.icon,p.status,p.is_deleted,p.gmt_create,p.gmt_modified </sql> <select id="selectPermissionByUserId" resultMap="permissionMap"> select <include refid="columns" /> from acl_user_role ur inner join acl_role_permission rp on rp.role_id = ur.role_id inner join acl_permission p on p.id = rp.permission_id where ur.user_id = #{userId} and ur.is_deleted = 0 and rp.is_deleted = 0 and p.is_deleted = 0 </select> <select id="selectPermissionValueByUserId" resultType="String"> select p.permission_value from acl_user_role ur inner join acl_role_permission rp on rp.role_id = ur.role_id inner join acl_permission p on p.id = rp.permission_id where ur.user_id = #{userId} and ur.is_deleted = 0 and rp.is_deleted = 0 and p.is_deleted = 0 </select> <select id="selectAllPermissionValue" resultType="String"> select permission_value from acl_permission where is_deleted = 0 </select> </mapper>
package com.stu.service.acl.service; import com.alibaba.fastjson.JSONObject; import com.stu.service.acl.entity.Permission; import com.baomidou.mybatisplus.extension.service.IService; import java.util.List; /** * <p> * 权限 服务类 * </p> * * @author stu * @since 2022-08-16 */ public interface PermissionService extends IService<Permission> { /*********************************** * 用途说明:查询所有权限菜单 * 返回值说明: * @return java.util.List<com.stu.service.acl.entity.Permission> ***********************************/ List<Permission> ListAllPermissions(); /*********************************** * 用途说明:递归删除菜单 * @param id * 返回值说明: * @return boolean ***********************************/ boolean removeChildById(String id); /*********************************** * 用途说明:根據角色獲取菜單 * @param id * 返回值说明: * @return java.util.List<com.stu.service.acl.entity.Permission> ***********************************/ List<Permission> listAllMenu(String id); /*********************************** * 用途说明:给角色分配菜单权限 * @param roleId * @param permissionId * 返回值说明: * @return boolean ***********************************/ boolean saveRolePermissionrelationShip(String roleId, String[] permissionId); /*********************************** * 用途说明:根据用户id查询有权限的菜单 * @param id * 返回值说明: * @return java.util.List<java.lang.String> ***********************************/ List<String> selectPermissionValueListByUserId(String id); /*********************************** * 用途说明:根据用户id查询所有权限的菜单详细列表 * @param userId * 返回值说明: * @return java.util.List<org.json.JSONObject> ***********************************/ List<JSONObject> selectPermissionByUserId(String userId); }
(6) PermissionServiceImpl.java实现类
package com.stu.service.acl.service.impl; import com.alibaba.fastjson.JSONObject; import com.baomidou.mybatisplus.core.conditions.query.QueryWrapper; import com.baomidou.mybatisplus.extension.service.impl.ServiceImpl; import com.stu.service.acl.entity.Permission; import com.stu.service.acl.entity.RolePermission; import com.stu.service.acl.entity.User; import com.stu.service.acl.mapper.PermissionMapper; import com.stu.service.acl.service.PermissionService; import com.stu.service.acl.service.RolePermissionService; import com.stu.service.acl.service.UserService; import org.apache.commons.lang3.StringUtils; import org.springframework.beans.factory.annotation.Autowired; import org.springframework.stereotype.Service; import java.util.ArrayList; import java.util.List; import java.util.stream.Collectors; /** * <p> * 权限 服务实现类 * </p> * * @author stu * @since 2022-08-16 */ @Service public class PermissionServiceImpl extends ServiceImpl<PermissionMapper, Permission> implements PermissionService { @Autowired private RolePermissionService rolePermissionService; @Autowired private UserService userService; /*********************************** * 用途说明:查询所有权限菜单 * 返回值说明: * @return java.util.List<com.stu.service.acl.entity.Permission> ***********************************/ @Override public List<Permission> ListAllPermissions() { QueryWrapper<Permission> queryWrapper = new QueryWrapper<>(); queryWrapper.orderByDesc("id"); return bulidPermission(baseMapper.selectList(queryWrapper)); } /*********************************** * 用途说明:把返回所有菜单list集合进行封装的方法 * @param list * 返回值说明: * @return java.util.List<com.stu.service.acl.entity.Permission> ***********************************/ private List<Permission> bulidPermission(List<Permission> list) { //创建list集合，用于数据最终封装 List<Permission> finalNode = new ArrayList<>(); //把所有菜单list集合遍历，得到顶层菜单 pid=0菜单，设置level是1 for (Permission permission : list) { //得到顶层菜单 pid=0菜单 if ("0".equals(permission.getPid())) { permission.setLevel(1); //根据顶层菜单，向里面进行查询子菜单，封装到finalNode里面 finalNode.add(selectChildren(permission, list)); } } return finalNode; } /*********************************** * 用途说明:递归查询下级菜单 * @param permission * @param list * 返回值说明: * @return com.stu.service.acl.entity.Permission ***********************************/ private Permission selectChildren(Permission permission, List<Permission> list) { //1 因为向一层菜单里面放二层菜单，二层里面还要放三层，把对象初始化 permission.setChildren(new ArrayList<Permission>()); //2 