springSecurity入门(ssm + spring-security)

1. 什么是spring-security？
2. 我们能用spring-security做什么？
3. spring-security 入门案例
4. spring-security需要注意的点

1、什么是spring-security？
spring-security解决系统安全问题的框架,sprign-security 是spring家族里面的一员，完美结合spring，充分利用了spring ico和aop等功能
想了解为什么我们要用springSecurity可以看一下这个文章
为什么越来越多程序员使用SpringSecurity，这些原因你都知道吗？

2、我们能用spring-security做什么？
我们可以利用spring-security进行权限控制，比如我想让这个输入框或者按钮只让管理员才可以看到，spring-security可以做到这些spring-security 按钮级权限控制

3、spring-security 入门案例
我个人觉得先把ssm的搞懂了在去弄springboot会好一点
案例我分两个讲吧，一个是不依赖数据库写死的用户权限让小白更好的理解，第二个是依赖数据库做用户权限
不依赖数据库
spring-security 的依赖坐标

 
      org.springframework.security
      spring-security-web
      4.1.0.RELEASE
    

    
      org.springframework.security
      spring-security-config
      4.1.0.RELEASE
    

springSecurity.xml文件的编写

    
    
    
        
    @Override
    public void onAuthenticationSuccess(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, Authentication authentication) throws IOException, ServletException {
        System.out.println(httpServletResponse.getWriter().toString());
    }
}

FailureHandler.class

import org.springframework.security.core.AuthenticationException;
import org.springframework.security.web.authentication.AuthenticationFailureHandler;

import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;


public class FailureHandler implements AuthenticationFailureHandler {
    @Override
    public void onAuthenticationFailure(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, AuthenticationException e) throws IOException, ServletException {
        System.out.println(e.toString());
    }
}

4、spring-security需要注意的点
在编写配置文件时需要注意的点：
1、放行你需要的资源，如果不配置则登录页面会说重定向过多，那是因为你的页面被spring-security 拦截了，由于是拦截所以不会报错404，由于被拦截浏览器会重试，然后就是死循环

因为我们在拦截资源那里配置了拦截资源范围，写的是" public interface UserService extends UserDetailsService { }

而UserServiceImp 实现UserService

import com.ownCloud.main.dao.UserDao;
import com.ownCloud.main.dao.entity.UserEntity;
import com.ownCloud.main.service.UserService;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.core.authority.SimpleGrantedAuthority;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UsernameNotFoundException;
import org.springframework.stereotype.Service;

import java.util.ArrayList;
import java.util.List;
import java.util.Objects;


@Service(value = "UserServiceImp")
public class UserServiceImp implements UserService {
    @Autowired
    UserDao userDao;// 用户查询实现
    @Override
    public UserDetails loadUserByUsername(String s) throws UsernameNotFoundException {
        UserEntity userEntity =null;
        try {
             userEntity = userDao.queryUserByUsername(s);
        }catch (Exception e){
            e.printStackTrace();
        }
        if (!Objects.isNull(userEntity)) {
            return new User(userEntity.getUsername(), userEntity.getPassword(), getAuthority());
        }else {
            return null;
        }
    }

    //作用就是返回一个List集合，集合中装入的是角色描述
    public List getAuthority(){
        List list=new ArrayList<>();
        list.add(new SimpleGrantedAuthority("ROLE_USER"));
        return  list;
    }

}

UserEntity 需要实现 UserDetails类

import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.userdetails.UserDetails;

import java.util.Collection;


public class UserEntity implements UserDetails {
    String username;
    char gender;
    String passWord;
    Integer age;
    String phoneNumber;

    @Override
    public Collection getAuthorities() {
        return null;
    }

    @Override
    public String getPassword() {
        return passWord;
    }

    public String getUsername() {
        return username;
    }

    @Override
    public boolean isAccountNonExpired() {
        return false;
    }

    @Override
    public boolean isAccountNonLocked() {
        return false;
    }

    @Override
    public boolean isCredentialsNonExpired() {
        return false;
    }

    @Override
    public boolean isEnabled() {
        return false;
    }

    public void setUsername(String username) {
        this.username = username;
    }

    public char getGender() {
        return gender;
    }

    public void setGender(char gender) {
        this.gender = gender;
    }

    public String getPassWord() {
        return passWord;
    }

    public void setPassWord(String passWord) {
        this.passWord = passWord;
    }

    public Integer getAge() {
        return age;
    }

    public void setAge(Integer age) {
        this.age = age;
    }

    public String getPhoneNumber() {
        return phoneNumber;
    }

    public void setPhoneNumber(String phoneNumber) {
        this.phoneNumber = phoneNumber;
    }
}

这样依赖数据库的所有配置就都完成了，还有不懂的可以私信我