Spring Security学习笔记二(实例)

╰半夏微凉° 2023-06-15 11:20 25阅读 0赞

### 运用实例 ###

#### 建表 ####

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzIyMTM2NDM5_size_16_color_FFFFFF_t_70]

DROP TABLE IF EXISTS `user`;
    DROP TABLE IF EXISTS `role`;
    DROP TABLE IF EXISTS `user_role`;
    DROP TABLE IF EXISTS `role_permission`;
    DROP TABLE IF EXISTS `permission`;
    
    CREATE TABLE `user` (
    `id` bigint(11) NOT NULL AUTO_INCREMENT,
    `username` varchar(255) NOT NULL,
    `password` varchar(255) NOT NULL,
    PRIMARY KEY (`id`) 
    );
    CREATE TABLE `role` (
    `id` bigint(11) NOT NULL AUTO_INCREMENT,
    `name` varchar(255) NOT NULL,
    PRIMARY KEY (`id`) 
    );
    CREATE TABLE `user_role` (
    `user_id` bigint(11) NOT NULL,
    `role_id` bigint(11) NOT NULL
    );
    CREATE TABLE `role_permission` (
    `role_id` bigint(11) NOT NULL,
    `permission_id` bigint(11) NOT NULL
    );
    CREATE TABLE `permission` (
    `id` bigint(11) NOT NULL AUTO_INCREMENT,
    `url` varchar(255) NOT NULL,
    `name` varchar(255) NOT NULL,
    `description` varchar(255) NULL,
    `pid` bigint(11) NOT NULL,
    PRIMARY KEY (`id`) 
    );
    
    INSERT INTO user (id, username, password) VALUES (1,'user','e10adc3949ba59abbe56e057f20f883e'); 
    INSERT INTO user (id, username , password) VALUES (2,'admin','e10adc3949ba59abbe56e057f20f883e'); 
    INSERT INTO role (id, name) VALUES (1,'USER');
    INSERT INTO role (id, name) VALUES (2,'ADMIN');
    INSERT INTO permission (id, url, name, pid) VALUES (1,'/user/common','common',0);
    INSERT INTO permission (id, url, name, pid) VALUES (2,'/user/admin','admin',0);
    INSERT INTO user_role (user_id, role_id) VALUES (1, 1);
    INSERT INTO user_role (user_id, role_id) VALUES (2, 1);
    INSERT INTO user_role (user_id, role_id) VALUES (2, 2);
    INSERT INTO role_permission (role_id, permission_id) VALUES (1, 1);
    INSERT INTO role_permission (role_id, permission_id) VALUES (2, 1);
    INSERT INTO role_permission (role_id, permission_id) VALUES (2, 2);

#### pom.xml ####

<dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-security</artifactId>
    </dependency>
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-thymeleaf</artifactId>
    </dependency>
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-web</artifactId>
    </dependency>
    <dependency>
        <groupId>org.thymeleaf.extras</groupId>
        <artifactId>thymeleaf-extras-security4</artifactId>
    </dependency>

#### application.yml ####

spring:
      thymeleaf:
        mode: HTML5
        encoding: UTF-8
        cache: false
    
      datasource:
        driver-class-name: com.mysql.cj.jdbc.Driver
        url: jdbc:mysql://localhost:3306/spring_security?useUnicode=true&characterEncoding=utf-8&useSSL=false
        username: root
        password: password

#### User ####

public class User implements UserDetails, Serializable {
    
        private Long id;
        private String username;
        private String password;
    
        private List<Role> authorities;
    
        public Long getId() {
            return id;
        }
    
        public void setId(Long id) {
            this.id = id;
        }
    
        @Override
        public String getUsername() {
            return username;
        }
    
        public void setUsername(String username) {
            this.username = username;
        }
    
        @Override
        public String getPassword() {
            return password;
        }
    
        public void setPassword(String password) {
            this.password = password;
        }
    
        @Override
        public List<Role> getAuthorities() {
            return authorities;
        }
    
        public void setAuthorities(List<Role> authorities) {
            this.authorities = authorities;
        }
    
        /**
         * 用户帐号是否未过期
         * @return
         */
    
        @Override
        public boolean isAccountNonExpired() {
            return true;
        }
    
        /**
         * 用户帐号是否未锁定
         * @return
         */
        @Override
        public boolean isAccountNonLocked() {
            return true;
        }
    
