springboot-29-security(二)用户角色权限控制

本博客基于上一个 http://www.cnblogs.com/wenbronk/p/7379865.html
增加了角色的权限表, 可以进行权限校验

一, 数据准备

1, 数据表建立

/*
Navicat MySQL Data Transfer
Source Server         : 本地
Source Host           : localhost:3306
Source Database       : test
Target Server Type    : MYSQL
Date: 2017-8-14 22:17:33
*/

SET FOREIGN_KEY_CHECKS=0;

-- ----------------------------
-- Table structure for `sys_user`
-- ----------------------------
DROP TABLE IF EXISTS `sys_user`;
CREATE TABLE `sys_user` (
`id` INT (32) NOT NULL AUTO_INCREMENT COMMENT '主键id',
`username` varchar(32) DEFAULT NULL COMMENT '用户名',
`password` varchar(32) DEFAULT NULL COMMENT '密码',
PRIMARY KEY (`id`)
) ENGINE=InnoDB AUTO_INCREMENT=28 DEFAULT CHARSET=utf8;

-- ----------------------------
-- Table structure for `sys_role`
-- ----------------------------
DROP TABLE IF EXISTS `sys_role`;
CREATE TABLE `sys_role` (
`id` INT (32) NOT NULL AUTO_INCREMENT COMMENT '主键id',
`name` varchar(32) DEFAULT NULL COMMENT '用户名',
PRIMARY KEY (`id`)
) ENGINE=InnoDB AUTO_INCREMENT=28 DEFAULT CHARSET=utf8;

-- ----------------------------
-- Table structure for `sys_permission`
-- ----------------------------
DROP TABLE IF EXISTS `sys_permission`;
CREATE TABLE `sys_permission` (
`id` INT (32) NOT NULL AUTO_INCREMENT COMMENT '主键id',
`name` varchar(32) DEFAULT NULL COMMENT '用户名',
`desc` VARCHAR (32) DEFAULT NULL COMMENT '描述',
`url` VARCHAR (32) DEFAULT NULL COMMENT 'url',
`pid` INT (32),
PRIMARY KEY (`id`)
) ENGINE=InnoDB AUTO_INCREMENT=28 DEFAULT CHARSET=utf8;

-- ----------------------------
-- Table structure for `sys_role_user`
-- ----------------------------
DROP TABLE IF EXISTS `sys_role_user`;
CREATE TABLE `sys_role_user` (
`id` bigint(20) NOT NULL AUTO_INCREMENT COMMENT '主键id',
`sys_user_id` INT(32) NOT NULL COMMENT 'user_id',
`sys_role_id` INT(32) NOT NULL COMMENT 'role_id',
PRIMARY KEY (`id`)
) ENGINE=InnoDB AUTO_INCREMENT=28 DEFAULT CHARSET=utf8;

ALTER TABLE sys_role_user ADD CONSTRAINT sys_FK1 FOREIGN KEY(sys_user_id) REFERENCES sys_user(id);
ALTER TABLE sys_role_user ADD CONSTRAINT role_FK2 FOREIGN KEY(sys_role_id) REFERENCES sys_role(id);

-- ----------------------------
-- Table structure for `sys_permission_role`
-- ----------------------------
DROP TABLE IF EXISTS `sys_permission_role`;
CREATE TABLE `sys_permission_role` (
`id` bigint(20) NOT NULL AUTO_INCREMENT COMMENT '主键id',
`sys_role_id` INT(32) NOT NULL COMMENT 'role_id',
`sys_permission_id` INT(32) NOT NULL COMMENT 'permission_id',
PRIMARY KEY (`id`)
) ENGINE=InnoDB AUTO_INCREMENT=28 DEFAULT CHARSET=utf8;
ALTER TABLE sys_permission_role ADD CONSTRAINT sys_FK3 FOREIGN KEY(sys_role_id) REFERENCES sys_role(id);
ALTER TABLE sys_permission_role ADD CONSTRAINT role_FK4 FOREIGN KEY(sys_permission_id) REFERENCES sys_permission(id);

2, 导入数据

insert into SYS_USER (id,username, password) values (1,'vini', '123');
insert into SYS_USER (id,username, password) values (2,'bronk', '123');

insert into SYS_ROLE(id,name) values(1,'ROLE_ADMIN');
insert into SYS_ROLE(id,name) values(2,'ROLE_USER');

insert into SYS_ROLE_USER(SYS_USER_ID,sys_role_id) values(1,1);
insert into SYS_ROLE_USER(SYS_USER_ID,sys_role_id) values(2,2);

