SpringBoot 整合Seccurity、权限管理

Spring Boot 整合Spring Seccurity

1.创建maven工程

<?xml version="1.0" encoding="UTF-8"?>

    4.0.0

    org.example
    springsecurity
    1.0-SNAPSHOT
    
        spring-boot-starter-web
        org.springframework.boot
        2.2.4.RELEASE
    
    
        
            org.springframework.boot
            spring-boot-starter-web
        
        
            org.springframework.boot
            spring-boot-starter-thymeleaf
        
        
            org.springframework.boot
            spring-boot-starter-security
        
    

权限管理的开发

权限付给角色，角色付给用户

2.Handler

package com.southwind.controller;

import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.GetMapping;

@Controller
public class SecurtyHandler {
    @GetMapping("/index")
    public String index(){
        return "index";
    }
}

3.HTML

    
    


    
idnex
    

        
    

4.配置文件

spring:
  thymeleaf:
    suffix: .html
    prefix: classpath:/templates/

5.启动类

package com;

import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.context.annotation.ComponentScan;

@SpringBootApplication
public class Application {
    public static void main(String[] args) {
        SpringApplication.run(Application.class,args);
    }
}

用户名默认user

密码：默认随机

自定义：

spring:
  thymeleaf:
    suffix: .html
    prefix: classpath:/templates/
  security:
    user:
      name: admin
      password: 123456

权限管理

定义两个资源：

• index.html

  package com.southwind.Config;
  
  import org.springframework.context.annotation.Configuration;
  import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
  import org.springframework.security.config.annotation.web.builders.HttpSecurity;
  import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
  @Configuration
  public class SecurityConfig extends WebSecurityConfigurerAdapter {
      /**
       * 角色和资源
       * @param http
       * @throws Exception
       */
      @Override
      protected void configure(HttpSecurity http) throws Exception {
          http.authorizeRequests()
                  .antMatchers("/admin").hasRole("ADMIN")
                  .antMatchers("/index").access("hasRole('ADMIN') or hasRole('USER')")
                  .anyRequest().authenticated()
                  .and()
                  .formLogin()
                  .loginPage("/login")
                  .permitAll()
                  .and()
                  .logout()
                  .permitAll()
                  .and()
                  .csrf()
                  .disable();
      }
  
      /**
       * 用户和角色
       * @param auth
       * @throws Exception
       */
      @Override
      protected void configure(AuthenticationManagerBuilder auth) throws Exception {
         auth.inMemoryAuthentication().passwordEncoder(new MypasswordEncoder())
                 .withUser("user").password(new MypasswordEncoder()
                 .encode("000")).roles("USER")
                 .and()
                 .withUser("admin").password(new MypasswordEncoder()
                 .encode("123")).roles("ADMIN","uSER");
      }
  }
  

• admin.html

定义两个角色：

• ADMIN访问index.html
• USER访问index.html

1.创建SecurityConfig

2.自定义MypasswordEncoder类

package com.southwind.Config;

import org.springframework.security.crypto.password.PasswordEncoder;

public class MypasswordEncoder implements PasswordEncoder {

    @Override
    public String encode(CharSequence charSequence) {
        return charSequence.toString();
    }

    @Override
    public boolean matches(CharSequence charSequence, String s) {
        return s.equals((charSequence.toString()));
    }
}

package com.southwind.Config;

import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
@Configuration
public class SecurityConfig extends WebSecurityConfigurerAdapter {
    /**
     * 角色和资源
     * @param http
     * @throws Exception
     */
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests()
                .antMatchers("/admin").hasRole("ADMIN")
                .antMatchers("/index").access("hasRole('ADMIN') or hasRole('USER')")
                .anyRequest().authenticated()
                .and()
                .formLogin()
                .loginPage("/login")
                .permitAll()
                .and()
                .logout()
                .permitAll()
                .and()
                .csrf()
                .disable();
    }

    /**
     * 用户和角色
     * @param auth
     * @throws Exception
     */
    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
       auth.inMemoryAuthentication().passwordEncoder(new MypasswordEncoder())
               .withUser("user").password(new MypasswordEncoder()
               .encode("000")).roles("USER")
               .and()
               .withUser("admin").password(new MypasswordEncoder()
               .encode("123")).roles("ADMIN","uSER");
    }
}

4.Handler

package com.southwind.controller;

import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.GetMapping;

@Controller
public class SecurtyHandler {
    @GetMapping("/index")
    public String index(){
        return "index";
    }
    @GetMapping("/admin")
    public String admin(){
        return "adimin";
    }
    @GetMapping("/login")
    public String login(){
        return "login";
    }
}

5.HTML

    
    


    
后台管理系统
    

        
    

    
    


    
欢迎回来
    

        
    

    
    


    

        用户名或密码错误
    
    

       用户名：

        密码：