springboot-30-security(三)使用注解实现权限控制

2023-08-26 16:14:34

上个博客: http://www.cnblogs.com/wenbronk/p/7381252.html中, 实现了经典5表对用户进行权限的控制, 但太过于繁琐了, 官方推荐的方式是将用户和角色存储数据库, 权限直接在要访问的接口上进行控制

(我感觉更麻烦...每个接口都需要指定)

本篇基于第一个, security: http://www.cnblogs.com/wenbronk/p/7379865.html

一, 数据库: (更多可见 security(1) )

1, 数据表:

SET FOREIGN_KEY_CHECKS=;

-- ----------------------------

-- Table structure for `sys_user`

-- ----------------------------

DROP TABLE IF EXISTS `sys_user`;

CREATE TABLE `sys_user` (

  `id` INT () NOT NULL AUTO_INCREMENT COMMENT '主键id',

  `username` varchar() DEFAULT NULL COMMENT '用户名',

  `password` varchar() DEFAULT NULL COMMENT '密码',

  PRIMARY KEY (`id`)

) ENGINE=InnoDB AUTO_INCREMENT= DEFAULT CHARSET=utf8;

-- ----------------------------

-- Table structure for `sys_role`

-- ----------------------------

DROP TABLE IF EXISTS `sys_role`;

CREATE TABLE `sys_role` (

  `id` INT () NOT NULL AUTO_INCREMENT COMMENT '主键id',

  `name` varchar() DEFAULT NULL COMMENT '用户名',

  PRIMARY KEY (`id`)

) ENGINE=InnoDB AUTO_INCREMENT= DEFAULT CHARSET=utf8;

-- ----------------------------

-- Table structure for `sys_role_user`

-- ----------------------------

DROP TABLE IF EXISTS `sys_role_user`;

CREATE TABLE `sys_role_user` (

  `id` int() NOT NULL AUTO_INCREMENT COMMENT '主键id',

  `sys_user_id` INT() NOT NULL COMMENT 'user_id',

  `sys_role_id` INT() NOT NULL COMMENT 'role_id',

  PRIMARY KEY (`id`)

) ENGINE=InnoDB AUTO_INCREMENT= DEFAULT CHARSET=utf8;

ALTER TABLE sys_role_user ADD CONSTRAINT sys_FK1 FOREIGN KEY(sys_user_id) REFERENCES sys_user(id);

ALTER TABLE sys_role_user ADD CONSTRAINT role_FK2 FOREIGN KEY(sys_role_id) REFERENCES sys_role(id);

2, 插入数据

insert into SYS_USER (id,username, password) values (,'vini', '$2a$10$n7sdY5rR1X3XOfZR6o2R.OdW0vvz3uidz0UEzVKV0CEyu0hGwIch.');

insert into SYS_USER (id,username, password) values (,'bronk', '$2a$10$n7sdY5rR1X3XOfZR6o2R.OdW0vvz3uidz0UEzVKV0CEyu0hGwIch.');

insert into SYS_ROLE(id,name) values(,'ROLE_ADMIN');

insert into SYS_ROLE(id,name) values(,'ROLE_USER');

insert into SYS_ROLE_USER(SYS_USER_ID,sys_role_id) values(,);

insert into SYS_ROLE_USER(SYS_USER_ID,sys_role_id) values(,);

这儿使用了 Bcrpy强hash加密, 我设置的密码为 123,

3, 映射实体

SysUser.groovy

package com.wenbronk.security.entity

import com.fasterxml.jackson.annotation.JsonIgnore

import org.springframework.security.core.GrantedAuthority

import org.springframework.security.core.userdetails.UserDetails

/**

 * Created by wenbronk on 2017/8/14.

 */

class SysUser implements UserDetails {

    int id

    String username

    @JsonIgnore

    String password

    String rawPass

    @JsonIgnore

    List<SysRole> roles

    List<? extends GrantedAuthority> authorities

    @Override

    @JsonIgnore

    Collection<? extends GrantedAuthority> getAuthorities() {

        return authorities

    }

    @Override

    @JsonIgnore

    boolean isAccountNonExpired() {

        return true

    }

    @Override

    @JsonIgnore

    boolean isAccountNonLocked() {

        return true

    }

    @Override

    @JsonIgnore

    boolean isCredentialsNonExpired() {

        return true

    }

    @Override

    @JsonIgnore

    boolean isEnabled() {

        return true

    }

    @Override

    public String toString() {

        return "SysUser{" +

                "id=" + id +

                ", username='" + username + '\'' +

                ", password='" + password + '\'' +

                ", rawPass='" + rawPass + '\'' +

                ", roles=" + roles +

                ", authorities=" + authorities +

                '}';

    }

}

SysRole.groovy

package com.wenbronk.security.entity

/**

 * Created by wenbronk on 2017/8/14.

 */

class SysRole {

    int id

    String name

    @Override

    public String toString() {

        return "SysRole{" +

                "id=" + id +

                ", name=" + name +

                '}';

    }

}

4, mapper

SysUserMapper.groovy

package com.wenbronk.security.mapper

import com.wenbronk.security.entity.SysUser

/**

 * Created by wenbronk on 2017/8/14.

