1 github: 源码地址 2 security03 子工程开启基于方法的安全认证机制
自定义实现细粒度的权限控制
4.0.0 com.yzm security 0.0.1-SNAPSHOT ../pom.xml security03 0.0.1-SNAPSHOT jar security03 Demo project for Spring Boot com.yzm common 0.0.1-SNAPSHOT org.springframework.boot spring-boot-maven-plugin
项目结构
application.yml
spring:
datasource:
driver-class-name: com.mysql.cj.jdbc.Driver
url: jdbc:mysql://127.0.0.1:3306/test04?useUnicode=true&characterEncoding=utf8&useSSL=false&allowMultiQueries=true&zeroDateTimeBehavior=convertToNull&serverTimezone=Asia/Shanghai
username: root
password: root
# 启动时提示需要这个，加上就好了
main:
allow-bean-definition-overriding: true
mybatis-plus:
mapper-locations: classpath:/mapper
@Service
public class SecUserDetailsServiceImpl implements UserDetailsService {
private final UserService userService;
private final RoleService roleService;
public SecUserDetailsServiceImpl(UserService userService, RoleService roleService) {
this.userService = userService;
this.roleService = roleService;
}
@Override
public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
User user = userService.lambdaQuery().eq(User::getUsername, username).one();
if (user == null) {
throw new UsernameNotFoundException(String.format("用户'%s'不存在", username));
}
List roleIds = Arrays.stream(user.getRIds().split(","))
.map(Integer::parseInt)
.collect(Collectors.toList());
List roleList = roleService.listByIds(roleIds);
List authorities = roleList.stream()
.map(Role::getRName)
.distinct()
.map(SimpleGrantedAuthority::new)
.collect(Collectors.toList());
return new SecUserDetails(username, user.getPassword(), authorities, roleIds);
}
}
由于我需要一些自定义的属性信息，默认org.springframework.security.core.userdetails.User满足不了需求，所以自定义了SecUserDetails 继承User，为后面使用细粒度权限作准备
package com.yzm.security03.config;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.userdetails.User;
import java.util.Collection;
import java.util.List;
import java.util.Set;
public class SecUserDetails extends User {
private static final long serialVersionUID = 3033317408164827323L;
// 自定义属性
private List roleIds;
private Set permissions;
public SecUserDetails(String username, String password, Collection authorities) {
this(username, password, true, true, true, true, authorities);
}
public SecUserDetails(String username, String password, Collection authorities, List roleIds) {
this(username, password, true, true, true, true, authorities);
this.roleIds = roleIds;
}
public SecUserDetails(String username, String password, Collection authorities, Set permissions) {
this(username, password, true, true, true, true, authorities);
this.permissions = permissions;
}
public SecUserDetails(
String username,
String password,
boolean enabled,
boolean accountNonExpired,
boolean credentialsNonExpired,
boolean accountNonLocked,
Collection authorities) {
super(username, password, enabled, accountNonExpired, credentialsNonExpired, accountNonLocked, authorities);
}
public List getRoleIds() {
return roleIds;
}
public void setRoleIds(List roleIds) {
this.roleIds = roleIds;
}
public Set getPermissions() {
return permissions;
}
public void setPermissions(Set permissions) {
this.permissions = permissions;
}
}
4 SecurityConfig
开启注解 @EnableGlobalMethodSecurity(prePostEnabled = true)
package com.yzm.security03.config;
import lombok.extern.slf4j.Slf4j;
import org.springframework.beans.factory.annotation.Qualifier;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.web.access.expression.DefaultWebSecurityexpressionHandler;
@Slf4j
@Configuration
@EnableWebSecurity // 开启Security服务
@EnableGlobalMethodSecurity(prePostEnabled = true) // 开启全局注解
public class SecurityConfig extends WebSecurityConfigurerAdapter {
private final UserDetailsService userDetailsService;
private final SecPermissionevaluator permissionevaluator;
public SecurityConfig(@Qualifier("secUserDetailsServiceImpl") UserDetailsService userDetailsService, SecPermissionevaluator permissionevaluator) {
this.userDetailsService = userDetailsService;
this.permissionevaluator = permissionevaluator;
}
@Bean
public PasswordEncoder passwordEncoder() {
return new BCryptPasswordEncoder();
}
@Bean
public DefaultWebSecurityexpressionHandler webSecurityexpressionHandler() {
DefaultWebSecurityexpressionHandler handler = new DefaultWebSecurityexpressionHandler();
handler.setPermissionevaluator(permissionevaluator);
return handler;
}
@Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
// 从数据库读取用户、并使用密码编码器解密
auth.userDetailsService(userDetailsService).passwordEncoder(passwordEncoder());
}
//配置资源权限规则
@Override
protected void configure(HttpSecurity http) throws Exception {
http
// 关闭CSRF跨域
.csrf().disable()
// 登录
.formLogin()
.loginPage("/auth/login") //指定登录页的路径，默认/login
.loginProcessingUrl("/login") //指定自定义form表单请求的路径(必须跟login.html中的form action=“url”一致)
.defaultSuccessUrl("/home", true) // 登录成功后的跳转url地址
.failureUrl("/auth/login?error") // 登录失败后的跳转url地址
.permitAll()
.and()
.exceptionHandling()
.accessDeniedPage("/401") // 拒接访问跳转页面
.and()
// 退出登录
.logout().permitAll()
.and()
// 访问路径URL的授权策略，如注册、登录免登录认证等
.authorizeRequests()
.antMatchers("/", "/home", "/register", "/auth/login").permitAll() //指定url放行
