springboot-security

一、添加依赖

  <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-security</artifactId>
        </dependency>

二、添加启动configuration 启动SpringSecurity过滤链

import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfiguration;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;

import javax.annotation.Resource;

/**
 * @Autor zhangjiawen
 * @Date: 2020/4/27 15:34
 */
@Configuration
@EnableWebSecurity //启动SpringSecurity过滤链
public class SpringSecurityConfig extends WebSecurityConfigurerAdapter {
    @Resource
    private AuthUserDetailService authUserDetailService;

    //该方法的作用是代替之前的配置：<security:authentication-manager>
    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        //auth.inMemoryAuthentication().passwordEncoder(new BCryptPasswordEncoder()).withUser("eric").password(new BCryptPasswordEncoder().encode("abc")).authorities("PRO_ADD");
        //相当于<security:authentication-provider user-service-ref="authUserDetailService">
        auth.userDetailsService(authUserDetailService).passwordEncoder(new BCryptPasswordEncoder());
    }
    //该方法的作用是代替之前的配置:<security:http>
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests()
                .antMatchers("/manager/pro/del").hasAnyAuthority("Role_Del")
                .antMatchers("/manager/login").permitAll()
                .antMatchers("/manager/**")
                .fullyAuthenticated()
                .and()
                .formLogin().loginPage("/manager/login").failureHandler( new MyAuthenticationFailureHandler())
                .successHandler(new MyAuthenticationSuccessHandler())
                .and()
                .csrf().disable();


    }
}

同一错误页面转发

import org.springframework.boot.web.server.ConfigurableWebServerFactory;
import org.springframework.boot.web.server.ErrorPage;
import org.springframework.boot.web.server.WebServerFactory;
import org.springframework.boot.web.server.WebServerFactoryCustomizer;
import org.springframework.context.EmbeddedValueResolverAware;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.http.HttpStatus;

/**
 * @Autor zhangjiawen
 * @Date: 2020/4/27 16:41
 */
@Configuration
public class ErrorPageConfig {
    @Bean
    public WebServerFactoryCustomizer<ConfigurableWebServerFactory> webServerFactoryCustomizer(){
        return new WebServerFactoryCustomizer<ConfigurableWebServerFactory>(){
            //ErrorPage:定义错误页面
            //参数一 错误状态码
            //参数二 交给哪个请求处理
            @Override
            public void customize(ConfigurableWebServerFactory factory) {
                factory.addErrorPages(new ErrorPage(HttpStatus.FORBIDDEN,"/403"));
            }


        };
    }
}

用户权限赋予类

import cn.net.topnet.topfs.dynamicdb.MongodbTemplateContextHolder;
import cn.net.topnet.topfs.entities.Permissions;
import cn.net.topnet.topfs.entities.Users;
import cn.net.topnet.topfs.service.UserService;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.authority.SimpleGrantedAuthority;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.core.userdetails.UsernameNotFoundException;
import org.springframework.stereotype.Service;

import javax.annotation.Resource;
import java.util.ArrayList;
import java.util.List;
import java.util.Set;

/**
 * @Autor zhangjiawen
 * @Date: 2020/4/28 10:03
 @Description: 实现了UserDetailsService接口中的loadUserByUsername方法
  * 执行登录,构建Authentication对象必须的信息,
  * 如果用户不存在，则抛出UsernameNotFoundException异常
 * @Param: [s]
 * @return: org.springframework.security.core.userdetails.UserDetails
 */
@Service
public class AuthUserDetailService implements UserDetailsService {
    @Resource
    private UserService userService;

    @Override
    public UserDetails loadUserByUsername(String s) throws UsernameNotFoundException {
        /**
         * @Author: Galen
         * @Description: 查询数据库，获取登录的用户信息
         **/
        MongodbTemplateContextHolder.setMongoDBTemplate("metadata");
        Users user = userService.findOneByUserName(s);
        if(user==null){
            throw new UsernameNotFoundException("用户名错误！");
        }
        MongodbTemplateContextHolder.setMongoDBTemplate("metadata");
        Set<Permissions> allPermissions = userService.findAllPermissionsByName(s);
        List<GrantedAuthority> authorities=new ArrayList<GrantedAuthority>();
        allPermissions.forEach(permissions -> {
            GrantedAuthority grantedAuthority=new SimpleGrantedAuthority(permissions.getSymbol());
            authorities.add(grantedAuthority);
        });
        user.setAuthorities(authorities);
        return user;
    }
}

验证失败拦截器

import com.fasterxml.jackson.databind.ObjectMapper;
import org.springframework.security.authentication.*;
import org.springframework.security.core.AuthenticationException;
import org.springframework.security.core.userdetails.UsernameNotFoundException;
import org.springframework.security.web.authentication.AuthenticationFailureHandler;

import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
import java.util.HashMap;
import java.util.Map;