遍历所有菜单list集合，进行判断比较，比较id和pid值是否相同 for (Permission child : list) { if (permission.getId().equals(child.getPid())) { child.setLevel(permission.getLevel() + 1); if (child.getChildren() == null) { child.setChildren(new ArrayList<>()); } // permission.getChildren().add(child); // selectChildren(child,list); permission.getChildren().add(selectChildren(child, list)); } } return permission; } /*********************************** * 用途说明:递归删除菜单 * @param id * 返回值说明: * @return boolean ***********************************/ @Override public boolean removeChildById(String id) { List<String> idList = new ArrayList<>(); selectChildListById(id, idList); idList.add(id); return baseMapper.deleteBatchIds(idList) > 0; } /*********************************** * 用途说明:根據角色獲取菜單 * @param id * 返回值说明: * @return java.util.List<com.stu.service.acl.entity.Permission> ***********************************/ @Override public List<Permission> listAllMenu(String id) { //获取所有菜单 List<Permission> allPermissionList = baseMapper.selectList(new QueryWrapper<>()); //根据角色id呼气角色权限列表 List<RolePermission> rolePermissionsList = rolePermissionService .list(new QueryWrapper<RolePermission>().eq("role_id", id)); //遍历所有菜单，获取每一项，看是否在权限列表，如果在，就标记 List<String> permissionIdList = rolePermissionsList.stream().map(e -> e.getPermissionId()).collect(Collectors.toList()); allPermissionList.forEach(permission -> { if (permissionIdList.contains(permission.getId())) { permission.setHasSelect(true); } else { permission.setHasSelect(false); } }); /*for (int i = 0; i < allPermissionList.size(); i++) { Permission permission = allPermissionList.get(i); for (int m = 0; m < rolePermissionList.size(); m++) { RolePermission rolePermission = rolePermissionList.get(m); if(rolePermission.getPermissionId().equals(permission.getId())) { permission.setSelect(true); } } }*/ return bulidPermission(allPermissionList); } /*********************************** * 用途说明:给角色分配菜单权限 * @param roleId * @param permissionId * 返回值说明: * @return boolean ***********************************/ @Override public boolean saveRolePermissionrelationShip(String roleId, String[] permissionId) { //删除旧的权限 rolePermissionService.remove(new QueryWrapper<RolePermission>().eq("role_id", roleId)); List<RolePermission> list = new ArrayList<>(); for (String id : permissionId) { RolePermission rolePermission = new RolePermission(); rolePermission.setRoleId(roleId); rolePermission.setPermissionId(id); list.add(rolePermission); } return rolePermissionService.saveBatch(list); } /*********************************** * 用途说明:根据用户id查询有权限的菜单 * @param id * 返回值说明: * @return java.util.List<java.lang.String> ***********************************/ @Override public List<String> selectPermissionValueListByUserId(String id) { List<String> list; if (checkAdmin(id)) { //如果是超级管理员获取所有权限 list = baseMapper.selectAllPermissionValue(); } else { //根据用户id查询所有权限 list = baseMapper.selectPermissionValueByUserId(id); } return list; } /*********************************** * 用途说明:根据用户id查询所有权限的菜单详细列表 * @param userId * 返回值说明: * @return java.util.List<org.json.JSONObject> ***********************************/ @Override public List<JSONObject> selectPermissionByUserId(String userId) { List<Permission> selectPermissionList = null; if (checkAdmin(userId)) { //如果是超级管理员获取所有权限 selectPermissionList = baseMapper.selectList(null); } else { //根据用户id查询所有权限 selectPermissionList = baseMapper.selectPermissionByUserId(userId); } //先转换成树状 List<Permission> permissionList = bulidPermission(selectPermissionList); //然后转化成前端需要的格式 List<JSONObject> result = bulidJson(permissionList); return result; } /*********************************** * 用途说明:转化成前端需要的格式 * @param permissionList * 返回值说明: * @return java.util.List<org.json.JSONObject> ***********************************/ private List<JSONObject> bulidJson(List<Permission> permissionList) { List<JSONObject> menus = new ArrayList<>(); if (permissionList.size() == 1) { Permission topNode = permissionList.get(0); //组建左侧一级菜单 List<Permission> oneMenuList = topNode.getChildren(); for (Permission one : oneMenuList) { JSONObject oneMenu = new JSONObject(); oneMenu.put("path", one.getPath()); oneMenu.put("component", one.getComponent()); oneMenu.put("redirect", "noredirect");//第一级不需要重定向 oneMenu.put("name", "name_" + one.getId()); oneMenu.put("hidden", false);//一级不需要因此，3级需要 JSONObject oneMeta = new JSONObject(); oneMeta.put("title", one.getName()); oneMeta.put("icon", one.getIcon()); oneMenu.put("meta", oneMeta); List<JSONObject> children = new ArrayList<>(); List<Permission> twoMenuList = one.getChildren();//二级菜单 for (Permission two : twoMenuList) { JSONObject twoMenu = new JSONObject(); twoMenu.put("path", two.getPath()); twoMenu.put("component", two.getComponent()); // twoMenu.put("redirect", "noredirect");//第一级不需要重定向 twoMenu.put("name", "name_" + two.getId()); twoMenu.put("hidden", false);//一级不需要因此，3级需要 JSONObject twoMeta = new JSONObject(); twoMeta.put("title", two.getName()); twoMeta.put("icon", two.getIcon()); twoMenu.put("meta", twoMeta); children.add(twoMenu); //功能按钮 