        /**
         * 用户密码是否未过期
         * @return
         */
        @Override
        public boolean isCredentialsNonExpired() {
            return true;
        }
    
        /**
         * 用户是否可用
         * @return
         */
        @Override
        public boolean isEnabled() {
            return true;
        }
    }

上面的 User 类实现了 UserDetails 接口，该接口是实现Spring Security 认证信息的核心接口。其中 getUsername 方法为 UserDetails 接口 的方法，这个方法返回 username，也可以是其他的用户信息，例如手机号、邮箱等。getAuthorities() 方法返回的是该用户设置的权限信息，在本实例中，从数据库取出用户的所有角色信息，权限信息也可以是用户的其他信息，不一定是角色信息。另外需要读取密码，最后几个方法一般情况下都返回 true，也可以根据自己的需求进行业务判断。

#### Role ####

public class Role implements GrantedAuthority {
        private Long id;
        private String name;
    
        public Long getId() {
            return id;
        }
    
        public void setId(Long id) {
            this.id = id;
        }
    
        public String getName() {
            return name;
        }
    
        public void setName(String name) {
            this.name = name;
        }
    
        @Override
        public String getAuthority() {
            return name;
        }
    }

Role 类实现了 GrantedAuthority 接口，并重写 getAuthority() 方法。权限点可以为任何字符串，不一定非要用角色名。  
**AuthenticationManager会设置到一个GrantedAuthority列表到Authentication对象中保存，GrantedAuthority列表表示用户所具有的权限，AccessDecisionManager将从Authentication中获取用户的GrantedAuthority来鉴定用户是否具有访问权限**

#### UserMapper ####

@Mapper
    public interface UserMapper {
        /**
         * 通过用户名加载用户
         * @param userName
         * @return
         */
        User findByUsername(@Param("userName") String userName);
    }

#### UserMapper.xml ####

<?xml version="1.0" encoding="UTF-8" ?>
    <!DOCTYPE mapper
            PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
            "http://mybatis.org/dtd/mybatis-3-mapper.dtd">
    <mapper namespace="com.example.backend_template.mapper.UserMapper">
        <select id="findByUsername" parameterType="string" resultType="com.example.spring_security.entity.User">
        SELECT * FROM user u WHERE u.username = #{userName}
        </select>
    </mapper>

#### RoleMapper类 ####

@Mapper
    public interface RoleMapper {
        /**
         * 通过用户ID查找用户角色
         * @param userId
         * @return
         */
        List<Role> findByUserId(@Param("userId") Long userId);
    }

#### RoleMapper.xml ####

<?xml version="1.0" encoding="UTF-8" ?>
    <!DOCTYPE mapper
            PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
            "http://mybatis.org/dtd/mybatis-3-mapper.dtd">
    <mapper namespace="com.example.backend_template.mapper.RoleMapper">
        <select id="findByUserId" parameterType="Long" resultType="com.example.spring_security.entity.Role">
        SELECT * FROM role r WHERE r.id IN (SELECT ur.role_id FROM user_role ur WHERE ur.user_id = #{userId} )
        </select>
    </mapper>

#### PermissionMapper类 ####

@Mapper
    public interface PermissionMapper {
    
        List<Map<String, String>> findRoleAndPermissions();
    }

#### PermissionMapper.xml ####

<?xml version="1.0" encoding="UTF-8" ?>
    <!DOCTYPE mapper
            PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
            "http://mybatis.org/dtd/mybatis-3-mapper.dtd">
    <mapper namespace="com.example.backend_template.mapper.PermissionMapper">
        <select id="findRoleAndPermissions" resultType="java.util.HashMap">
        SELECT R.name,P.url FROM role AS R LEFT JOIN role_permission RP ON R.id=RP.role_id LEFT JOIN permission AS P ON RP.permission_id=P.id
        </select>
    </mapper>

写完后，还要在启动类上添加`@MapperScan("com.example.spring_security.mapper")`注解，这样才能扫描到xxxMapper类

#### UserDetailsServiceImpl类 ####

@Service
    public class UserDetailsServiceImpl implements UserDetailsService {
    
        @Autowired
        private UserMapper userMapper;
        @Autowired
        private RoleMapper roleMapper;
    
