SpringBoot整合Spring Security SpringBoot整合Spring Security的详细教程

-- ----------------------------
-- Table structure for sys_role
-- ----------------------------
DROP TABLE IF EXISTS `sys_role`;
CREATE TABLE `sys_role` (
 `ID` int(11) NOT NULL AUTO_INCREMENT COMMENT '编号',
 `ROLE_NAME` varchar(30) CHARACTER SET utf8 COLLATE utf8_general_ci NULL DEFAULT NULL COMMENT '角色名称',
 `ROLE_DESC` varchar(60) CHARACTER SET utf8 COLLATE utf8_general_ci NULL DEFAULT NULL COMMENT '角色描述',
 PRIMARY KEY (`ID`) USING BTREE
) ENGINE = InnoDB AUTO_INCREMENT = 6 CHARACTER SET = utf8 COLLATE = utf8_general_ci ROW_FORMAT = Compact;

-- ----------------------------
-- Records of sys_role
-- ----------------------------
INSERT INTO `sys_role` VALUES (1, 'ROLE_USER', '基本角色');
INSERT INTO `sys_role` VALUES (2, 'ROLE_ADMIN', '超级管理员');
INSERT INTO `sys_role` VALUES (3, 'ROLE_PRODUCT', '管理产品');
INSERT INTO `sys_role` VALUES (4, 'ROLE_ORDER', '管理订单');

-- ----------------------------
-- Table structure for sys_user
-- ----------------------------
DROP TABLE IF EXISTS `sys_user`;
CREATE TABLE `sys_user` (
 `id` int(11) NOT NULL AUTO_INCREMENT,
 `username` varchar(32) CHARACTER SET utf8 COLLATE utf8_general_ci NOT NULL COMMENT '用户名称',
 `password` varchar(120) CHARACTER SET utf8 COLLATE utf8_general_ci NOT NULL COMMENT '密码',
 `status` int(1) NULL DEFAULT 1 COMMENT '1开启0关闭',
 PRIMARY KEY (`id`) USING BTREE
) ENGINE = InnoDB AUTO_INCREMENT = 4 CHARACTER SET = utf8 COLLATE = utf8_general_ci ROW_FORMAT = Compact;

-- ----------------------------
-- Records of sys_user
-- ----------------------------
INSERT INTO `sys_user` VALUES (1, 'xiaoming', '$2a$10$CYX9OMv0yO8wR8rE19N2fOaXDJondci5uR68k2eQJm50q8ESsDMlC', 1);
INSERT INTO `sys_user` VALUES (2, 'xiaoma', '$2a$10$CYX9OMv0yO8wR8rE19N2fOaXDJondci5uR68k2eQJm50q8ESsDMlC', 1);

-- ----------------------------
-- Table structure for sys_user_role
-- ----------------------------
DROP TABLE IF EXISTS `sys_user_role`;
CREATE TABLE `sys_user_role` (
 `UID` int(11) NOT NULL COMMENT '用户编号',
 `RID` int(11) NOT NULL COMMENT '角色编号',
 PRIMARY KEY (`UID`, `RID`) USING BTREE,
 INDEX `FK_Reference_10`(`RID`) USING BTREE,
 CONSTRAINT `FK_Reference_10` FOREIGN KEY (`RID`) REFERENCES `sys_role` (`ID`) ON DELETE RESTRICT ON UPDATE RESTRICT,
 CONSTRAINT `FK_Reference_9` FOREIGN KEY (`UID`) REFERENCES `sys_user` (`id`) ON DELETE RESTRICT ON UPDATE RESTRICT
) ENGINE = InnoDB CHARACTER SET = utf8 COLLATE = utf8_general_ci ROW_FORMAT = Compact;

-- ----------------------------
-- Records of sys_user_role
-- ----------------------------
INSERT INTO `sys_user_role` VALUES (1, 1);
INSERT INTO `sys_user_role` VALUES (2, 1);
INSERT INTO `sys_user_role` VALUES (1, 3);
INSERT INTO `sys_user_role` VALUES (2, 4);