List<Permission> threeMenuList = two.getChildren(); for (Permission three : threeMenuList) { if (StringUtils.isEmpty(three.getPath())) { continue; } JSONObject threeMenu = new JSONObject(); threeMenu.put("path", three.getPath()); threeMenu.put("component", three.getComponent()); // threeMenu.put("redirect", "noredirect");//第一级不需要重定向 threeMenu.put("name", "name_" + three.getId()); threeMenu.put("hidden", true);//一级不需要因此，3级需要 JSONObject threeMeta = new JSONObject(); threeMeta.put("title", three.getName()); threeMeta.put("icon", three.getIcon()); threeMenu.put("meta", threeMeta); children.add(threeMenu); } } oneMenu.put("children", children); menus.add(oneMenu); } } return menus; } /*********************************** * 用途说明:判断是否管理员 * @param id * 返回值说明: * @return boolean ***********************************/ private boolean checkAdmin(String id) { User user = userService.getById(id); if (user != null && "admin".equals(user.getUsername())) { return true; } return false; } /*********************************** * 用途说明:根据当前菜单id查询他的子子孙孙id，封装到list集合 * @param id * @param idList * 返回值说明: ***********************************/ private void selectChildListById(String id, List<String> idList) { //查询当前菜单的下级 QueryWrapper<Permission> queryWrapper = new QueryWrapper<>(); queryWrapper.eq("pid", id); queryWrapper.select("id"); List<Permission> childList = baseMapper.selectList(queryWrapper); //把childIdList里面菜单id值获取出来，封装idList里面，做递归查询 childList.forEach(item -> { idList.add(item.getId()); selectChildListById(item.getId(), idList); }); } }
package com.stu.service.acl.service.impl; import com.stu.security.entity.SecurityUser; import com.stu.service.acl.entity.User; import com.stu.service.acl.service.PermissionService; import com.stu.service.acl.service.UserService; import com.stu.service.base.exception.CustomException; import com.stu.service.base.result.ResultCodeEnum; import org.springframework.beans.BeanUtils; import org.springframework.beans.factory.annotation.Autowired; import org.springframework.security.core.userdetails.UserDetails; import org.springframework.security.core.userdetails.UserDetailsService; import org.springframework.security.core.userdetails.UsernameNotFoundException; import org.springframework.stereotype.Service; import java.util.List; /****************************** * 用途说明:自定义UserDetailsService实现类，认证用户详情 * 作者姓名: Administrator * 创建时间: 2022-09-01 10:05 ******************************/ @Service("userDetailsService") public class UserDetailsServiceImpl implements UserDetailsService { @Autowired private UserService userService; @Autowired private PermissionService permissionService; /** *根据用户名查询用户信息 * @param username the username identifying the user whose data is required. * @return a fully populated user record (never <code>null</code>) * @throws UsernameNotFoundException if the user could not be found or the user has no * GrantedAuthority */ @Override public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException { User user = userService.selectByUserName(username); if(user == null){ throw new CustomException(ResultCodeEnum.LOGIN_MOBILE_ERROR); } // 返回UserDetails实现类 com.stu.security.entity.User curUser = new com.stu.security.entity.User(); BeanUtils.copyProperties(user,curUser); //根据用户id查询有权限的菜单 List<String> authorities = permissionService.selectPermissionValueListByUserId(user.getId()); SecurityUser securityUser = new SecurityUser(curUser); securityUser.setPermissionValueList(authorities); return securityUser; } }
(8)ResponseUtil.java
package com.stu.service.base.utils; import com.fasterxml.jackson.databind.ObjectMapper; import com.stu.service.base.result.R; import org.springframework.http.HttpStatus; import org.springframework.http.MediaType; import javax.servlet.http.HttpServletResponse; import java.io.IOException; /****************************** * 用途说明: * 作者姓名: Administrator * 创建时间: 2022-09-01 20:44 ******************************/ public class ResponseUtil { public static void out(HttpServletResponse response, R r) { ObjectMapper mapper = new ObjectMapper(); response.setStatus(HttpStatus.OK.value()); response.setContentType(MediaType.APPLICATION_JSON_UTF8_VALUE); try { mapper.writeValue(response.getWriter(), r); } catch (IOException e) { e.printStackTrace(); } } }
package com.stu.service.acl.service; import com.stu.service.acl.entity.Permission; import com.stu.service.acl.entity.Role; import com.baomidou.mybatisplus.extension.service.IService; import java.util.List; import java.util.Map; /** * <p> * 服务类 * </p> * * @author stu * @since 2022-08-16 */ public interface RoleService extends IService<Role> { /*********************************** * 用途说明:根据用户获取角色 * @param userId * 返回值说明: * @return java.util.List<com.stu.service.acl.entity.Permission> ***********************************/ Map<String, Object> findRoleByUserId(String userId); /*********************************** * 用途说明:给用户分配角色权限 * @param userId * @param permissionIds * 返回值说明: * @return boolean ***********************************/ boolean saveUserRelationShip(String userId, String[] permissionIds); /*********************************** * 用途说明:根据userid获取用户信息 * @param id * 返回值说明: * @return java.util.List<com.stu.service.acl.entity.Role> ***********************************/ List<Role> selectRoleByUserId(String id); }