BEGIN;
INSERT INTO `sys_permission` VALUES ('1', 'ROLE_HOME', 'home', '/', null),
('2', 'ROLE_ADMIN', 'ABel', '/admin', null);
COMMIT;

BEGIN;
INSERT INTO `sys_permission_role` VALUES ('1', '1', '1'), ('2', '1', '2'), ('3', '2', '1');
COMMIT;

3, mybatis实体, 其余2个和上一篇博客一样

SysPermission.groovy

package com.wenbronk.security.entity

/**
* Created by wenbronk on 2017/8/17.
*/
class SysPermission {
int id
String name
String desc
String url
int pid
}

4, application.yml配置服务启动导入

和上个一样

二, security部分

东西比较多, 按流程来,

1, WebSecurityConfig.groovy 添加

http.addFilterBefore(myFilterSecurityInterceptor, FilterSecurityInterceptor.class)

最终代码为:

package com.wenbronk.security.security.config

import com.wenbronk.security.security.interceptor.MyFilterSecurityInterceptor
import com.wenbronk.security.security.service.CustomUserService
import org.springframework.beans.factory.annotation.Autowired
import org.springframework.context.annotation.Configuration
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder
import org.springframework.security.config.annotation.web.builders.HttpSecurity
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter
import org.springframework.security.web.access.intercept.FilterSecurityInterceptor

import javax.inject.Inject
/**
* Created by wenbronk on 2017/8/15.
*/
@Configuration
@EnableWebSecurity
class WebSecurityConfig extends WebSecurityConfigurerAdapter {

@Inject
CustomUserService customUserService;
@Autowired
MyFilterSecurityInterceptor myFilterSecurityInterceptor

@Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
auth.userDetailsService(customUserService);
}

@Override
protected void configure(HttpSecurity http) throws Exception {
http.authorizeRequests()
.anyRequest().authenticated()   // 任何请求都拦截
.and()
.formLogin()
.loginPage("/login")
.failureUrl("/login?error")
.permitAll()        // 登陆后可访问任意页面
.and()
.logout().permitAll();  // 注销后任意访问
http.addFilterBefore(myFilterSecurityInterceptor, FilterSecurityInterceptor.class)
}
}

2, 请求会被拦截器拦截, MyFilterSecurityInterceptor,

package com.wenbronk.security.security.interceptor

import com.wenbronk.security.security.config.MyAccessDecisonManager
import org.springframework.beans.factory.annotation.Autowired
import org.springframework.security.access.SecurityMetadataSource
import org.springframework.security.access.intercept.AbstractSecurityInterceptor
import org.springframework.security.access.intercept.InterceptorStatusToken
import org.springframework.security.web.FilterInvocation
import org.springframework.security.web.access.intercept.FilterInvocationSecurityMetadataSource
import org.springframework.stereotype.Component

import javax.inject.Inject
import javax.servlet.*

/**
* Created by wenbronk on 2017/8/17.
*/
@Component
class MyFilterSecurityInterceptor extends AbstractSecurityInterceptor implements Filter {

@Inject
FilterInvocationSecurityMetadataSource securityMetadataSource

@Autowired
public void setMyAccessDecisionManager(MyAccessDecisonManager myAccessDecisonManager) {
super.setAccessDecisionManager(myAccessDecisonManager)
}

@Override
void init(FilterConfig filterConfig) throws ServletException {

}

/**
* fi中有一个被拦截的url
* 里面调用MyInvocationSecurityMetadataSource的getAttributes(Object object)这个方法获取fi对应的所有权限
//再调用MyAccessDecisionManager的decide方法来校验用户的权限是否足够
*/
@Override
void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
FilterInvocation fi = new FilterInvocation(request, response, chain)
invoke(fi)
}

void invoke(FilterInvocation filterInvocation) {
InterceptorStatusToken token = super.beforeInvocation(filterInvocation)
try {
filterInvocation.getChain().doFilter(filterInvocation.getRequest(), filterInvocation.getResponse())
} finally {
super.afterInvocation(token, null)
}
}

@Override
void destroy() {

}

@Override
Class<?> getSecureObjectClass() {
return FilterInvocation.class
}

@Override
SecurityMetadataSource obtainSecurityMetadataSource() {
return this.securityMetadataSource
}
}

3, 拦截器会调用 MyInvocationSecurityMetaDataSource的 getAttribute方法 获取 filter的权限, 并且滴哦啊用 MyAccessDecisionManager的 decide 方法来校验是否拥有权限

