package cn.coreqi.ssoserver.rbac;

 import org.springframework.security.core.Authentication;

 import javax.servlet.http.HttpServletRequest;

 public interface RbacService {

     /**

      *

      * @param request   当前请求的信息

      * @param authentication    当前用户的信息

      * @return  是否拥有访问权限

      */

     boolean hasPermission(HttpServletRequest request, Authentication authentication);

 }

 package cn.coreqi.ssoserver.rbac.impl;

 import cn.coreqi.ssoserver.rbac.RbacService;

 import org.springframework.beans.factory.annotation.Autowired;

 import org.springframework.security.core.Authentication;

 import org.springframework.security.core.userdetails.UserDetails;

 import org.springframework.stereotype.Component;

 import org.springframework.util.AntPathMatcher;

 import javax.servlet.http.HttpServletRequest;

 import java.util.HashSet;

 import java.util.Set;

 @Component("rbacService")

 public class RbacServiceImpl implements RbacService {

     private AntPathMatcher antPathMatcher = new AntPathMatcher();

     /**

      *

      * @param request   当前请求的信息

      * @param authentication    当前用户的信息

      * @return  是否拥有访问权限

      */

     @Override

     public boolean hasPermission(HttpServletRequest request, Authentication authentication) {

         Object principal = authentication.getPrincipal();

         boolean hasPermission = false;

         if(principal instanceof UserDetails){

             String username = ((UserDetails)principal).getUsername();

             //在数据库中读取用户所拥有权限的所有URL

             //在这里使用Set模拟

             Set<String> urls = new HashSet<>();

             for (String url : urls){

                 if(antPathMatcher.match(url,request.getRequestURI())){

                     hasPermission = true;

                     break;

                 }

             }

         }

         return hasPermission;

     }

 }

 @EnableWebSecurity

 public class SsoWebSecurityConfig extends WebSecurityConfigurerAdapter {

     @Override

     protected void configure(HttpSecurity http) throws Exception {

         http.formLogin()

                 .and()

                 .authorizeRequests()

                     .anyRequest().access("@rbacService.hasPermission(request, authentication)") //为了避免该配置被覆盖，必要时需要使用@Order注解设置优先级。

                 .and()

                     .csrf().disable();    //禁用CSRF

     }

 }