• spring boot学习第十三篇:使用spring security控制权限

    该文章同时也讲到了如何使用swagger。

    1、pom.xml文件内容如下：

    1. <?xml version="1.0" encoding="UTF-8"?>
    2. <project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    3. 	xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
    4. 	<modelVersion>4.0.0</modelVersion>
    5. 	<parent>
    6. 		<groupId>org.springframework.boot</groupId>
    7. 		<artifactId>spring-boot-starter-parent</artifactId>
    8. 		<version>2.3.5.RELEASE</version>
    9. 		<relativePath/> <!-- lookup parent from repository -->
    10. 	</parent>
    11. 	<groupId>com.hmblogs</groupId>
    12. 	<artifactId>springboot-security-demo</artifactId>
    13. 	<version>0.0.1-SNAPSHOT</version>
    14. 	<name>springboot-security-demo</name>
    15. 	<description>Demo project for Spring Boot</description>
    16.  
    17. 	<properties>
    18. 		<java.version>1.8</java.version>
    19. 	</properties>
    20.  
    21. 	<dependencies>
    22. 		<!--devtools热部署-->
    23.         <dependency>
    24.             <groupId>org.springframework.boot</groupId>
    25.             <artifactId>spring-boot-devtools</artifactId>
    26.             <optional>true</optional>
    27.             <scope>true</scope>
    28.         </dependency>
    29. 	
    30. 		<!--  springboor-->
    31.        <dependency>
    32.            <groupId>org.springframework.boot</groupId>
    33.            <artifactId>spring-boot-starter-web</artifactId>
    34.        </dependency>
    35.        <dependency>
    36.            <groupId>org.springframework.boot</groupId>
    37.            <artifactId>spring-boot-starter</artifactId>
    38.        </dependency>
    39. 	
    40. 		<dependency>
    41. 			<groupId>org.springframework.boot</groupId>
    42. 			<artifactId>spring-boot-starter-security</artifactId>
    43. 		</dependency>
    44.  
    45.         <dependency>
    46.             <groupId>org.springframework.boot</groupId>
    47.             <artifactId>spring-boot-actuator</artifactId>
    48.         </dependency>
    49.  
    50.         <dependency>
    51.             <groupId>org.springframework.boot</groupId>
    52.             <artifactId>spring-boot-starter-test</artifactId>
    53.             <scope>test</scope>
    54.         </dependency>
    55.  
    56.         <dependency>
    57.             <groupId>io.jsonwebtoken</groupId>
    58.             <artifactId>jjwt</artifactId>
    59.             <version>0.7.0</version>
    60.         </dependency>
    61.  
    62. 		<!-- swagger -->
    63.         <dependency>
    64.             <groupId>io.springfox</groupId>
    65.             <artifactId>springfox-swagger2</artifactId>
    66.             <version>2.9.2</version>
    67.         </dependency>
    68.         <dependency>
    69.             <groupId>io.springfox</groupId>
    70.             <artifactId>springfox-swagger-ui</artifactId>
    71.             <version>2.9.2</version>
    72.         </dependency>
    73.         
    74.         <dependency>
    75.             <groupId>org.projectlombok</groupId>
    76.             <artifactId>lombok</artifactId>
    77.         </dependency>
    78. 	</dependencies>
    79.  
    80. 	<build>
    81. 		<plugins>
    82. 			<plugin>
    83. 				<groupId>org.springframework.boot</groupId>
    84. 				<artifactId>spring-boot-maven-plugin</artifactId>
    85. 			</plugin>
    86. 		</plugins>
    87. 	</build>
    88.  
    89. </project>

    2、application.yml文件内容如下：

    1. server:
    2.   port: 8088
    3.   servlet:
    4.     context-path: /springboot-security-demo
    5.     
    6. spring:
    7.   security:
    8.     user:
    9.       name: user
    10.       password: 123456