package com.stu.service.acl.service.impl; import com.baomidou.mybatisplus.core.conditions.query.QueryWrapper; import com.stu.service.acl.entity.Permission; import com.stu.service.acl.entity.Role; import com.stu.service.acl.entity.RolePermission; import com.stu.service.acl.entity.UserRole; import com.stu.service.acl.mapper.RoleMapper; import com.stu.service.acl.service.RoleService; import com.baomidou.mybatisplus.extension.service.impl.ServiceImpl; import com.stu.service.acl.service.UserRoleService; import org.springframework.beans.factory.annotation.Autowired; import org.springframework.stereotype.Service; import java.util.ArrayList; import java.util.HashMap; import java.util.List; import java.util.Map; import java.util.stream.Collectors; /** * <p> * 服务实现类 * </p> * * @author stu * @since 2022-08-16 */ @Service public class RoleServiceImpl extends ServiceImpl<RoleMapper, Role> implements RoleService { @Autowired private UserRoleService userRoleService; /*********************************** * 用途说明:根据用户获取角色 * @param userId * 返回值说明: * @return java.util.List<com.stu.service.acl.entity.Permission> ***********************************/ @Override public Map<String, Object> findRoleByUserId(String userId) { //获取所有角色 List<Role> allRoleList = baseMapper.selectList(new QueryWrapper<>()); //根据用户id获取角色列表 List<UserRole> existUserRoleList = userRoleService .list(new QueryWrapper<UserRole>().eq("user_id", userId).select("role_id")); //遍历所有菜单，获取每一项，看是否在权限列表，如果在，就标记 List<String> existRoleLists = existUserRoleList.stream().map(e -> e.getRoleId()).collect(Collectors.toList()); List<Role> assignRoles = new ArrayList<>(); allRoleList.forEach(role -> { if (existRoleLists.contains(role.getId())) { assignRoles.add(role); } }); Map<String, Object> roleMap = new HashMap<>(); roleMap.put("assignRoles", assignRoles); roleMap.put("allRoleList", allRoleList); return roleMap; } /*********************************** * 用途说明:给用户分配角色权限 * @param userId * @param roleIds * 返回值说明: * @return boolean ***********************************/ @Override public boolean saveUserRelationShip(String userId, String[] roleIds) { //删除旧的所有角色权限 userRoleService.remove(new QueryWrapper<UserRole>().eq("user_id", userId)); List<UserRole> list = new ArrayList<>(); for (String id : roleIds) { UserRole rolePermission = new UserRole(); rolePermission.setRoleId(id); rolePermission.setUserId(userId); list.add(rolePermission); } return userRoleService.saveBatch(list); } /*********************************** * 用途说明:根据userid获取用户信息 * @param userId * 返回值说明: * @return java.util.List<com.stu.service.acl.entity.Role> ***********************************/ @Override public List<Role> selectRoleByUserId(String userId) { //根据用户id获取角色列表 List<UserRole> userRoleList = userRoleService .list(new QueryWrapper<UserRole>().eq("user_id", userId).select("role_id")); //遍历所有菜单，获取每一项，看是否在权限列表，如果在，就标记 List<String> roleIdLists = userRoleList.stream().map(e -> e.getRoleId()).collect(Collectors.toList()); List<Role> roleList = new ArrayList<>(); if (roleIdLists.size() > 0) { roleList = baseMapper.selectBatchIds(roleIdLists); } return roleList; } }
package com.stu.service.acl.service; import com.alibaba.fastjson.JSONObject; import java.util.List; import java.util.Map; public interface IndexService { /*********************************** * 用途说明:根据用户明获取用户登录信息 * @param userName * 返回值说明: * @return java.util.Map<java.lang.String, java.lang.Object> ***********************************/ Map<String, Object> getUserInfo(String userName); /*********************************** * 用途说明:根据用户动态获取菜单 * @param userName * 返回值说明: * @return java.util.List<org.json.JSONObject> ***********************************/ List<JSONObject> getMenu(String userName); }
package com.stu.service.acl.service.impl; import com.alibaba.fastjson.JSONObject; import com.stu.service.acl.entity.Role; import com.stu.service.acl.entity.User; import com.stu.service.acl.service.IndexService; import com.stu.service.acl.service.PermissionService; import com.stu.service.acl.service.RoleService; import com.stu.service.acl.service.UserService; import com.stu.service.base.exception.CustomException; import com.stu.service.base.result.ResultCodeEnum; import org.springframework.beans.factory.annotation.Autowired; import org.springframework.data.redis.core.RedisTemplate; import org.springframework.stereotype.Service; import java.util.HashMap; import java.util.List; import java.util.Map; import java.util.stream.Collectors; /****************************** * 用途说明: * 作者姓名: Administrator * 创建时间: 2022-09-01 22:34 ******************************/ @Service public class