 */

interface SysUserMapper {

    SysUser findByUserName(String username)

}

SysUserMapper.xml

<?xml version="1.0" encoding="UTF-8" ?>

        <!DOCTYPE mapper PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN" "http://mybatis.org/dtd/mybatis-3-mapper.dtd" >

<mapper namespace="com.wenbronk.security.mapper.SysUserMapper">

<resultMap id="sys_user_map" type="SysUser">

    <id property="id" column="id" />

    <result property="username" column="username" />

    <result property="password" column="password" />

    <collection property="roles" ofType="SysRole">

        <result column="name" property="name" />

    </collection>

</resultMap>

<select id="findByUserName" parameterType="string" resultMap="sys_user_map">

    select u.id, u.username, u.password, r.name

    from sys_user u

    LEFT JOIN sys_role_user s on u.id = s.sys_user_id

    LEFT JOIN sys_role r on r.id = s.sys_role_id

    WHERE username = #{username}

</select>

</mapper>

二, security

1, WebSecurityConfig.groovy

package com.wenbronk.security.security.config

import com.wenbronk.security.security.interceptor.MyFilterSecurityInterceptor

import com.wenbronk.security.security.service.CustomUserService

import org.springframework.beans.factory.annotation.Autowired

import org.springframework.context.annotation.Configuration

import org.springframework.http.HttpMethod

import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder

import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity

import org.springframework.security.config.annotation.web.builders.HttpSecurity

import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity

import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter

import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder

import javax.inject.Inject

/**

 * Created by wenbronk on 2017/8/15.

 */

@Configuration

@EnableWebSecurity

@EnableGlobalMethodSecurity(securedEnabled = true) // 控制权限注解

class WebSecurityConfig extends WebSecurityConfigurerAdapter {

    @Inject

    CustomUserService customUserService;

    @Autowired

    MyFilterSecurityInterceptor myFilterSecurityInterceptor

    /**

     * 设置加密方式为 BCrypt强hash

     */

    @Override

    protected void configure(AuthenticationManagerBuilder auth) throws Exception {

        auth.userDetailsService(customUserService).passwordEncoder(new BCryptPasswordEncoder());

    }

    @Override

    protected void configure(HttpSecurity http) throws Exception {

        // 关闭 csrf()

        http.csrf().disable()

                .authorizeRequests()

                .antMatchers("/users**").authenticated()

                .antMatchers(HttpMethod.POST).authenticated()

                .antMatchers(HttpMethod.PUT).authenticated()

                .antMatchers(HttpMethod.DELETE).authenticated()

                .antMatchers("/**")

                .permitAll()

                .and()

                .sessionManagement()

                // 使用basic认证登陆

                .and().httpBasic()

    }

}

这儿需要关闭 csrf 和使用 basic 认证, 相信可见:

http://blog.csdn.net/u012373815/article/details/55047285

http://blog.csdn.net/u012373815/article/details/56832167

CustomerUserService.groovy

package com.wenbronk.security.security.service

import com.wenbronk.security.entity.SysUser

import com.wenbronk.security.mapper.SysUserMapper

import org.springframework.security.core.GrantedAuthority

import org.springframework.security.core.authority.SimpleGrantedAuthority

import org.springframework.security.core.userdetails.UserDetails

import org.springframework.security.core.userdetails.UserDetailsService

import org.springframework.security.core.userdetails.UsernameNotFoundException

import org.springframework.stereotype.Service

import javax.inject.Inject

/**

 * Created by wenbronk on 2017/8/15.

 */

@Service

class CustomUserService implements UserDetailsService {

    @Inject

    SysUserMapper sysUserMapper

//    @Inject

//    SysPermissionMapper sysPermissionMapper

    @Override

    UserDetails loadUserByUsername(String s) throws UsernameNotFoundException {

        def sysUser = sysUserMapper.findByUserName(s) as SysUser

        assert sysUser != null

        List<GrantedAuthority> authorities = new ArrayList<>()

        sysUser.getRoles().each { role ->

            // 将用户的权限添加到 authrities中就可以了

            authorities.add(new SimpleGrantedAuthority(role.getName()))

        }

        sysUser.setAuthorities(authorities)

        return sysUser

    }

}

三, 接口控制:

登陆使用的

    @RequestMapping(value = "/login")

    public Object login(@AuthenticationPrincipal SysUser loginUser, @RequestParam(name = "logout", required = false) String logout) {

        if (logout != null) {

            return null

        }

        if (loginUser != null) {

            return loginUser

        }

        return null

    }

权限接口控制:

package com.wenbronk.security.controller

import com.wenbronk.security.entity.SysUser

import org.springframework.security.access.annotation.Secured

import org.springframework.web.bind.annotation.RequestBody

import org.springframework.web.bind.annotation.RequestMapping

import org.springframework.web.bind.annotation.RequestMethod

import org.springframework.web.bind.annotation.RestController

/**

 * Created by wenbronk on 2017/8/17.

 */

@RestController

@RequestMapping("/users")

class HomeController {

    /**

     * 所有可访问

     */

    @RequestMapping(method = RequestMethod.GET)

    String getusers() {

        'getUsers'

    }

    @Secured(value = ['ROLE_ADMIN', 'ROLE_USER'])

    @RequestMapping(method = RequestMethod.POST)

    String save(@RequestBody SysUser user) {

        user.toString()

    }

    /**

     * 只有admin可访问

     */

    @Secured(value = ['ROLE_ADMIN'])

    @RequestMapping(method = RequestMethod.PUT)

    String update() {

        'updateUser'

    }

    @Secured(value = ['ROLE_ADMIN'])

    @RequestMapping(method = RequestMethod.DELETE)

    String delete() {

        'deleteUser'

    }

}

四, 访问:

1, get访问

2, post访问, 请求体为:

{

    "id": ,

    "username": "vini",

    "password": "",

    "rawPass": ""

}

3, put请求, 此处使用的用户没有权限

4, delete请求, 换有权限的用户

这样, 就可以实现具体方法的访问权限控制, 包括rest请求

ps: basic64登陆, 需要密码, 可以使用工具生成, 也可以抓包

原博客地址:

http://blog.csdn.net/u012373815/article/details/59749385

码农公寓