Spring Security权限注解

启用注解

@EnableGlobalMethodSecurity(prePostEnabled = true)


正常启用开启那个注解就行，下面放下我的配置
package com.fedtech.sys.provider.config.config;

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.data.redis.connection.RedisConnectionFactory;
import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
import org.springframework.security.oauth2.config.annotation.web.configuration.EnableResourceServer;
import org.springframework.security.oauth2.config.annotation.web.configuration.ResourceServerConfigurerAdapter;
import org.springframework.security.oauth2.config.annotation.web.configurers.ResourceServerSecurityConfigurer;
import org.springframework.security.oauth2.provider.token.TokenStore;
import org.springframework.security.oauth2.provider.token.store.redis.RedisTokenStore;

import javax.annotation.Resource;


@Configuration
@EnableResourceServer
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class ResourceServerConfig extends ResourceServerConfigurerAdapter {

    @Resource
    RedisConnectionFactory redisConnectionFactory;
    @Resource
    private TokenStore tokenStore;

    @Bean
    public TokenStore redisTokenStore() {
 return new RedisTokenStore(redisConnectionFactory);
    }

    @Override
    public void configure(ResourceServerSecurityConfigurer resources) {
 resources.tokenStore(tokenStore);
    }
}

角色
    
    @GetMapping("select")
    @PreAuthorize("hasAuthority('admin')")
    public R selectUser(UserQuery query) {
 UserDto dto = userService.selectUser(query);
 return R.successWithData(userMapper.dto2View(dto));
    }

权限
默认的是DenyAllPermissionevaluator，所有权限都拒绝，所以要自定义
自定义处理逻辑
我是把权限放到了自定义的userDetails里面
package com.fedtech.common.model;

import cn.hutool.core.collection.CollUtil;
import lombok.Data;
import lombok.extern.slf4j.Slf4j;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.authority.SimpleGrantedAuthority;
import org.springframework.security.core.userdetails.UserDetails;

import java.util.ArrayList;
import java.util.Collection;
import java.util.List;
import java.util.StringTokenizer;


@Data
@Slf4j
public class SecurityUser implements UserDetails {
    private static final long serialVersionUID = 8689435103879098852L;
    
    private String salt;

    
    private String token;

    
    private String status;

    
    private String password;

    
    private String loginName;

    private Long userId;

    
    private List roleList;
    
    private List permissionList;


    
    public SecurityUser(OauthClientDetails client) {
 if (client != null) {
     password = client.getClientSecret();
     loginName = client.getClientId();
     String authorities = client.getAuthorities();
     StringTokenizer stringTokenizer = new StringTokenizer(authorities, ", ");
     roleList = new ArrayList<>();
     if (stringTokenizer.hasMoreTokens()) {
  UserRole userRole = new UserRole();
  userRole.setCode(stringTokenizer.nextToken());
  roleList.add(userRole);
     }
 }
    }

    
    public SecurityUser(User user, List roleList, List permissionList) {
 if (user != null) {
     salt = user.getSalt();
     token = user.getToken();
     status = user.getStatus();
     password = user.getPassword();
     loginName = user.getLoginName();
     userId = user.getId();
     this.roleList = roleList;
     this.permissionList = permissionList;
 }
    }

    @Override
    public Collection<? extends GrantedAuthority> getAuthorities() {
 Collection authorities = new ArrayList<>();
 if (!CollUtil.isEmpty(roleList)) {
     for (UserRole role : roleList) {
  SimpleGrantedAuthority authority = new SimpleGrantedAuthority(role.getCode());
  authorities.add(authority);
     }
 }
 log.debug("获取到的用户权限：{}", authorities);
 return authorities;
    }

    @Override
    public String getPassword() {
 return password;
    }

    @Override
    public String getUsername() {
 return loginName;
    }

    @Override
    public boolean isAccountNonExpired() {
 return true;
    }

    @Override
    public boolean isAccountNonLocked() {
 return true;
    }

    @Override
    public boolean isCredentialsNonExpired() {
 return true;
    }

    @Override
    public boolean isEnabled() {
 return true;
    }
}

package com.fedtech.common.config;

import cn.hutool.core.collection.CollUtil;
import com.fedtech.common.model.SecurityUser;
import com.fedtech.common.model.UserPermission;
import lombok.extern.slf4j.Slf4j;
import org.apache.commons.lang3.StringUtils;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.access.Permissionevaluator;
import org.springframework.security.core.Authentication;

import java.io.Serializable;
import java.util.List;



@Slf4j
@Configuration
public class MyPermissionevaluator implements Permissionevaluator {
    @Override
    public boolean hasPermission(Authentication authentication, Object targetDomainObject, Object permission) {
 SecurityUser principal = (SecurityUser) authentication.getPrincipal();
 List permissionList = principal.getPermissionList();
 if (CollUtil.isNotEmpty(permissionList)) {
     return permissionList.stream().anyMatch(x -> StringUtils.equals(x.getUrl(), (CharSequence) targetDomainObject) &&
      StringUtils.equals(x.getCode(), (CharSequence) permission));
 }
 return false;
    }

    @Override
    public boolean hasPermission(Authentication authentication, Serializable targetId, String targetType, Object permission) {
 return false;
    }
}


使用
    
    @GetMapping("select")
    @PreAuthorize("hasPermission('/sys/user/insert','userInsert')")
    public R selectUser(UserQuery query) {
 UserDto dto = userService.selectUser(query);
 return R.successWithData(userMapper.dto2View(dto));
    }

Spring Security权限注解

Java相关栏目本月热门文章