IndexServiceImpl implements IndexService { @Autowired private UserService userService; @Autowired private RoleService roleService; @Autowired private PermissionService permissionService; @Autowired private RedisTemplate redisTemplate; /*********************************** * 用途说明:根据用户明获取用户登录信息 * @param userName * 返回值说明: * @return java.util.Map<java.lang.String, java.lang.Object> ***********************************/ @Override public Map<String, Object> getUserInfo(String userName) { Map<String, Object> result = new HashMap<>(); User user = userService.selectByUserName(userName); if (user == null) { throw new CustomException(ResultCodeEnum.FETCH_USERINFO_ERROR); } //根据用户id获取角色 List<Role> roleList = roleService.selectRoleByUserId(user.getId()); //转换成角色名称列表 List<String> roleNameList = roleList.stream() .map(item -> item.getRoleName()).collect(Collectors.toList()); //前端框架必须返回一个角色，否则报错，如果没有角色，返回一个空角色 if (roleNameList.size() == 0) { roleNameList.add(""); } List<String> permissionValueList = permissionService.selectPermissionValueListByUserId(user.getId()); redisTemplate.opsForValue().set(userName, permissionValueList); result.put("name", user.getUsername()); result.put("roles", roleNameList); result.put("permissionValueList", permissionValueList); return result; } /*********************************** * 用途说明:根据用户动态获取菜单 * @param userName * 返回值说明: * @return java.util.List<org.json.JSONObject> ***********************************/ @Override public List<JSONObject> getMenu(String userName) { User user = userService.selectByUserName(userName); if (user == null) { throw new CustomException(ResultCodeEnum.FETCH_USERINFO_ERROR); } //根据用户动态获取菜单 return permissionService.selectPermissionByUserId(user.getId()); } }
package com.stu.service.acl.controller.admin; import com.alibaba.fastjson.JSONObject; import com.stu.service.acl.service.IndexService; import com.stu.service.base.result.R; import org.springframework.beans.factory.annotation.Autowired; import org.springframework.security.core.context.SecurityContextHolder; import org.springframework.web.bind.annotation.GetMapping; import org.springframework.web.bind.annotation.PostMapping; import org.springframework.web.bind.annotation.RequestMapping; import org.springframework.web.bind.annotation.RestController; import java.util.List; import java.util.Map; /****************************** * 用途说明: * 作者姓名: Administrator * 创建时间: 2022-09-01 21:42 ******************************/ @RestController @RequestMapping("/admin/acl/index") public class IndexController { @Autowired private IndexService indexService; /*********************************** * 用途说明:退出 * 返回值说明: * @return com.stu.service.base.result.R ***********************************/ @PostMapping("logout") public R logout() { return R.ok(); } /*********************************** * 用途说明: * 返回值说明: * @return com.stu.service.base.result.R ***********************************/ @GetMapping("getUserInfo") public R getUserInfo() { String userName = SecurityContextHolder.getContext().getAuthentication().getName(); Map<String, Object> userInfo = indexService.getUserInfo(userName); return R.ok().data(userInfo); } /*********************************** * 用途说明:根据用户明获取动态菜单 * 返回值说明: * @return com.stu.service.base.result.R ***********************************/ @GetMapping("menu") public R menu() { String userName = SecurityContextHolder.getContext().getAuthentication().getName(); List<JSONObject> permissionList = indexService.getMenu(userName); return R.ok().data("permissionList", permissionList); } }
6、Spring Security配置
（1）核心配置类：TokenWebSecurityConfig
Spring Security的核心配置就是继承WebSecurityConfigurerAdapter并注解@EnableWebSecurity的配置。
这个配置指明了用户名密码的处理方式、请求路径的开合、登录登出控制等和安全相关的配置。
package com.stu.security.config; import com.stu.security.filter.TokenAuthenticationFilter; import com.stu.security.filter.TokenLoginFilter; import com.stu.security.security.DefaultPasswordEncoder; import com.stu.security.security.TokenLogoutHandler; import com.stu.security.security.TokenManager; import com.stu.security.security.UnauthorizedEntryPoint; import org.springframework.beans.factory.annotation.Autowired; import org.springframework.context.annotation.Configuration; import org.springframework.data.redis.core.RedisTemplate; import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder; import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity; import org.springframework.security.config.annotation.web.builders.HttpSecurity; import org.springframework.security.config.annotation.web.builders.WebSecurity; import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity; import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter; import org.springframework.security.core.userdetails.UserDetailsService; /****************************** * 用途说明: * 作者姓名: Administrator * 创建时间: 2022-09-01 9:30 ******************************/ @Configuration @EnableWebSecurity @EnableGlobalMethodSecurity(prePostEnabled = true) public class TokenWebSecurityConfig extends