SET FOREIGN_KEY_CHECKS = 1;

…………
# 配置了公钥和私钥的位置
rsa:
 key:
 pubKeyPath: C:\Users\robod\Desktop\auth_key\id_key_rsa.pub
 priKeyPath: C:\Users\robod\Desktop\auth_key\id_key_rsa

@Data
public class Payload<T> {
 private String id;
 private T userInfo;
 private Date expiration;
}

@Data
@ConfigurationProperties("rsa.key") //指定配置文件的key
public class RsaKeyProperties {

 private String pubKeyPath;

 private String priKeyPath;

 private PublicKey publicKey;
 private PrivateKey privateKey;

 @PostConstruct
 public void createKey() throws Exception {
 this.publicKey = RsaUtils.getPublicKey(pubKeyPath);
 this.privateKey = RsaUtils.getPrivateKey(priKeyPath);
 }
}

@EnableConfigurationProperties(RsaKeyProperties.class)

@Data
public class SysUser implements UserDetails {

 private Integer id;
 private String username;
 private String password;
 private Integer status;
 private List<SysRole> roles = new ArrayList<>();	//SysRole封装了角色信息，和登录无关，我放在后面讲

	//这里还有几个UserDetails中的方法，我就不贴代码了

}

public interface UserService extends UserDetailsService {
}
//-----------------------------------------------------------
@Service("userService")
public class UserServiceImpl implements UserService {
	…………
 @Override
 public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
 SysUser sysUser = userMapper.findByUsername(username);
 return sysUser;
 }
}

public class JwtLoginFilter extends UsernamePasswordAuthenticationFilter {

 private AuthenticationManager authenticationManager;
 private RsaKeyProperties rsaKeyProperties;

 public JwtLoginFilter(AuthenticationManager authenticationManager, RsaKeyProperties rsaKeyProperties) {
 this.authenticationManager = authenticationManager;
 this.rsaKeyProperties = rsaKeyProperties;
 }

 //这个方法是用来去尝试验证用户的
 @Override
 public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response) throws AuthenticationException {
 try {
  SysUser user = JSONObject.parseObject(request.getInputStream(),SysUser.class);
  return authenticationManager.authenticate(
   new UsernamePasswordAuthenticationToken(
    user.getUsername(),
    user.getPassword())
  );
 } catch (Exception e) {
  try {
  response.setContentType("application/json;charset=utf-8");
  response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
  PrintWriter out = response.getWriter();
  Map<String, Object> map = new HashMap<>();
  map.put("code", HttpServletResponse.SC_UNAUTHORIZED);
  map.put("message", "账号或密码错误！");
  out.write(new ObjectMapper().writeValueAsString(map));
  out.flush();
  out.close();
  } catch (Exception e1) {
  e1.printStackTrace();
  }
  throw new RuntimeException(e);
 }
 }

 //成功之后执行的方法
 @Override
 public void successfulAuthentication(HttpServletRequest request, HttpServletResponse response, FilterChain chain, Authentication authResult) throws IOException, ServletException {
 SysUser sysUser = new SysUser();
 sysUser.setUsername(authResult.getName());
 sysUser.setRoles((List<SysRole>) authResult.getAuthorities());
 String token = JwtUtils.generateTokenExpireInMinutes(sysUser,rsaKeyProperties.getPrivateKey(),24*60);
 response.addHeader("Authorization", "RobodToken " + token);	//将Token信息返回给用户
 try {
  //登录成功时，返回json格式进行提示
  response.setContentType("application/json;charset=utf-8");
  response.setStatus(HttpServletResponse.SC_OK);
  PrintWriter out = response.getWriter();
  Map<String, Object> map = new HashMap<String, Object>(4);
  map.put("code", HttpServletResponse.SC_OK);
  map.put("message", "登陆成功！");
  out.write(new ObjectMapper().writeValueAsString(map));
  out.flush();
  out.close();
 } catch (Exception e1) {
  e1.printStackTrace();
 }
 }
}