.anyRequest().authenticated() //其他任何请求都需要身份认证
.and()
;
}
}
5 使用注解
@PreAuthorize(“hasAuthority(‘ROLE_ADMIN’)”)
@PreAuthorize(“hasAnyRole(‘ADMIN’,‘USER’)”)
package com.yzm.security03.controller;
import org.springframework.security.access.prepost.PreAuthorize;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RestController;
@RestController
@RequestMapping("/admin")
@PreAuthorize("hasAuthority('ROLE_ADMIN')")
public class AdminController {
@GetMapping("/select")
public Object select() {
return "Select";
}
@GetMapping("/create")
public Object create() {
return "Create";
}
@GetMapping("/update")
public Object update() {
return "Update";
}
@GetMapping("/delete")
public Object delete() {
return "Delete";
}
}
package com.yzm.security03.controller;
import org.springframework.security.access.prepost.PreAuthorize;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RestController;
@RestController
@RequestMapping("/user")
@PreAuthorize("hasAnyRole('ADMIN','USER')")
public class UserController {
@GetMapping("/select")
public Object select() {
return "Select";
}
@GetMapping("/create")
public Object create() {
return "Create";
}
@GetMapping("/update")
public Object update() {
return "Update";
}
@GetMapping("/delete")
public Object delete() {
return "Delete";
}
}
测试
启动项目，登录yzm
而admin可以访问所有接口
目前演示都是基于角色进行授权的，如果要角色role跟权限permission一起使用，就需要我们自定义了
自定义SecPermissionevaluator 实现 Permissionevaluator 重写 hasPermission()
package com.yzm.security03.config;
import com.yzm.security03.entity.Permissions;
import com.yzm.security03.entity.Role;
import com.yzm.security03.service.PermissionsService;
import com.yzm.security03.service.RoleService;
import org.springframework.security.access.Permissionevaluator;
import org.springframework.security.core.Authentication;
import org.springframework.stereotype.Component;
import java.io.Serializable;
import java.util.Arrays;
import java.util.HashSet;
import java.util.List;
import java.util.Set;
import java.util.stream.Collectors;
@Slf4j
@Component
public class SecPermissionevaluator implements Permissionevaluator {
private final RoleService roleService;
private final PermissionsService permissionsService;
public SecPermissionevaluator(RoleService roleService, PermissionsService permissionsService) {
this.roleService = roleService;
this.permissionsService = permissionsService;
}
@Override
public boolean hasPermission(Authentication authentication, Object targetUrl, Object targetPermission) {
log.info("hasPermission 方法执行");
// 获得loadUserByUsername()方法的结果
SecUserDetails userDetails = (SecUserDetails) authentication.getPrincipal();
// 获得loadUserByUsername()中注入的角色
//Collection authorities = userDetails.getAuthorities();
// 拿到SecUserDetails 自定义的roleIds值
List roleIds = userDetails.getRoleIds();
// 查询角色对应的权限id信息
List roles = roleService.listByIds(roleIds);
Set permIds = new HashSet<>();
roles.forEach(role -> {
Set collect = Arrays.stream(role.getPIds().split(","))
.map(Integer::parseInt).collect(Collectors.toSet());
permIds.addAll(collect);
});
List perms = permissionsService.listByIds(permIds);
String permission = (String) targetUrl + ":" + (String) targetPermission;
for (Permissions perm : perms) {
// 如果访问的Url和权限用户符合的话，返回true
if (permission.equals(perm.getPName())) {
return true;
}
}
return false;
}
@Override
public boolean hasPermission(Authentication authentication, Serializable targetId, String targetType, Object permission) {
return false;
}
}
6.1 SecurityConfig中把自定义SecPermissionevaluator交给Security管理
@Bean
public DefaultWebSecurityexpressionHandler webSecurityexpressionHandler() {
DefaultWebSecurityexpressionHandler handler = new DefaultWebSecurityexpressionHandler();
handler.setPermissionevaluator(permissionevaluator);
return handler;
}
6.2 使用hasPermission
package com.yzm.security03.controller;
import org.springframework.security.access.prepost.PreAuthorize;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RestController;
@RestController
@RequestMapping("/admin")
@PreAuthorize("hasAuthority('ROLE_ADMIN')")
public class AdminController {
@GetMapping("/select")
@PreAuthorize("hasPermission('admin','select')")
public Object select() {
return "Select";
}
@GetMapping("/create")
public Object create() {
return "Create";
}
@GetMapping("/update")
public Object update() {
return "Update";
}
@GetMapping("/delete")
@PreAuthorize("hasPermission('admin','delete')")
public Object delete() {
return "Delete";
}
}
package com.yzm.security03.controller;
import org.springframework.security.access.prepost.PreAuthorize;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RestController;
@RestController
@RequestMapping("/user")
@PreAuthorize("hasAnyRole('ADMIN','USER')")
public class UserController {
@GetMapping("/select")
@PreAuthorize("hasPermission('user','select')")
public Object select() {
return "Select";
}
@GetMapping("/create")
public Object create() {
return "Create";
}
@GetMapping("/update")
public Object update() {
return "Update";
}
@GetMapping("/delete")
@PreAuthorize("hasPermission('user','delete')")
public Object delete() {
return "Delete";
}
}
测试
登录yzm，/user/select、/user/delete时会打印日志，并且由于/user/delete没有权限，拒绝访问
登录admin，则可以访问所有的接口