WebSecurityConfigurerAdapter { @Autowired private UserDetailsService userDetailsService; @Autowired private DefaultPasswordEncoder defaultPasswordEncoder; @Autowired private TokenManager tokenManager; @Autowired private RedisTemplate redisTemplate; /*********************************** * 用途说明:密码处理 * @param auth * 返回值说明: ***********************************/ @Override protected void configure(AuthenticationManagerBuilder auth) throws Exception { auth.userDetailsService(userDetailsService).passwordEncoder(defaultPasswordEncoder); } /*********************************** * 用途说明:配置设置 * @param http * 返回值说明: ***********************************/ @Override protected void configure(HttpSecurity http) throws Exception { http.exceptionHandling().authenticationEntryPoint(new UnauthorizedEntryPoint()) //未授权异常处理 .and().csrf().disable().authorizeRequests().anyRequest().authenticated() //取消跨域所有请求 .and().logout().logoutUrl("/admin/acl/index/logout") .addLogoutHandler(new TokenLogoutHandler(tokenManager, redisTemplate)) .and().addFilter(new TokenLoginFilter(authenticationManager(), tokenManager, redisTemplate)) .addFilter(new TokenAuthenticationFilter(authenticationManager(), tokenManager, redisTemplate)) .httpBasic(); } /*********************************** * 用途说明:配置哪些请求不拦截 * @param web * 返回值说明: ***********************************/ @Override public void configure(WebSecurity web) throws Exception { web.ignoring().antMatchers( "/api/**", "/swagger-resources/**", "/webjars/**", "/v2/**", "/swagger-ui.html/**" ); } }
package com.stu.security.entity; import com.baomidou.mybatisplus.annotation.*; import io.swagger.annotations.ApiModel; import io.swagger.annotations.ApiModelProperty; import lombok.Data; import lombok.EqualsAndHashCode; import java.io.Serializable; import java.util.Date; /****************************** * 用途说明: * 作者姓名: Administrator * 创建时间: 2022-09-01 9:38 ******************************/ @Data @ApiModel(value = "User对象", description = "用户表") public class User implements Serializable { private static final long serialVersionUID = 1L; @ApiModelProperty(value = "会员id") private String id; @ApiModelProperty(value = "用户名称") private String username; @ApiModelProperty(value = "密码") private String password; @ApiModelProperty(value = "昵称") private String nickName; @ApiModelProperty(value = "用户头像") private String salt; @ApiModelProperty(value = "用户签名") private String token; }
package com.stu.security.entity; import lombok.Data; import lombok.extern.slf4j.Slf4j; import org.springframework.security.core.GrantedAuthority; import org.springframework.security.core.authority.SimpleGrantedAuthority; import org.springframework.security.core.userdetails.UserDetails; import org.springframework.util.StringUtils; import java.util.ArrayList; import java.util.Collection; import java.util.List; /****************************** * 用途说明: * 作者姓名: Administrator * 创建时间: 2022-09-01 9:38 ******************************/ @Data @Slf4j public class SecurityUser implements UserDetails { //当前登录用户 private transient User currentUserInfo; //当前登录用户权限 private List<String> permissionValueList; public SecurityUser() { } public SecurityUser(User user) { if (user != null) { this.currentUserInfo = user; } } /*********************************** * 用途说明:获取当前用户的所有权限 * 返回值说明: * @return java.util.Collection<? extends org.springframework.security.core.GrantedAuthority> ***********************************/ @Override public Collection<? extends GrantedAuthority> getAuthorities() { Collection<GrantedAuthority> authorities = new ArrayList<>(); for(String permissionValue:permissionValueList){ if(StringUtils.isEmpty(permissionValue)){ continue; } SimpleGrantedAuthority authority = new SimpleGrantedAuthority(permissionValue); authorities.add(authority); } return authorities; } @Override public String getPassword() { return currentUserInfo.getPassword(); } @Override public String getUsername() { return currentUserInfo.getUsername(); } @Override public boolean isAccountNonExpired() { return true; } @Override public boolean isAccountNonLocked() { return true; } @Override public boolean isCredentialsNonExpired() { return true; } @Override public boolean isEnabled() { return true; } }
package com.stu.security.filter; import com.fasterxml.jackson.databind.ObjectMapper; import com.stu.security.entity.SecurityUser; import com.stu.security.entity.User; import com.stu.security.security.TokenManager; import com.stu.service.base.exception.CustomException; import com.stu.service.base.result.R; import com.stu.service.base.result.ResultCodeEnum; import com.stu.service.base.utils.ResponseUtil; import org.springframework.data.redis.core.RedisTemplate; import org.springframework.security.authentication.AuthenticationManager; import org.springframework.security.authentication.UsernamePasswordAuthenticationToken; import org.springframework.security.core.Authentication; import org.springframework.security.core.AuthenticationException; import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter; import