    3、SpringbootSecurityDemoApplication文件内容如下：

    1. package com.hmblogs;
    2.  
    3. import org.springframework.boot.SpringApplication;
    4. import org.springframework.boot.autoconfigure.SpringBootApplication;
    5.  
    6. @SpringBootApplication
    7. public class SpringbootSecurityDemoApplication {
    8.  
    9. 	public static void main(String[] args) {
    10. 		SpringApplication.run(SpringbootSecurityDemoApplication.class, args);
    11. 	}
    12.  
    13. }

    4、UserDetailsServiceImpl代码如下：

    1. package com.hmblogs.service.impl;
    2.  
    3. import java.util.ArrayList;
    4. import java.util.List;
    5.  
    6. import com.hmblogs.pojo.Admin;
    7. import org.springframework.security.core.GrantedAuthority;
    8. import org.springframework.security.core.authority.SimpleGrantedAuthority;
    9. import org.springframework.security.core.userdetails.User;
    10. import org.springframework.security.core.userdetails.UserDetails;
    11. import org.springframework.security.core.userdetails.UserDetailsService;
    12. import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
    13. import org.springframework.stereotype.Service;
    14.  
    15. @Service
    16. public class UserDetailsServiceImpl implements UserDetailsService {
    17.  
    18. 	@Override
    19. 	public UserDetails loadUserByUsername(String username) {
    20. 		List grantedAuthorities = new ArrayList();
    21. 		Admin admin = new Admin();
    22. 		
    23. 		if (username.equals("employee")) {
    24. 			admin.setUsername("employee");
    25. 			admin.setPassword("123456");
    26. 			GrantedAuthority grantedAuthority = new SimpleGrantedAuthority("ROLE_EMPLOYEE");
    27. 			grantedAuthorities.add(grantedAuthority);
    28. 			// 创建用户，用户判断权限
    29. 			return new User(
    30. 					admin.getUsername(), 
    31. 					new BCryptPasswordEncoder().encode(admin.getPassword()), 
    32. 					grantedAuthorities);
    33. 		} 
    34. 		
    35. 		if (username.equals("admin")) {
    36. 			admin.setUsername("admin");
    37. 			admin.setPassword("123456");
    38. 			GrantedAuthority grantedAuthority = new SimpleGrantedAuthority("ROLE_ADMIN");
    39. 			grantedAuthorities.add(grantedAuthority);
    40. 			// 创建用户，用户判断权限
    41. 			return new User(
    42. 					admin.getUsername(), 
    43. 					new BCryptPasswordEncoder().encode(admin.getPassword()), 
    44. 					grantedAuthorities);
    45. 		}
    46. 		
    47. 		return null;
    48. 	}
    49.  
    50. }

    5、Admin这一个对象类代码如下：

    1. package com.hmblogs.pojo;
    2.  
    3.  
    4. public class Admin {
    5.  
    6. 	private String username;
    7. 	
    8. 	private String password;
    9.  
    10. 	public Admin() {
    11. 		super();
    12. 	}
    13.  
    14. 	public Admin(String username, String password) {
    15. 		super();
    16. 		this.username = username;
    17. 		this.password = password;
    18. 	}
    19.  
    20. 	public String getUsername() {
    21. 		return username;
    22. 	}
    23.  
    24. 	public void setUsername(String username) {
    25. 		this.username = username;
    26. 	}
    27.  
    28. 	public String getPassword() {
    29. 		return password;
    30. 	}
    31.  
    32. 	public void setPassword(String password) {
    33. 		this.password = password;
    34. 	}
    35.  
    36. 	@Override
    37. 	public String toString() {
    38. 		return "Admin [username=" + username + ", password=" + password + "]";
    39. 	}
    40. 	
    41. }

    6、TestController测试接口类代码如下所示：

    1. package com.hmblogs.controller;
    2.  
    3. import org.springframework.web.bind.annotation.RequestMapping;
    4. import org.springframework.web.bind.annotation.RequestMethod;
    5. import org.springframework.web.bind.annotation.RestController;
    6.  
    7. @RestController
    8. @RequestMapping("/test/")
    9. public class TestController {
    10.  
    11. 	@RequestMapping(value = "get", method = RequestMethod.GET)
    12. 	public String get() {
    13. 		return "success";
    14. 	}
    15. 	
    16. }