MyInvocationSecurityMetadataSource.groovy

package com.wenbronk.security.security.service

import com.wenbronk.security.entity.SysPermission
import com.wenbronk.security.mapper.SysPermissionMapper
import org.springframework.security.access.ConfigAttribute
import org.springframework.security.access.SecurityConfig
import org.springframework.security.web.FilterInvocation
import org.springframework.security.web.access.intercept.FilterInvocationSecurityMetadataSource
import org.springframework.security.web.util.matcher.AntPathRequestMatcher
import org.springframework.stereotype.Service

import javax.inject.Inject
import javax.servlet.http.HttpServletRequest

/**
* Created by wenbronk on 2017/8/17.
*/
@Service
class MyInvocationSecurityMetadataSourceService implements FilterInvocationSecurityMetadataSource{

@Inject
SysPermissionMapper sysPermissionMapper

/**
* 此方法是为了判定用户请求的url 是否在权限表中，
* 如果在权限表中，则返回给 decide 方法，用来判定用户是否有此权限。如果不在权限表中则放行。
*/
@Override
Collection<ConfigAttribute> getAttributes(Object o) throws IllegalArgumentException {
Map<String, Collection<ConfigAttribute>> map = loadResourceDefine()
HttpServletRequest request = ((FilterInvocation) o).getHttpRequest()
map.each {entry ->
AntPathRequestMatcher matcher = new AntPathRequestMatcher(entry.getKey())
if (matcher.matches(request)) {
// 匹配, 返回给decide方法
return entry.getValue()
}
}
return null
}

/**
* 加载权限表中所有的权限
*/
public Map<String, Collection<ConfigAttribute>> loadResourceDefine() {
Map<String, Collection<ConfigAttribute>> map = new HashMap<>()
List<SysPermission> permissions = sysPermissionMapper.findAll()
permissions.each {permission ->
List<ConfigAttribute> array = new ArrayList<>()
// 此处只添加了用户的名字，其实还可以添加更多权限的信息，例如请求方法到ConfigAttribute的集合中去。
// 此处添加的信息将会作为MyAccessDecisionManager类的decide的第三个参数。
ConfigAttribute cfg = new SecurityConfig(permission.getName())
array.add(cfg)
// 用权限的url作为key, 权限的名称集合为value
map.put(permission.getUrl(), array);
}

return null
}

@Override
Collection<ConfigAttribute> getAllConfigAttributes() {
return null
}

@Override
boolean supports(Class<?> aClass) {
return true
}
}

4, MyInvocationSecurityMetadataSource 查询数据库中url和所需权限的关系, 返回给 MyAccessDecisionManger

MyAccessDecisionManger.groovy

package com.wenbronk.security.security.config

import org.springframework.security.access.AccessDecisionManager
import org.springframework.security.access.AccessDeniedException
import org.springframework.security.access.ConfigAttribute
import org.springframework.security.authentication.InsufficientAuthenticationException
import org.springframework.security.core.Authentication
import org.springframework.stereotype.Service

/**
* Created by wenbronk on 2017/8/17.
*/
@Service
class MyAccessDecisonManager implements AccessDecisionManager {

/**
* 判断是否拥有权限的决策方法
* authentication 是CustomUserService中循环添加到 GrantedAuthority 对象中的权限信息集合.
* object 包含客户端发起的请求的requset信息，可转换为 HttpServletRequest request = ((FilterInvocation) object).getHttpRequest();
* configAttributes 为MyInvocationSecurityMetadataSource的getAttributes(Object object)这个方法返回的结果，
*/
@Override
void decide(Authentication authentication, Object o, Collection<ConfigAttribute> configAttributes) throws AccessDeniedException, InsufficientAuthenticationException {
if (null == configAttributes || configAttributes.size() <=0 )
return
configAttributes.each {configAttribute ->
String needRole = configAttribute.getAttribute()
authentication.getAuthorities().each {authority ->
if (needRole.trim().equals(authority.getAuthority()))
return
}
}
throw new java.nio.file.AccessDeniedException('no right')
}