org.springframework.security.web.util.matcher.AntPathRequestMatcher; import javax.servlet.FilterChain; import javax.servlet.ServletException; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; import java.io.IOException; import java.util.ArrayList; /****************************** * 用途说明:登录过滤器，对用户名称和密码进行校验 * 作者姓名: Administrator * 创建时间: 2022-09-01 9:39 ******************************/ public class TokenLoginFilter extends UsernamePasswordAuthenticationFilter { private AuthenticationManager authenticationManager; private TokenManager tokenManager; private RedisTemplate redisTemplate; public TokenLoginFilter(AuthenticationManager authenticationManager, TokenManager tokenManager, RedisTemplate redisTemplate) { this.authenticationManager = authenticationManager; this.tokenManager = tokenManager; this.redisTemplate = redisTemplate; //设置访问方式，可以post以为的访问 this.setPostOnly(false); this.setRequiresAuthenticationRequestMatcher( new AntPathRequestMatcher("/admin/acl/login", "POST")); } /*********************************** * 用途说明:验证账号密码是否正确 * @param request * @param response * 返回值说明: * @return org.springframework.security.core.Authentication ***********************************/ @Override public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response) throws AuthenticationException { try { User user = new ObjectMapper().readValue(request.getInputStream(), User.class); return authenticationManager.authenticate( new UsernamePasswordAuthenticationToken(user.getUsername(), user.getPassword(), new ArrayList<>())); } catch (Exception e) { e.printStackTrace(); throw new CustomException(ResultCodeEnum.LOGIN_MOBILE_ERROR); } } /*********************************** * 用途说明:登录成功 * @param request * @param response * @param chain * @param authResult * 返回值说明: ***********************************/ @Override protected void successfulAuthentication(HttpServletRequest request, HttpServletResponse response, FilterChain chain, Authentication authResult) throws IOException, ServletException { SecurityUser user = (SecurityUser) authResult.getPrincipal(); String token = tokenManager.createToken(user.getCurrentUserInfo().getUsername()); redisTemplate.opsForValue().set(user.getCurrentUserInfo().getUsername(), user.getPermissionValueList()); ResponseUtil.out(response, R.ok().data("token", token)); } /*********************************** * 用途说明:登录失败 * @param request * @param response * @param e * 返回值说明: ***********************************/ @Override protected void unsuccessfulAuthentication(HttpServletRequest request, HttpServletResponse response, AuthenticationException e) throws IOException, ServletException { ResponseUtil.out(response, R.error()); } }
package com.stu.security.filter; import com.stu.security.security.TokenManager; import com.stu.service.base.result.R; import com.stu.service.base.utils.ResponseUtil; import io.netty.util.internal.StringUtil; import org.springframework.data.redis.core.RedisTemplate; import org.springframework.security.authentication.AuthenticationManager; import org.springframework.security.authentication.UsernamePasswordAuthenticationToken; import org.springframework.security.core.GrantedAuthority; import org.springframework.security.core.authority.SimpleGrantedAuthority; import org.springframework.security.core.context.SecurityContextHolder; import org.springframework.security.web.authentication.www.BasicAuthenticationFilter; import org.springframework.util.StringUtils; import javax.servlet.FilterChain; import javax.servlet.ServletException; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; import java.io.IOException; import java.util.ArrayList; import java.util.Collection; import java.util.List; /****************************** * 用途说明: * 作者姓名: Administrator * 创建时间: 2022-09-01 9:39 ******************************/ public class TokenAuthenticationFilter extends BasicAuthenticationFilter { private AuthenticationManager authenticationManager; private TokenManager tokenManager; private RedisTemplate redisTemplate; public TokenAuthenticationFilter(AuthenticationManager authenticationManager, TokenManager tokenManager, RedisTemplate redisTemplate) { super(authenticationManager); this.tokenManager = tokenManager; this.redisTemplate = redisTemplate; } @Override protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain chain) throws IOException, ServletException { if (request.getRequestURI().indexOf("admin") == -1) { chain.doFilter(request, response); return; } UsernamePasswordAuthenticationToken usernamePasswordAuthenticationToken = null; try { usernamePasswordAuthenticationToken = getAuthentication(request); } catch (Exception e) { ResponseUtil.out(response, R.error()); } if (usernamePasswordAuthenticationToken != null) { SecurityContextHolder.getContext().setAuthentication(usernamePasswordAuthenticationToken); } else { ResponseUtil.out(response, R.error()); } chain.doFilter(request, response); } /*********************************** * 