springsecurity在springboot项目中的配置

1 jsp做页面展示

1.1 包

<!--使用jsp必须打war包，表明这是一个web项目--> <packaging>war</packaging> <parent> <groupId>org.springframework.boot</groupId> <artifactId>spring-boot-starter-parent</artifactId> <version>2.1.3.RELEASE</version> <relativePath/> </parent> <dependencies> <dependency> <groupId>org.springframework.boot</groupId> <artifactId>spring-boot-starter-web</artifactId> </dependency> <dependency> <groupId>org.springframework.boot</groupId> <artifactId>spring-boot-starter-security</artifactId> </dependency> <dependency> <groupId>org.springframework.boot</groupId> <artifactId>spring-boot-starter-tomcat</artifactId> </dependency> <dependency> <groupId>org.apache.tomcat.embed</groupId> <artifactId>tomcat-embed-jasper</artifactId> </dependency> <!--jsp页面的el标签--> <dependency> <groupId>org.springframework.security</groupId> <artifactId>spring-security-taglibs</artifactId> <version>5.1.5.RELEASE</version> </dependency> <dependency> <groupId>jstl</groupId> <artifactId>jstl</artifactId> <version>1.2</version> </dependency> <dependency> <groupId>mysql</groupId> <artifactId>mysql-connector-java</artifactId> </dependency> <!--通用mapper--> <dependency> <groupId>tk.mybatis</groupId> <artifactId>mapper-spring-boot-starter</artifactId> <version>2.0.4</version> </dependency> <dependency> <groupId>org.projectlombok</groupId> <artifactId>lombok</artifactId> </dependency> </dependencies>

1.2 application.yml配置文件

配置很简单，不做解释

server: port: 8080 spring: mvc: view: prefix: /pages/ suffix: .jsp datasource: url: jdbc:mysql:///security_authority?useUnicode=true&characterEncoding=UTF-8&serverTimezone=UTC username: root password: driver-class-name: com.mysql.cj.jdbc.Driver mybatis: type-aliases-package: cn.lx.security.doamin configuration: #驼峰 map-underscore-to-camel-case: true logging: level: cn.lx.security: debug

1.3 日志的配置文件log4j.properties

这个可以去log4j官网找

# Set root category priority to INFO and its only appender to CONSOLE. #log4j.rootCategory=INFO, CONSOLE debug info warn error fatal log4j.rootCategory=debug, CONSOLE, LOGFILE # Set the enterprise logger category to FATAL and its only appender to CONSOLE. log4j.logger.org.apache.axis.enterprise=FATAL, CONSOLE # CONSOLE is set to be a ConsoleAppender using a PatternLayout. log4j.appender.CONSOLE=org.apache.log4j.ConsoleAppender log4j.appender.CONSOLE.layout=org.apache.log4j.PatternLayout log4j.appender.CONSOLE.layout.ConversionPattern=%d{ISO8601} %-6r [%15.15t] %-5p %30.30c %x - %m\n # LOGFILE is set to be a File appender using a PatternLayout. log4j.appender.LOGFILE=org.apache.log4j.FileAppender log4j.appender.LOGFILE.File=../logs/wlanapi/client.log log4j.appender.LOGFILE.Append=true log4j.appender.LOGFILE.layout=org.apache.log4j.PatternLayout log4j.appender.LOGFILE.layout.ConversionPattern=%d{ISO8601} %-6r [%15.15t] %-5p %30.30c %x - %m\n

1.4 在main下面创建一个webapp包

项目会自动将包标点，如此，web项目创建成功

将项目需要的jsp，css等资源复制到webapp下，使用代码生成工具生成三层结构，并实现对用户，角色，权限的增删改查，这个太简单了，而且不是我们的重点，这里我们就默认已经搭建好了。接下来我们就来实现对security的配置。

1.5 security的前置准备

1.5.1 修改SysUser

SysUser直接UserDetails接口，这样我们在loadUserByUsername方法中就不用创建UserDetails实现类User的对象了，而是直接使用SysUser，非常方便，注意，要添加一个额外的属性，就是该用户拥有的权限的list集合

@Data @Table(name = "sys_user") public class SysUser implements UserDetails { @Id @GeneratedValue(strategy= GenerationType.IDENTITY) @Column(name = "id") private Integer id; @Column(name = "username") private String username; @Column(name = "password") private String password; @Column(name = "status") private Integer status; //权限的集合对象 private List<SysPermission> authorities; /** * Returns the authorities granted to the user. Cannot return <code>null</code>. * * @return the authorities, sorted by natural key (never <code>null</code>) */ @JsonIgnore @Override public Collection<? extends GrantedAuthority> getAuthorities() { return authorities; } /** * Indicates whether the user's account has expired. An expired account cannot be * authenticated. * * @return <code>true</code> if the user's account is valid (ie non-expired), * <code>false</code> if no longer valid (ie expired) */ @JsonIgnore @Override public boolean isAccountNonExpired() { return true; } /** * Indicates whether the user is locked or unlocked. A locked user cannot be * authenticated. * * @return <code>true</code> if the user is not locked, <code>false</code> otherwise */ @JsonIgnore @Override public boolean isAccountNonLocked() { return true; } /** * Indicates whether the user's credentials (password) has expired. Expired * credentials prevent authentication. * * @return <code>true</code> if the user's credentials are valid (ie non-expired), * <code>false</code> if no longer valid (ie expired) */ @JsonIgnore @Override public boolean isCredentialsNonExpired() { return true; } /** * Indicates whether the user is enabled or disabled. A disabled user cannot be * authenticated. * 4个布尔值必须全为true，用户才算认证通过，这几个上篇文档已经讲过了 * @return <code>true</code> if the user is enabled, <code>false</code> otherwise */ @JsonIgnore @Override public boolean isEnabled() { return status==1; } }

