详解Springboot2.3集成Spring security 框架(原生集成)

0、pom

	4.0.0
	
		org.springframework.boot
		spring-boot-starter-parent
		2.3.0.RELEASE
		 
	
	com.jack
	demo
	0.0.1-SNAPSHOT
	war
	demo
	Demo project for Spring Security

	
		1.8
	

	
		
			org.springframework.boot
			spring-boot-starter-security
		
		
			org.springframework.boot
			spring-boot-starter-web
		

		
			org.springframework.boot
			spring-boot-starter-tomcat
			provided
		
		
			org.springframework.boot
			spring-boot-starter-test
			test
			
				
					org.junit.vintage
					junit-vintage-engine
				
			
		
		
			org.springframework.security
			spring-security-test
			test
		
	

	
		
			
				org.springframework.boot
				spring-boot-maven-plugin
			
		
	

1、SpringSecurityConfig（security配置）

// 手动定义用户认证 和 // 关联用户Service认证 二者取一

这里测试用的是 手动定义用户认证！！！

package com.jack.demo;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.builders.WebSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;



@Configuration
@EnableWebSecurity
public class SpringSecurityConfig extends WebSecurityConfigurerAdapter {

  @Autowired
  private MyUserService myUserService;

  @Override
  protected void configure(AuthenticationManagerBuilder auth) throws Exception {
    // 手动定义用户认证
    auth.inMemoryAuthentication().passwordEncoder(new BCryptPasswordEncoder()).withUser("admin").password(new BCryptPasswordEncoder().encode("123456")).roles("ADMIN");
    auth.inMemoryAuthentication().passwordEncoder(new BCryptPasswordEncoder()).withUser("jack").password(new BCryptPasswordEncoder().encode("fang")).roles("USER");

    // 关联用户Service认证
    //auth.userDetailsService(myUserService).passwordEncoder(new MyPasswordEncoder());

    // 默认jdbc认证
    // auth.jdbcAuthentication().usersByUsernameQuery("").authoritiesByUsernameQuery("").passwordEncoder(new MyPasswordEncoder());
  }

  @Override
  protected void configure(HttpSecurity http) throws Exception {
    http.authorizeRequests()
 .antMatchers("/").permitAll()
 .anyRequest().authenticated()
 .and()
 .logout().permitAll()
 .and()
 .formLogin();
    http.csrf().disable();
  }

  @Override
  public void configure(WebSecurity web) throws Exception {
    web.ignoring().antMatchers("/js
public class MyPasswordEncoder implements PasswordEncoder {

  @Override
  public String encode(CharSequence charSequence) {
    return new BCryptPasswordEncoder().encode(charSequence.toString());
  }

  @Override
  public boolean matches(CharSequence charSequence, String s) {
    return new BCryptPasswordEncoder().matches(charSequence,s);
  }
}

3、MyUserService（自行实现的用户登录接口）

具体内容 省略。这里测试用的是SpringSecurityConfig手动添加用户名与密码。

package com.jack.demo;

import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.core.userdetails.UsernameNotFoundException;
import org.springframework.stereotype.Component;


@Component
public class MyUserService implements UserDetailsService {

  @Override
  public UserDetails loadUserByUsername(String s) throws UsernameNotFoundException {
    return null;
  }
}

4、启动类（测试）

DemoApplication.java

package com.jack.demo;

import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.security.access.prepost.PostAuthorize;
import org.springframework.security.access.prepost.PostFilter;
import org.springframework.security.access.prepost.PreAuthorize;
import org.springframework.security.access.prepost.PreFilter;
import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
import org.springframework.security.core.userdetails.User;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RestController;

import java.util.List;

@EnableGlobalMethodSecurity(prePostEnabled = true)
@RestController
@SpringBootApplication
public class DemoApplication {

	public static void main(String[] args) {
		SpringApplication.run(DemoApplication.class, args);
	}

	@RequestMapping("/")
	public String index(){
		return "hello Spring Security!";
	}

	@RequestMapping("/hello")
	public String hello(){
		return "hello !";
	}

	@PreAuthorize("hasRole('ROLE_ADMIN')")
	@RequestMapping("/roleAdmin")
	public String role() {
		return "admin auth";
	}


	@PreAuthorize("#id<10 and principal.username.equals(#username) and #user.username.equals('abc')")
	@PostAuthorize("returnObject%2==0")
	@RequestMapping("/test")
	public Integer test(Integer id, String username, User user) {
		// ...
		return id;
	}

	@PreFilter("filterObject%2==0")
	@PostFilter("filterObject%4==0")
	@RequestMapping("/test2")
	public List test2(List idList) {
		// ...
		return idList;
	}
}

测试hello接口（http://localhost:8080/hello）

未登录跳转登录页

登录SpringSecurityConfig配置的admin账号与密码123456
成功调用hello

测试roleAdmin（登录admin 123456成功，登录jack fang访问则失败）

登出 logout

到此这篇关于详解Springboot2.3集成Spring security 框架(原生集成)的文章就介绍到这了,更多相关Springboot2.3集成Spring security 内容请搜索考高分网以前的文章或继续浏览下面的相关文章希望大家以后多多支持考高分网！