用途说明:从request获取token，根据token获取权限列表 * 返回值说明: * @return org.springframework.security.authentication.UsernamePasswordAuthenticationToken ***********************************/ private UsernamePasswordAuthenticationToken getAuthentication(HttpServletRequest request) { String token = request.getHeader("token"); if (token != null && !"".equals(token.trim())) { String userName = tokenManager.getUserFromToken(token); List<String> permissionValueList = (List<String>) redisTemplate.opsForValue().get(userName); Collection<GrantedAuthority> authorities = new ArrayList<>(); for (String permissionValue : permissionValueList) { if (StringUtils.isEmpty(permissionValue)) { continue; } SimpleGrantedAuthority simpleGrantedAuthority = new SimpleGrantedAuthority(permissionValue); authorities.add(simpleGrantedAuthority); } return new UsernamePasswordAuthenticationToken(userName, token, authorities); } return null; } }
package com.stu.security.security; import com.stu.service.base.utils.MD5; import org.springframework.security.crypto.password.PasswordEncoder; import org.springframework.stereotype.Component; /****************************** * 用途说明: * 作者姓名: Administrator * 创建时间: 2022-09-01 9:39 ******************************/ @Component public class DefaultPasswordEncoder implements PasswordEncoder { /** * 加密密码 * * @param rawPassword */ @Override public String encode(CharSequence rawPassword) { return MD5.encrypt(rawPassword.toString()); } /** * 判断密码是否正确 * * @param rawPassword the raw password to encode and match * @param encodedPassword the encoded password from storage to compare with * @return true if the raw password, after encoding, matches the encoded password from * storage */ @Override public boolean matches(CharSequence rawPassword, String encodedPassword) { return encodedPassword.equals(MD5.encrypt(rawPassword.toString())); } }
package com.stu.security.security; import com.stu.service.base.result.R; import com.stu.service.base.utils.ResponseUtil; import org.springframework.data.redis.core.RedisTemplate; import org.springframework.security.authentication.AuthenticationManager; import org.springframework.security.core.Authentication; import org.springframework.security.web.authentication.logout.LogoutHandler; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; /****************************** * 用途说明: * 作者姓名: Administrator * 创建时间: 2022-09-01 9:39 ******************************/ public class TokenLogoutHandler implements LogoutHandler { private AuthenticationManager authenticationManager; private TokenManager tokenManager; private RedisTemplate redisTemplate; public TokenLogoutHandler(TokenManager tokenManager, RedisTemplate redisTemplate) { this.tokenManager = tokenManager; this.redisTemplate = redisTemplate; } @Override public void logout(HttpServletRequest request, HttpServletResponse response, Authentication authentication) { String token = request.getHeader("token"); if (token != null) { tokenManager.removeToken(token); String userName = tokenManager.getUserFromToken(token); redisTemplate.delete(userName); ResponseUtil.out(response, R.ok()); } } }
package com.stu.security.security; import io.jsonwebtoken.CompressionCodecs; import io.jsonwebtoken.Jwts; import io.jsonwebtoken.SignatureAlgorithm; import org.springframework.stereotype.Component; import java.util.Date; /****************************** * 用途说明: * 作者姓名: Administrator * 创建时间: 2022-09-01 9:40 ******************************/ @Component public class TokenManager { private long tokenExpiration = 24*60*60*1000; private String tokenSignKey = "123456"; public String createToken(String username) { String token = Jwts.builder().setSubject(username) .setExpiration(new Date(System.currentTimeMillis() + tokenExpiration)) .signWith(SignatureAlgorithm.HS512, tokenSignKey).compressWith(CompressionCodecs.GZIP).compact(); return token; } public String getUserFromToken(String token) { String user = Jwts.parser().setSigningKey(tokenSignKey).parseClaimsJws(token).getBody().getSubject(); return user; } public void removeToken(String token) { //jwttoken无需删除，客户端扔掉即可。 } }
package com.stu.security.security; import com.stu.service.base.result.R; import com.stu.service.base.utils.ResponseUtil; import org.springframework.security.core.AuthenticationException; import org.springframework.security.web.AuthenticationEntryPoint; import javax.servlet.ServletException; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; import java.io.IOException; /****************************** * 用途说明: * 作者姓名: Administrator * 创建时间: 2022-09-01 9:40 ******************************/ public class UnauthorizedEntryPoint implements AuthenticationEntryPoint { @Override public void commence(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, AuthenticationException e) throws IOException, ServletException { ResponseUtil.out(httpServletResponse, R.error()); } }
目录截图
作者：明
出处：https://www.cnblogs.com/konglxblog//
版权：本文版权归作者和博客园共有
转载：欢迎转载，文章中请给出原文连接，此文章仅为个人知识学习分享，否则必究法律责任