    7、EmployeeController员工权限的员工接口类代码如下所示：

    1. package com.hmblogs.controller;
    2.  
    3. import org.springframework.web.bind.annotation.RequestMapping;
    4. import org.springframework.web.bind.annotation.RequestMethod;
    5. import org.springframework.web.bind.annotation.RestController;
    6.  
    7. @RestController
    8. @RequestMapping("/employee/")
    9. public class EmployeeController {
    10.  
    11. 	@RequestMapping(value = "greeting", method = RequestMethod.GET)
    12. 	public String greeting() {
    13. 		return "hello world";
    14. 	}
    15. 	
    16. 	@RequestMapping(value = "login", method = RequestMethod.GET)
    17. 	public String login() {
    18. 		return "login success";
    19. 	}
    20. 	
    21. }

    8、AdminController管理员接口类的代码如下所示：

    1. package com.hmblogs.controller;
    2.  
    3. import org.springframework.web.bind.annotation.RequestMapping;
    4. import org.springframework.web.bind.annotation.RequestMethod;
    5. import org.springframework.web.bind.annotation.RestController;
    6.  
    7. @RestController
    8. @RequestMapping("/admin/")
    9. public class AdminController {
    10.  
    11. 	@RequestMapping(value = "greeting", method = RequestMethod.GET)
    12. 	public String greeting() {
    13. 		return "hello world";
    14. 	}
    15. 	
    16. 	@RequestMapping(value = "login", method = RequestMethod.GET)
    17. 	public String login() {
    18. 		return "login success";
    19. 	}
    20. 	
    21. }

    9、SwaggerConfig代码如下：配置swagger

    1. package com.hmblogs.config;
    2.  
    3. import org.springframework.context.annotation.Bean;
    4. import org.springframework.context.annotation.Configuration;
    5. import springfox.documentation.builders.ApiInfoBuilder;
    6. import springfox.documentation.builders.PathSelectors;
    7. import springfox.documentation.builders.RequestHandlerSelectors;
    8. import springfox.documentation.service.ApiInfo;
    9. import springfox.documentation.spi.DocumentationType;
    10. import springfox.documentation.spring.web.plugins.Docket;
    11. import springfox.documentation.swagger2.annotations.EnableSwagger2;
    12.  
    13. @Configuration
    14. @EnableSwagger2
    15. public class SwaggerConfig {
    16.  
    17. 	@Bean
    18.     public Docket createRestApi(){
    19.         // 添加请求参数，我们这里把token作为请求头部参数传入后端
    20. 		return new Docket(DocumentationType.SWAGGER_2).apiInfo(apiInfo())
    21.                 .select().apis(RequestHandlerSelectors.any())
    22.                 .paths(PathSelectors.any()).build();
    23.     }
    24.  
    25.     private ApiInfo apiInfo(){
    26.         return new ApiInfoBuilder()
    27.                 .title("SpringBoot API Doc")
    28.                 .description("This is a restful api document of Spring Boot.")
    29.                 .version("1.0")
    30.                 .build();
    31.     }
    32. 	
    33. }

    10、SecurityConfig代码如下:

    1. package com.hmblogs.config;
    2.  
    3. import org.springframework.beans.factory.annotation.Autowired;
    4. import org.springframework.context.annotation.Bean;
    5. import org.springframework.context.annotation.Configuration;
    6. import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
    7. import org.springframework.security.config.annotation.web.builders.HttpSecurity;
    8. import org.springframework.security.config.annotation.web.builders.WebSecurity;
    9. import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
    10. import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
    11. import org.springframework.security.core.userdetails.UserDetailsService;
    12. import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
    13. import org.springframework.security.crypto.password.PasswordEncoder;
    14.  
    15. @Configuration
    16. @EnableWebSecurity
    17. public class SecurityConfig extends WebSecurityConfigurerAdapter {
    18.  
    19. 	@Autowired
    20. 	private UserDetailsService userDetailsService;
    21. 	
    22. 	@Bean
    23.     public PasswordEncoder passwordEncoder() {
    24.         return new BCryptPasswordEncoder();
    25.     }
    26. 	
    27. 	@Override
    28.     public void configure(WebSecurity web) throws Exception {
    29.         super.configure(web);
    30.     }
    31.  
    32.     @Override
    33.     public void configure(AuthenticationManagerBuilder auth) throws Exception {
    34.     	auth.userDetailsService(userDetailsService)
    35.                 .passwordEncoder(passwordEncoder());//passwoldEncoder是对密码的加密处理，如果user中密码没有加密，则可以不加此方法。注意加密请使用security自带的加密方式。
    36.     }
    37.  
    38.     @Override
    39.     protected void configure(HttpSecurity http) throws Exception {
    40.         http.csrf().disable()//禁用了 csrf 功能
    41.                 .authorizeRequests()//限定签名成功的请求
    42.                 .antMatchers("/decision/**","/govern/**","/employee/*").hasAnyRole("EMPLOYEE","ADMIN")//对decision和govern 下的接口 需要 EMPLOYEE 或者 ADMIN 权限
    43.                 .antMatchers("/employee/login").permitAll()///employee/login 不限定
    44.                 .antMatchers("/admin/**").hasRole("ADMIN")//对admin下的接口 需要ADMIN权限
    45.                 .antMatchers("/oauth/**").permitAll()//不拦截 oauth 开放的资源
    46.                 .anyRequest().permitAll()//其他没有限定的请求，允许访问
    47.                 .and().anonymous()//对于没有配置权限的其他请求允许匿名访问
    48.                 .and().formLogin()//使用 spring security 默认登录页面
    49.                 .and().httpBasic();//启用http 基础验证
    50.  
    51.     }
    52. 	
    53. }

    11.CorsConfig文件代码如下：

    1. package com.hmblogs.config;
    2.  
    3. import org.springframework.context.annotation.Configuration;
    4. import org.springframework.web.servlet.config.annotation.CorsRegistry;
    5. import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;
    6.  
    7. @Configuration
    8. public class CorsConfig implements WebMvcConfigurer{
    9.  
    10. 	@Override
    11. 	public void addCorsMappings(CorsRegistry registry) {
    12. 		registry.addMapping("/**")    // 允许跨域访问的路径
    13.         .allowedOrigins("*")    // 允许跨域访问的源
    14.         .allowedMethods("POST", "GET", "PUT", "OPTIONS", "DELETE")    // 允许请求方法
    15.         .maxAge(168000)    // 预检间隔时间
    16.         .allowedHeaders("*")  // 允许头部设置
    17.         .allowCredentials(true);    // 是否发送cookie
    18. 	}
    19. 	
    20. }

    12、启动该微服务，验证。

    12.1访问http://localhost:8088/springboot-security-demo/swagger-ui.html

    这里我如果用户名输入admin，密码输入123456，点击登录

    清除浏览器缓存后，再使用employee和123456登录，则会报401

    admin账号能使用admin接口，但是employee账号不能使用admin接口。

     12.2使用admin账号密码和empoyee账号密码尝试employee接口，

    先试用admin账号密码登录

    清除浏览器缓存，再使用employee账号密码登录

    点击登录后，查看响应，如下：

    admin和employee账号都能正常访问employee接口

    达到了预期目的。 

    代码参考：https://github.com/veminhe/spring-security-demo

  • 相关阅读:
    计算机视觉基础【OpenCV轻松入门】：获取图像的ROI
    渗透测试概念详解
    疫情下更合适的开发模式
    React源码分析1-jsx转换及React.createElement
    如何做好银行统一报送系统UI设计
    AIGC启示录：深度解析AIGC技术的现代性与系统性的奇幻旅程
    mysql进程信息出现大量Waiting for table level lock信息的原因，怎么处理？
    MIMO-OFDM无线通信技术-IEEE802.16d模型(Matlab代码)
    拿到第一个用户并提权
    Java easy_trans字典绑定，Java字典注解绑定
  • 原文地址：https://blog.csdn.net/heming20122012/article/details/136344803