1.5.2 修改SysPermission

我们让SysPermission实现GrantedAuthority接口，这样在loadUserByUsername方法中就不用了重新封装权限了

@Data @Table(name = "sys_permission") public class SysPermission implements GrantedAuthority { @Id @GeneratedValue(strategy= GenerationType.IDENTITY) @Column(name = "ID") private Integer id; @Column(name = "permission_NAME") private String permissionName; @Column(name = "permission_url") private String permissionUrl; @Column(name = "parent_id") private String parentId; /** * If the <code>GrantedAuthority</code> can be represented as a <code>String</code> * and that <code>String</code> is sufficient in precision to be relied upon for an * access control decision by an {@link AccessDecisionManager} (or delegate), this * method should return such a <code>String</code>. * <p> * If the <code>GrantedAuthority</code> cannot be expressed with sufficient precision * as a <code>String</code>, <code>null</code> should be returned. Returning * <code>null</code> will require an <code>AccessDecisionManager</code> (or delegate) * to specifically support the <code>GrantedAuthority</code> implementation, so * returning <code>null</code> should be avoided unless actually required. * * @return a representation of the granted authority (or <code>null</code> if the * granted authority cannot be expressed as a <code>String</code> with sufficient * precision). * @JsonIgnore 这个注解这个注解的作用是在序列化的时候忽略authority字段 */ @JsonIgnore @Override public String getAuthority() { return permissionName; } }

1.5.3 修改IUserService接口

继承UserDetailsService接口，并实现

@Service public class IUserServiceImpl implements IUserService { @Autowired private UserMapper userMapper; /** * Locates the user based on the username. In the actual implementation, the search * may possibly be case sensitive, or case insensitive depending on how the * implementation instance is configured. In this case, the <code>UserDetails</code> * object that comes back may have a username that is of a different case than what * was actually requested.. * * @param username the username identifying the user whose data is required. * @return a fully populated user record (never <code>null</code>) * @throws UsernameNotFoundException if the user could not be found or the user has no * GrantedAuthority */ @Override public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException { //这里是不是很简单 SysUser sysUser = userMapper.findByUsername(username); if (null==sysUser){ throw new RuntimeException("没有此用户"); } return sysUser; } }

1.5.4 修改UserMapper

//这里不仅仅只是查询出用户信息，还要查询用户拥有的权限 SysUser sysUser = userMapper.findByUsername(username);

所以我们可以直接这样，不理解的自己去查一下资料

@Select("select * from sys_user where username=#{username}") @Results({@Result(id = true, property = "id", column = "id"), @Result(property = "authorities", column = "id", javaType = List.class, many = @Many(select = "cn.lx.security.dao.RermissionMapper.findByUid"))}) public SysUser findByUsername(String username);

然后我们在RermissionMapper定义一个方法

//根据用户id查询该用户所拥有的权限 @Select("SELECT * FROM sys_permission WHERE ID IN(" + "SELECT PID FROM sys_role_permission WHERE RID IN(" + "SELECT RID FROM sys_user_role WHERE uid=#{uid}" + "))") public List<SysPermission> findByUid(Integer uid);