@Configuration
@EnableWebSecurity //这个注解的意思是这个类是Spring Security的配置类
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
	…………
 @Bean
 public BCryptPasswordEncoder passwordEncoder() {
 return new BCryptPasswordEncoder();
 }

 //认证用户的来源
 @Override
 protected void configure(AuthenticationManagerBuilder auth) throws Exception {
 auth.userDetailsService(userService).passwordEncoder(passwordEncoder());
 }

 //配置SpringSecurity相关信息
 @Override
 public void configure(HttpSecurity http) throws Exception {
 http.csrf().disable() //关闭csrf
  .addFilter(new JwtLoginFilter(super.authenticationManager(),rsaKeyProperties))
  .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS); //禁用session
 }

}

@Data
public class SysRole implements GrantedAuthority {

 private Integer id;
 private String roleName;
 private String roleDesc;

 /**
 * 如果授予的权限可以当作一个String的话，就可以返回一个String
 * @return
 */
 @JsonIgnore
 @Override
 public String getAuthority() {
 return roleName;
 }

}

public class JwtVerifyFilter extends BasicAuthenticationFilter {
	…………
 @Override
 protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain chain)
  throws IOException, ServletException {
 String header = request.getHeader("Authorization");
 //没有登录
 if (header == null || !header.startsWith("RobodToken ")) {
  chain.doFilter(request, response);
  response.setContentType("application/json;charset=utf-8");
  response.setStatus(HttpServletResponse.SC_FORBIDDEN);
  PrintWriter out = response.getWriter();
  Map<String, Object> map = new HashMap<String, Object>(4);
  map.put("code", HttpServletResponse.SC_FORBIDDEN);
  map.put("message", "请登录！");
  out.write(new ObjectMapper().writeValueAsString(map));
  out.flush();
  out.close();
  return;
 }
 //登录之后从token中获取用户信息
 String token = header.replace("RobodToken ","");
 SysUser sysUser = JwtUtils.getInfoFromToken(token, rsaKeyProperties.getPublicKey(), SysUser.class).getUserInfo();
 if (sysUser != null) {
  Authentication authResult = new UsernamePasswordAuthenticationToken
   (sysUser.getUsername(),null,sysUser.getAuthorities());
  SecurityContextHolder.getContext().setAuthentication(authResult);
  chain.doFilter(request, response);
 }
 }
}

…………
rsa:
 key:
 pubKeyPath: C:\Users\robod\Desktop\auth_key\id_key_rsa.pub

@Data
@ConfigurationProperties("rsa.key") //指定配置文件的key
public class RsaKeyProperties {

 private String pubKeyPath;

 private PublicKey publicKey;

 @PostConstruct
 public void createKey() throws Exception {
 this.publicKey = RsaUtils.getPublicKey(pubKeyPath);
 }
}

@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(securedEnabled = true) //开启权限控制的注解支持,securedEnabled表示SpringSecurity内部的权限控制注解开关
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
	…………
 //配置SpringSecurity相关信息
 @Override
 public void configure(HttpSecurity http) throws Exception {
 http.csrf().disable() //关闭csrf
  .authorizeRequests()
  .antMatchers("/**").hasAnyRole("USER") //角色信息
  .anyRequest() //其它资源
  .authenticated() //表示其它资源认证通过后
  .and()
  .addFilter(new JwtVerifyFilter(super.authenticationManager(),rsaKeyProperties))
  .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS); //禁用session
 }

}

@RestController
@RequestMapping("/product")
public class ProductController {

 @Secured("ROLE_PRODUCT")
 @RequestMapping("/findAll")
 public String findAll() {
 return "产品列表查询成功";
 }

}