您的位置：首页 > 编程语言 > Java开发

Spring Security的配置

2016-05-02 18:16 411 查看

使用和配置spring security，一个基本的权限管理模块

引入这两个包，版本自选，目前是2.5

<dependency>
<groupId>org.springframework.security</groupId>
<artifactId>spring-security-web</artifactId>
<version>${springSecuroty.version}</version>
</dependency>

<dependency>
<groupId>org.springframework.security</groupId>
<artifactId>spring-security-config</artifactId>
<version>${springSecuroty.version}</version>
</dependency>

新建一个class，目的是配置启动web app时加载spring security

因为是简单配置，所以没有重写里面的任何方法，实际项目中可以根据需求重写里面的方法

package com.demo.config.spring;

import org.springframework.core.Ordered;
import org.springframework.core.annotation.Order;
import org.springframework.security.web.context.AbstractSecurityWebApplicationInitializer;

@Order(Ordered.HIGHEST_PRECEDENCE)
public class SecurityInit extends AbstractSecurityWebApplicationInitializer {

}

具体的spring security权限配置

用户名和密码读取数据库进行鉴权的配置

如下：

package com.demo.config.spring;

import javax.sql.DataSource;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;

@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

@Autowired
private DataSource dataSourceMySQL;

@Autowired
public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
auth
.jdbcAuthentication()
.dataSource(dataSourceMySQL)
.usersByUsernameQuery(this.getUserQuery())
.authoritiesByUsernameQuery(this.getAuthoritiesQuery());
}

@Override
protected void configure(HttpSecurity http) throws Exception {

http
.csrf() //防止csrf
.disable()
.authorizeRequests() //css js的目录设为不需要验证
.antMatchers("/resources/**")
.permitAll()
.anyRequest() //所有请求都要经过验证
.authenticated()
.and()
.formLogin() //登陆页面设为不需要验证
.loginPage("/login")
.permitAll()
.and()
.logout() //登出请求设为不需要验证
.permitAll()
.and()
.headers() //如果使用iframe的话需要这段配置
.frameOptions()
.sameOrigin()
.httpStrictTransportSecurity()
.disable();

}

private String getUserQuery() {
return "SELECT t.user_name as 'username', t.pass_word as 'password', t.enabled as 'enabled' FROM demo.users t WHERE t.user_name = ?";
}

private String getAuthoritiesQuery() {
return "SELECT t.user_name as 'username', t.user_auth as 'authority' FROM demo.authorities t WHERE t.user_name = ?";
}

}

数据库里面有两张表

user表，字段有username，password，enable

authority表，权限等级表，字段有id，username，authority

另外，如果想要根据自己的需求定制登陆登出

新建一个这样的controller：

import javax.servlet.http.HttpServletRequest;

import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RestController;
import org.springframework.web.servlet.ModelAndView;

@RestController
public class AuthenticationController {

@RequestMapping(value = "/login", produces = "text/html; charset=utf-8")
public ModelAndView login(HttpServletRequest request){
return new ModelAndView("loginPage");
}

}

以及一个个性化的登录页面，处理所有的登录和登出：

<%@ page language="java" contentType="text/html" pageEncoding="UTF-8" isELIgnored="false"%>
<%@ taglib uri="http://java.sun.com/jsp/jstl/core" prefix="c"%>
<html>
<head>
<title>Login</title>
</head>
<body>
<form name="f" action="login" method="post">
<input type="hidden" name="${_csrf.parameterName}"
value="${_csrf.token}" />
<fieldset>
<c:if test="${param.error != null}">
<p><span style="color:red;">Invalid username and password.</span></p>
</c:if>
<c:if test="${param.logout != null}">
<p><span style="color:red;">You have been logged out.</span></p>
</c:if>
<legend>Please Login</legend>
<label for="username">Username</label> <input type="text"
id="username" name="username" /> <label for="password">Password</label>
<input type="password" id="password" name="password" />
<div class="form-actions">
<button type="submit" class="btn">Log in</button>
</div>
</fieldset>
</form>
</body>
</html>

补充：

1. 登陆自动转发请求/login，可以参考前面SecurityConfig.class的代码进行修改。

2. 如果输错密码，会自动转发请求/login?error

3. 登出自动转发请求/login?logout

个性化的页面，加密方式，等等都可以按需定制，spring security很强大的。

配置完成，网站有了全局的权限管理咯

以上

内容来自用户分享和网络整理，不保证内容的准确性，如有侵权内容，可联系管理员处理

标签：

相关文章推荐

新的分享

章节导航