/**
 * @Autor zhangjiawen
 * @Date: 2020/4/28 14:02
 */
public class MyAuthenticationFailureHandler implements AuthenticationFailureHandler {
    @Override
    public void onAuthenticationFailure(HttpServletRequest request, HttpServletResponse response, AuthenticationException exception) throws IOException, ServletException {
        response.setContentType("application/json;charset=utf-8");
        Map result=new HashMap();
        if (exception instanceof BadCredentialsException ||
                exception instanceof UsernameNotFoundException) {
            result.put("error","账户名或者密码输入错误!");
        } else if (exception instanceof LockedException) {
            result.put("error","账户被锁定，请联系管理员!");
        } else if (exception instanceof CredentialsExpiredException) {
            result.put("error","密码过期，请联系管理员!");
        } else if (exception instanceof AccountExpiredException) {
            result.put("error","账户过期，请联系管理员!");
        } else if (exception instanceof DisabledException) {
            result.put("error","账户被禁用，请联系管理员!");
        } else {
            result.put("error","登录失败!");
        }
        ObjectMapper objectMapper=new ObjectMapper();
        response.setContentType("Text/json;charset=utf-8");
        response.getWriter().write(objectMapper.writeValueAsString(result));


    }
}

验证成功拦截器

import com.fasterxml.jackson.databind.ObjectMapper;
import org.springframework.security.core.Authentication;
import org.springframework.security.web.authentication.AuthenticationSuccessHandler;

import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
import java.util.HashMap;
import java.util.Map;

/**
 * @Autor zhangjiawen
 * @Date: 2020/4/28 14:37
 */
public class MyAuthenticationSuccessHandler implements AuthenticationSuccessHandler {
    @Override
    public void onAuthenticationSuccess(HttpServletRequest request, HttpServletResponse response, Authentication authentication) throws IOException, ServletException {
        Map result=new HashMap();
        result.put("success",true);
        ObjectMapper objectMapper=new ObjectMapper();
        response.getWriter().write(objectMapper.writeValueAsString(result));
    }
}

用户实体类

import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.userdetails.UserDetails;

import java.util.ArrayList;
import java.util.Collection;
import java.util.Date;
import java.util.List;

/**
 * @Autor zhangjiawen
 * @Date: 2020/4/27 17:26
 */
public class Users implements UserDetails {

    private String id;
    private String username;
    private String realName;
    private String password;
    private Date creatDate;
    private Date lastLoginTime;
    private boolean enabled;
    private boolean accountNonExpired;
    private boolean accountNonLocked;
    private boolean credentialsNonExpired;
    private List<GrantedAuthority> authorities=new ArrayList<>();
    public String getId() {
        return id;
    }

    public void setAuthorities(List<GrantedAuthority> authorities) {
        this.authorities = authorities;
    }

    public void setId(String id) {
        this.id = id;
    }

    @Override
    public String getUsername() {
        return username;
    }

    public void setUsername(String username) {
        this.username = username;
    }

    public String getRealName() {
        return realName;
    }

    public void setRealName(String realName) {
        this.realName = realName;
    }

    @Override
    public Collection<? extends GrantedAuthority> getAuthorities() {
        return this.authorities;
    }

    @Override
    public String getPassword() {
        return password;
    }

    public void setPassword(String password) {
        this.password = password;
    }

    public Date getCreatDate() {
        return creatDate;
    }

    public void setCreatDate(Date creatDate) {
        this.creatDate = creatDate;
    }

    public Date getLastLoginTime() {
        return lastLoginTime;
    }

    public void setLastLoginTime(Date lastLoginTime) {
        this.lastLoginTime = lastLoginTime;
    }

    @Override
    public boolean isEnabled() {
        return enabled;
    }

    public void setEnabled(boolean enabled) {
        this.enabled = enabled;
    }

    @Override
    public boolean isAccountNonExpired() {
        return accountNonExpired;
    }

    public void setAccountNonExpired(boolean accountNonExpired) {
        this.accountNonExpired = accountNonExpired;
    }

    @Override
    public boolean isAccountNonLocked() {
        return accountNonLocked;
    }

    public void setAccountNonLocked(boolean accountNonLocked) {
        this.accountNonLocked = accountNonLocked;
    }

    @Override
    public boolean isCredentialsNonExpired() {
        return credentialsNonExpired;
    }

    public void setCredentialsNonExpired(boolean credentialsNonExpired) {
        this.credentialsNonExpired = credentialsNonExpired;
    }
}

controller

import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RestController;

/**
 * @Autor zhangjiawen
 * @Date: 2020/4/27 15:45
 */
@Controller
@RequestMapping("/manager")
public class SecurityController {

    @GetMapping("/index")
    public String index(){
        return "index";
    }

    @GetMapping("/pro/add")
    public String add(){
        return "add";
    }
    @GetMapping("/pro/update")
    public String update(){
        return "update";
    }
    @GetMapping("/pro/del")
    public String del(){
        return "del";
    }

    @GetMapping("/403")
    public String forbidden(){
        return "403";
    }
    @GetMapping("/login")
    public String login(){
        return "login";
    }

}

login.html

<!DOCTYPE html >
<html lang="en" xmlns:th="http://www.thymeleaf.org">
<head>
    <meta charset="UTF-8">
    <title>Title</title>
</head>
<body>
<form action="/api/v1/manager/login" method="post">
账号：<input type="text" name="username"/>
    密码：<input type="text" name="password">
    <input type="submit" value="登录" />
    <span th:text="${error}"></span>

</form>

</body>
</html>

密码加密代码块

    @Override
    public Users insert(Users entity) {
        PasswordEncoder passwordEncoder=new BCryptPasswordEncoder();
        entity.setPassword(passwordEncoder.encode(entity.getPassword()));
        return mongoTemplate.insert(entity);
    }