        @Override
        public UserDetails loadUserByUsername(String userName) throws UsernameNotFoundException {
            //查数据库，查找到用户名对应的所有角色，并注入user中
            User user = userMapper.findByUsername(userName);
            if (user != null) {
                List<Role> roles = roleMapper.findByUserId(user.getId());
                user.setAuthorities(roles);
            }
            return user;
        }
    }

Service 层需要实现 UserDetailsService 接口，该接口是根据用户名获取该用户的所有信息， 包括用户信息和权限点

#### InvocationSecurityMetadataSourceServiceImpl类 ####

@Component
    public class InvocationSecurityMetadataSourceServiceImpl implements FilterInvocationSecurityMetadataSource {
    
        @Autowired
        private PermissionMapper permissionMapper;
    
        /**
         * 每一个资源所需要的角色 Collection<ConfigAttribute>决策器会用到
         */
        private static HashMap<String, Collection<ConfigAttribute>> map = null;
    
        /**
         * 返回请求的资源需要的角色
         *
         * @param o
         * @return
         * @throws IllegalArgumentException
         */
        @Override
        public Collection<ConfigAttribute> getAttributes(Object o) throws IllegalArgumentException {
            //object 中包含用户请求的request 信息
            HttpServletRequest request = ((FilterInvocation) o).getHttpRequest();
            for (Iterator<String> it = map.keySet().iterator(); it.hasNext(); ) {
                String url = it.next();
                if (new AntPathRequestMatcher(url).matches(request)) {
                    return map.get(url);
                }
            }
            return null;
        }
    
        @Override
        public Collection<ConfigAttribute> getAllConfigAttributes() {
            //初始化 所有资源 对应的角色
            loadResourceDefine();
            return null;
        }
    
        @Override
        public boolean supports(Class<?> aClass) {
            return true;
        }
    
        /**
         * 初始化 所有资源 对应的角色
         */
        public void loadResourceDefine() {
            map = new HashMap<>(16);
            //查出结果为角色和对应URL的集合
            List<Map<String, String>> roleAndPermissions = permissionMapper.findRoleAndPermissions();
    
            //某个资源可以被哪些角色访问
            for (Map<String, String> roleAndPermission : roleAndPermissions) {
    
                String roleName = roleAndPermission.get("name");
                String url = roleAndPermission.get("url");
                ConfigAttribute role = new SecurityConfig(roleName);
    
                if (map.containsKey(url)) {
                    map.get(url).add(role);
                } else {
                    List<ConfigAttribute> list = new ArrayList<>();
                    list.add(role);
                    map.put(url, list);
                }
            }
        }
    }

InvocationSecurityMetadataSourceServiceImpl 类实现了 FilterInvocationSecurityMetadataSource，FilterInvocationSecurityMetadataSource 的作用是用来储存请求与权限的对应关系。

FilterInvocationSecurityMetadataSource接口有3个方法：

boolean supports(Class<?> clazz)：指示该类是否能够为指定的方法调用或Web请求提供ConfigAttributes。  
Collection getAllConfigAttributes()：Spring容器启动时自动调用, 一般把所有请求与权限的对应关系也要在这个方法里初始化, 保存在一个属性变量里。  
Collection getAttributes(Object object)：当接收到一个http请求时, filterSecurityInterceptor会调用的方法. 参数object是一个包含url信息的HttpServletRequest实例. 这个方法要返回请求该url所需要的所有权限集合

#### AccessDecisionManagerImpl类 ####

@Component
    public class AccessDecisionManagerImpl implements AccessDecisionManager {
    
        /**
         * 通过传递的参数来决定用户是否有访问对应受保护对象的权限
         *
         * @param authentication 包含了当前的用户信息，包括拥有的权限。这里的权限来源就是前面登录时UserDetailsService中设置的authorities。
         * @param object  就是FilterInvocation对象，可以得到request等web资源
         * @param configAttributes configAttributes是本次访问需要的权限
         */
        @Override
        public void decide(Authentication authentication, Object object, Collection<ConfigAttribute> configAttributes) throws AccessDeniedException, InsufficientAuthenticationException {
            if (configAttributes == null || configAttributes.size() <= 0) {
                return;
            } else {
                String needRole;
                for (Iterator<ConfigAttribute> iterator = configAttributes.iterator(); iterator.hasNext();) {
                    needRole = iterator.next().getAttribute();
                    for (GrantedAuthority ga : authentication.getAuthorities()) {
                        if (needRole.trim().equals(ga.getAuthority().trim())) {
                            return;
                        }
                    }
                }
            }
            throw new AccessDeniedException("当前没有访问权限！");
        }
    