1.6 配置security

新建一个security的配置类

@Configuration @EnableWebSecurity //spring的安全注解，推荐使用 @EnableGlobalMethodSecurity(prePostEnabled = true) public class SecurityConfig extends WebSecurityConfigurerAdapter { @Autowired private IUserService iUserService; @Autowired private BCryptPasswordEncoder bCryptPasswordEncoder; /** * Used by the default implementation of {@link #authenticationManager()} to attempt * to obtain an {@link AuthenticationManager}. If overridden, the * {@link AuthenticationManagerBuilder} should be used to specify the * {@link AuthenticationManager}. * * <p> * The {@link #authenticationManagerBean()} method can be used to expose the resulting * {@link AuthenticationManager} as a Bean. The {@link #userDetailsServiceBean()} can * be used to expose the last populated {@link UserDetailsService} that is created * with the {@link AuthenticationManagerBuilder} as a Bean. The * {@link UserDetailsService} will also automatically be populated on * {@link HttpSecurity#getSharedObject(Class)} for use with other * {@link SecurityContextConfigurer} (i.e. RememberMeConfigurer ) * </p> * * <p> * For example, the following configuration could be used to register in memory * authentication that exposes an in memory {@link UserDetailsService}: * </p> * * <pre> * &#064;Override * protected void configure(AuthenticationManagerBuilder auth) { * auth * // enable in memory based authentication with a user named * // &quot;user&quot; and &quot;admin&quot; * .inMemoryAuthentication().withUser(&quot;user&quot;).password(&quot;password&quot;).roles(&quot;USER&quot;).and() * .withUser(&quot;admin&quot;).password(&quot;password&quot;).roles(&quot;USER&quot;, &quot;ADMIN&quot;); * } * * // Expose the UserDetailsService as a Bean * &#064;Bean * &#064;Override * public UserDetailsService userDetailsServiceBean() throws Exception { * return super.userDetailsServiceBean(); * } * * </pre> * * @param auth the {@link AuthenticationManagerBuilder} to use * @throws Exception */ @Override protected void configure(AuthenticationManagerBuilder auth) throws Exception { //在内存中注册一个账号 //auth.inMemoryAuthentication().withUser("user").password("{noop}123").roles("USER"); //连接数据库，使用数据库中的账号 auth.userDetailsService(iUserService).passwordEncoder(bCryptPasswordEncoder); } /** * Override this method to configure {@link WebSecurity}. For example, if you wish to * ignore certain requests. * 这些资源可以直接访问，不需要认证 * @param web */ @Override public void configure(WebSecurity web) throws Exception { web.ignoring().antMatchers("/css/**", "/img/**", "/plugins/**", "/failer.jsp", "/login.jsp"); } /** * Override this method to configure the {@link HttpSecurity}. Typically subclasses * should not invoke this method by calling super as it may override their * configuration. The default configuration is: * * <pre> * http.authorizeRequests().anyRequest().authenticated().and().formLogin().and().httpBasic(); * </pre> * 读过上一篇文档的应该对这些配置有所了解 * @param http the {@link HttpSecurity} to modify * @throws Exception if an error occurs */ @Override protected void configure(HttpSecurity http) throws Exception { http.csrf().disable() //禁用csrf .authorizeRequests() //所有请求都需要认证 .anyRequest().authenticated() .and() //配置登录相关 .formLogin().loginPage("/login.jsp").loginProcessingUrl("/login").defaultSuccessUrl("/index.jsp").failureForwardUrl("/failer.jsp").permitAll() .and() //配置注销相关 .logout().logoutUrl("/logout").logoutSuccessUrl("/login.jsp").invalidateHttpSession(true).permitAll(); }

1.7 方法授权控制

//具体加到那个方法上，我就不具体说了 @PreAuthorize(value = "hasAuthority('权限名')")

jsp上菜单控制上一篇文档已经给大家看过了，这里就不展示了

2 thymeleaf模板做页面展示

2.1 静态资源

在resources下面新建一个static文件夹，静态资源全部放这里面，具体的见下图

2.2 登录页面

只需要注意两个地方，其他的和jsp差不多

（1）thymeleaf的约束

<!DOCTYPE HTML> <html xmlns:th="http://www.thymeleaf.org">

（2）静态资源的路径

不需要写static路径，程序会自动识别static下的静态资源

<link rel="stylesheet" href="/plugins/bootstrap/css/bootstrap.min.css"> <link rel="stylesheet" href="/plugins/font-awesome/css/font-awesome.min.css"> <link rel="stylesheet" href="/plugins/ionicons/css/ionicons.min.css"> <link rel="stylesheet" href="/plugins/adminLTE/css/AdminLTE.css"> <link rel="stylesheet" href="/plugins/iCheck/square/blue.css">

2.3 页面跳转的控制器

必须要写一个控制器，通过controller访问页面，我们可以写一个mvc的配置类

@Configuration //不要使用这个注解，他会禁用springboot的自动装配，导致很多默认配置失效 //@EnableWebMvc public class MvcConfig implements WebMvcConfigurer { /** * Configure simple automated controllers pre-configured with the response * status code and/or a view to render the response body. This is useful in * cases where there is no need for custom controller logic -- e.g. render a * home page, perform simple site URL redirects, return a 404 status with * HTML content, a 204 with no content, and more. * * @param registry */ @Override public void addViewControllers(ViewControllerRegistry registry) { registry.addViewController("/loginPage").setViewName("login"); } }

2.4 security的配置

//这些资源不需要认证即可访问 @Override public void configure(WebSecurity web) throws Exception { web.ignoring().antMatchers("/css/**", "/img/**", "/plugins/**", "favicon.ico", "/loginPage"); }

还要修改登录页面

@Override protected void configure(HttpSecurity http) throws Exception { http.csrf().disable() .authorizeRequests() //.antMatchers("/css/**", "/img/**", "/plugins/**").permitAll() .anyRequest().authenticated() .and() //.formLogin().loginPage("/login.jsp").loginProcessingUrl("/login").defaultSuccessUrl("/index.jsp").failureForwardUrl("/failer.jsp").permitAll() //我们这里是前后端分离，不需要默认跳转页面和登录失败的页面 .formLogin().loginPage("/loginPage").loginProcessingUrl("/login").permitAll() .and() .logout().logoutUrl("/logout").logoutSuccessUrl("/loginPage").invalidateHttpSession(true).permitAll(); }