SpringSecurity在SSM项目中的简单使用

旧城等待， 2023-07-13 04:28 84阅读 0赞

注：仅为作为入门项目简单使用

### 一、导入jar包坐标 ###

<spring.security.version>5.0.1.RELEASE</spring.security.version>
    
    <dependency>
    <groupId>org.springframework.security</groupId>
    <artifactId>spring-security-web</artifactId>
    <version>${
        spring.security.version}</version>
    </dependency>
    <dependency>
    <groupId>org.springframework.security</groupId>
    <artifactId>spring-security-config</artifactId>
    <version>${
        spring.security.version}</version>
    </dependency>
    <dependency>
    <groupId>org.springframework.security</groupId>
    <artifactId>spring-security-core</artifactId>
    <version>${
        spring.security.version}</version>
    </dependency>
    <dependency>
    <groupId>org.springframework.security</groupId>
    <artifactId>spring-security-taglibs</artifactId>
    <version>${
        spring.security.version}</version>
    </dependency>

### 二、在web.xml中配置SpringSecurity的过滤器 ###

<filter>
    	<filter-name>springSecurityFilterChain</filter-name>
    	<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
    </filter>
    <filter-mapping>
    	<filter-name>springSecurityFilterChain</filter-name>
    	<url-pattern>/*</url-pattern>
    </filter-mapping>

### 三、配置spring-security.xml配置文件 ###

**注**：该套配置仅为最简单的测试用配置

<?xml version="1.0" encoding="UTF-8"?>
    <beans xmlns="http://www.springframework.org/schema/beans"
           xmlns:security="http://www.springframework.org/schema/security"
           xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
           xsi:schemaLocation="http://www.springframework.org/schema/beans
        http://www.springframework.org/schema/beans/spring-beans.xsd
        http://www.springframework.org/schema/security
        http://www.springframework.org/schema/security/spring-security.xsd">
    
        <security:global-method-security pre-post-annotations="enabled" jsr250-annotations="enabled" secured-annotations="enabled"></security:global-method-security>
    
        
        <security:http pattern="/login.jsp" security="none"/>
        <security:http pattern="/failer.jsp" security="none"/>
        <security:http pattern="/css/**" security="none"/>
        <security:http pattern="/img/**" security="none"/>
        <security:http pattern="/plugins/**" security="none"/>
    
        
        <security:http auto-config="true" use-expressions="true">
            
            <security:intercept-url pattern="/**" access="hasAnyRole('ROLE_USER','ROLE_ADMIN')"/>
    
            
            
            
            
            
            
            <security:form-login login-page="/login.jsp"
                                 login-processing-url="/login.do"
                                default-target-url="/index.jsp"
                                authentication-failure-url="/failer.jsp"
                                authentication-success-forward-url="/pages/main.jsp"/>
    
            
            
            <security:csrf disabled="true"/>
    
            
            <security:logout invalidate-session="true" logout-url="/logout.do" logout-success-url="/login.jsp"></security:logout>
        </security:http>
    
        
        
        <security:authentication-manager>
            <security:authentication-provider user-service-ref="userService">
                
            </security:authentication-provider>
        </security:authentication-manager>
    
        
        
        <bean id="passwordEncoder" class="org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder"/>
    </beans>

### 四、创建第三方关联表 ###

添加测试数据  
![在这里插入图片描述][20200310214117716.png]

### 五、编写表和表之间的方法 ###

select \* from role where rid in(select rid from userrole where uid=\#\{uid\})

### 六、Service继承UserDetailService类 ###

public interface IUserInfoService **extends UserDetailsService**

### 七、完善bean ###

往UserInfo里注入private List roleList;  
添加get方法和set方法  
使userinfo里**包含**rolelist

### 八、实现实现类里的loadUserByUsername方法 ###

@Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        
        // 将当前登录的用户查询出来
        UserInfo userInfo = userInfoDao.findUserByUsername(username);
        // 将当前登录的用户对应的所属角色查询出来
        List<Role> roleList = roleDao.findRoleByUserId(userInfo.getId());
        // 将查询出的角色集合放入UserInfo中
        userInfo.setRoleList(roleList);
    
        // 将得到的信息交给SpringSecurity处理
        // SpringSecurity的内置对象 名字叫User
        User user=new User(userInfo.getUsername(),"{noop}"+userInfo.getPassword(),getAuthority(roleList));
    
        return user;
    }
    
    private Collection<? extends GrantedAuthority> getAuthority(List<Role> roleList) {
        
        // 创建SimpleGrantedAuthority对象的集合
        List<SimpleGrantedAuthority> list=new ArrayList<>();
    
        // 遍历角色信息 加上ROLE_前缀 构造成SimpleGrantedAuthority添加进数组
        for (Role role:roleList)
        {
        
            list.add(new SimpleGrantedAuthority("ROLE_"+role.getRname()));
        }
    
        // 返回SimpleGrantedAuthority对象的集合
        return list;
    }

### 九、若在控制器中自己写了登录方法 需要去掉 ###

注释掉Controller里的Login方法 不需要自己写的登录方法了  
因为SpringSecurity已经提供了

### 十、登录的时候信息提交的位置为SpringSecurity定义好的路径 ###

这样 登录的时候就可以交给SpringSecurity进行判断了

### 十一、在web.xml中加载SpringSecurity的配置文件 ###

多个配置文件之间用逗号进行连接

<context-param>
        <param-name>contextConfigLocation</param-name>
        <param-value>classpath:applicationContext.xml,classpath:spring-security.xml</param-value>
    </context-param>

--------------------

## principal对象： ##

SpringSecurity可以用专有标签获取到当前登录用户  
保存当前登录用户存放在**principal对象**中  
语法：`<security:authentication property="principal.属性名"/>`  
使用前 须在jsp页面前面添加头文件：

<%@taglib prefix="security" uri="http://www.springframework.org/security/tags" %>

## 权限的控制： ##

用security:authorize标签包裹  
语法：`<security:authorize access="hasRole('角色名')"></security:authorize>`

例：

--------------------

[20200310214117716.png]: https://img-blog.csdnimg.cn/20200310214117716.png