        /**
         * 表示此AccessDecisionManager是否能够处理传递的ConfigAttribute呈现的授权请求
         * @param configAttribute
         * @return
         */
        @Override
        public boolean supports(ConfigAttribute configAttribute) {
            return true;
        }
    
        /**
         * 表示当前AccessDecisionManager实现是否能够为指定的安全对象（方法调用或Web请求）提供访问控制决策
         * @param aClass
         * @return
         */
        @Override
        public boolean supports(Class<?> aClass) {
            return true;
        }
    }

AccessDecisionManagerImpl 类实现了AccessDecisionManager接口，AccessDecisionManager是由AbstractSecurityInterceptor调用的，它负责鉴定用户是否有访问对应资源（方法或URL）的权限。

#### FilterSecurityInterceptorImpl类 ####

@Component
    public class FilterSecurityInterceptorImpl extends AbstractSecurityInterceptor implements Filter {
    
        @Autowired
        private FilterInvocationSecurityMetadataSource securityMetadataSource;
    
        @Autowired
        public void setAccessDecisionManagerImpl(AccessDecisionManagerImpl accessDecisionManagerImpl) {
            super.setAccessDecisionManager(accessDecisionManagerImpl);
        }
    
        @Override
        public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws IOException, ServletException {
            FilterInvocation fi = new FilterInvocation(servletRequest, servletResponse, filterChain);
            invoke(fi);
        }
    
        public void invoke(FilterInvocation fi) throws IOException,ServletException {
            InterceptorStatusToken token = super.beforeInvocation(fi);
            try {
                //执行下一个拦截器
                fi.getChain().doFilter(fi.getRequest(),fi.getResponse());
            }finally {
                super.afterInvocation(token, null);
            }
        }
    
        @Override
        public Class<?> getSecureObjectClass() {
            return FilterInvocation.class;
        }
    
        @Override
        public SecurityMetadataSource obtainSecurityMetadataSource() {
            return this.securityMetadataSource;
        }
    }

每种受支持的安全对象类型（方法调用或Web请求）都有自己的拦截器类，它是AbstractSecurityInterceptor的子类，AbstractSecurityInterceptor 是一个实现了对受保护对象的访问进行拦截的抽象类。  
AbstractSecurityInterceptor中的方法说明：  
beforeInvocation()方法实现了对访问受保护对象的权限校验，内部用到了AccessDecisionManager和AuthenticationManager；  
finallyInvocation()方法用于实现受保护对象请求完毕后的一些清理工作，主要是如果在beforeInvocation()中改变了SecurityContext，则在finallyInvocation()中需要将其恢复为原来的SecurityContext，该方法的调用应当包含在子类请求受保护资源时的finally语句块中。  
afterInvocation()方法实现了对返回结果的处理，在注入了AfterInvocationManager的情况下默认会调用其decide()方法。  
了解了AbstractSecurityInterceptor，就应该明白了，我们自定义FilterSecurityInterceptorImpl就是想使用我们之前自定义的 AccessDecisionManager 和 securityMetadataSource。

#### SecurityConfig ####

@EnableWebSecurity注解以及WebSecurityConfigurerAdapter一起配合提供基于web的security。自定义类 继承了WebSecurityConfigurerAdapter来重写了一些方法来指定一些特定的Web安全设置。

@Configuration
    @EnableWebSecurity
    public class SecurityConfig extends WebSecurityConfigurerAdapter {
        @Autowired
        private UserDetailsServiceImpl userService;
        @Autowired
        public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
            //校验用户
            auth.userDetailsService(userService).passwordEncoder(new PasswordEncoder() {
                //对密码进行加密
                @Override
                public String encode(CharSequence charSequence) {
                    return DigestUtils.md5DigestAsHex(charSequence.toString().getBytes());
                }
                //对密码进行判断匹配
                @Override
                public boolean matches(CharSequence charSequence, String s) {
                    String encode = DigestUtils.md5DigestAsHex(charSequence.toString().getBytes());
                    boolean res = s.equals(encode);
                    return res;
                }
            });
        }
    
        @Override
        protected void configure(HttpSecurity http) throws Exception {
            http.authorizeRequests()
                    .antMatchers("/", "/index", "/login", "/login-error", "/401").permitAll()
                    .anyRequest().authenticated()
                    .and()
                    .formLogin().loginPage("/login").failureUrl("/login-error")
                    .and()
                    .exceptionHandling().accessDeniedPage("/401");
            http.logout().logoutSuccessUrl("/");
        }
    }

#### SecurityController类 ####

@Controller
    public class SecurityController {
        @RequestMapping("/")
        public String root() {
            return "redirect:/index";
        }
        @RequestMapping("/index")
        public String index() {
            return "index";
        }
        @RequestMapping("/login")
        public String login() {
            return "login";
        }
        @RequestMapping("/login-error")
        public String loginError(Model model) {
            model.addAttribute( "loginError"  , true);
            return "login";
        }
        @GetMapping("/401")
        public String accessDenied() {
            return "401";
        }
        @GetMapping("/user/common")
        public String common() {
            return "user/common";
        }
        @GetMapping("/user/admin")
        public String admin() {
            return "user/admin";
        }
    }

#### `resources/templates`下新建401.html ####

<!DOCTYPE html>
    <html lang="en">
    <head>
        <meta charset="UTF-8">
        <title>401 page</title>
    </head>
    <body>
        <div>
            <div>
                <h2>权限不够</h2>
                <p>拒绝访问！</p>
            </div>
        </div>
    </body>
    </html>

#### `resources/templates`下新建index.html ####

<!DOCTYPE html>
    <html lang="en" xmlns:th="http://www.thymeleaf.org">
    <head>
    <head>
        <meta charset="UTF-8">
        <title>首页</title>
    </head>
    <body>
        <h2>page list</h2>
        <a href="/user/common">common page</a>
        <br/>
        <a href="/user/admin">admin page</a>
        <br/>
        <form th:action="@{/logout}" method="post">
            <input type="submit" class="btn btn-primary" value="注销"/>
        </form>
    </body>
    </html>

#### `resources/templates`下新建login.html ####

<!DOCTYPE html>
    <html xmlns="http://www.w3.org/1999/xhtml" xmlns:th="http://www.thymeleaf.org">
    <head>
        <meta charset="UTF-8">
        <title>登录</title>
    </head>
    <body>
        <h1>Login page</h1>
        <p th:if="${loginError}" class="error">用户名或密码错误</p>
        <form th:action="@{/login}" method="post">
            <label for="username">用户名</label>:
            <input type="text" id="username" name="username" autofocus="autofocus" />
            <br/>
            <label for="password">密　码</label>:
            <input type="password" id="password" name="password" />
            <br/>
            <input type="submit" value="登录" />
        </form>
        <p><a href="/index" th:href="@{/index}"></a></p>
    </body>
    </html>

#### `resources/templates/user`下新建admin.html ####

<!DOCTYPE html>
    <head>
        <meta charset="UTF-8">
        <title>admin page</title>
    </head>
    <body>
        success admin page！！！
    </body>
    </html>

#### `resources/templates/user`下新建common.html ####

<!DOCTYPE html>
    <head>
        <meta charset="UTF-8">
        <title>common page</title>
    </head>
    <body>
        success common page！！！
    </body>
    </html>

*  启动项目，访问 http://localhost:8080/index 并选择 `common page`  
    ![在这里插入图片描述][20200630154002715.png]
 *  输入用户名：”user“，密码：”123456“，出现以下界面，说明登陆成功  
    ![在这里插入图片描述][20200630154042893.png]
 *  接着访问 http://localhost:8080/user/admin ，会出现以下界面，因为user用户没有权力访问`/user/admin`界面，必须用`admin`帐号才能访问  
    ![在这里插入图片描述][20200630154102427.png]  
    如成功出现以上所有结果，则 Spring Security 整合成功

### 参考 ###

**[Spring Boot Security 详解][Spring Boot Security]**

[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzIyMTM2NDM5_size_16_color_FFFFFF_t_70]: https://img-blog.csdnimg.cn/2019112109542789.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzIyMTM2NDM5,size_16,color_FFFFFF,t_70
[20200630154002715.png]: https://img-blog.csdnimg.cn/20200630154002715.png
[20200630154042893.png]: https://img-blog.csdnimg.cn/20200630154042893.png
[20200630154102427.png]: https://img-blog.csdnimg.cn/20200630154102427.png
[Spring Boot Security]: https://www.jianshu.com/p/e715cc993bf0