@Override
boolean supports(ConfigAttribute configAttribute) {
return true
}

@Override
boolean supports(Class<?> aClass) {
return true
}
}

decide进行是否有权限的决策, 正常则返回, 没有就抛出异常

5, 最终在 customuserService进行权限和用户的装配, 准备返回给前端

package com.wenbronk.security.security.service

import com.wenbronk.security.entity.SysPermission
import com.wenbronk.security.entity.SysUser
import com.wenbronk.security.mapper.SysPermissionMapper
import com.wenbronk.security.mapper.SysUserMapper
import org.springframework.security.core.GrantedAuthority
import org.springframework.security.core.authority.SimpleGrantedAuthority
import org.springframework.security.core.userdetails.User
import org.springframework.security.core.userdetails.UserDetails
import org.springframework.security.core.userdetails.UserDetailsService
import org.springframework.security.core.userdetails.UsernameNotFoundException
import org.springframework.stereotype.Service

import javax.inject.Inject
/**
* Created by wenbronk on 2017/8/15.
*/
@Service
class CustomUserService implements UserDetailsService {

@Inject
SysUserMapper sysUserMapper
@Inject
SysPermissionMapper sysPermissionMapper

@Override
UserDetails loadUserByUsername(String s) throws UsernameNotFoundException {
def sysUser = sysUserMapper.findByUserName(s) as SysUser
if (sysUser != null) {
List<SysPermission> permissions = sysPermissionMapper.findByAdminUserId(sysUser.getId())
List<GrantedAuthority> grantedAuthorities = new ArrayList<>()
permissions.each {permission ->
if (permission != null && permission.getName() != null) {
GrantedAuthority grantedAuthority = new SimpleGrantedAuthority(permission.getName())
// 此处将权限信息添加到 GrantedAuthority 对象中，在后面进行全权限验证时会使用GrantedAuthority 对象。
grantedAuthorities.add(grantedAuthority)
}
}
return new User(sysUser.getUsername(), sysUser.getPassword(), grantedAuthorities)
}else {
throw new UsernameNotFoundException('admin: ' + s + ' do not exits')
}
}
}

三: 页面部分

1, 页面转向config, 和上一篇的一样

@Configuration
class WebMvcConfig extends WebMvcConfigurerAdapter{

@Override
void addViewControllers(ViewControllerRegistry registry) {
registry.addViewController("/login").setViewName("login")
//        registry.addViewController("/home").setViewName("home")
}
}

2, 更改home.html

<!DOCTYPE html>
<html xmlns:th="http://www.thymeleaf.org"
xmlns:sec="http://www.thymeleaf.org/thymeleaf-extras-springsecurity4">
<head>
<meta content="text/html;charset=UTF-8"/>
<title sec:authentication="name"></title>
<link rel="stylesheet" th:href="@{css/bootstrap.min.css}" />
<style type="text/css">
body {
padding-top: 50px;
}
.starter-template {
padding: 40px 15px;
text-align: center;
}
</style>
</head>
<body>
<nav class="navbar navbar-inverse navbar-fixed-top">
<div class="container">
<div class="navbar-header">
<a class="navbar-brand" href="#">Spring Security演示</a>
</div>
<div id="navbar" class="collapse navbar-collapse">
<ul class="nav navbar-nav">
<li><a th:href="@{/}"> 首页 </a></li>
<li><a th:href="@{/admin}"> admin </a></li>
</ul>
</div><!--/.nav-collapse -->
</div>
</nav>

<div class="container">

<div class="starter-template">
<h1 th:text="${msg.title}"></h1>

<p class="bg-primary" th:text="${msg.content}"></p>

<div sec:authorize="hasRole('ROLE_HOME')"> <!-- 用户类型为ROLE_ADMIN 显示 -->
<p class="bg-info" th:text="${msg.etraInfo}"></p>
</div>

<div sec:authorize="hasRole('ROLE_ADMIN')"> <!-- 用户类型为 ROLE_USER 显示 -->
<p class="bg-info">恭喜, 有ROLE_ADMIN的权限</p>
</div>

<form th:action="@{/logout}" method="post">
<input type="submit" class="btn btn-primary" value="注销"/>
</form>
</div>

</div>
</body>

</html>

四, 密码进行加密

注意, 如果使用, 存储进数据库的密码也必须是同一个算法计算的密文

md5, 工具类

package com.wenbronk.security.tools

import java.security.MessageDigest

/**
* Created by wenbronk on 2017/8/17.
*/
class MD5Utils {
private static final String SALT = "tamboo";

public static String encode(String password) {
password = password + SALT;
MessageDigest md5 = null;
try {
md5 = MessageDigest.getInstance("MD5");
} catch (Exception e) {
throw new RuntimeException(e);
}
char[] charArray = password.toCharArray();
byte[] byteArray = new byte[charArray.length];

for (int i = 0; i < charArray.length; i++)
byteArray[i] = (byte) charArray[i];
byte[] md5Bytes = md5.digest(byteArray);
StringBuffer hexValue = new StringBuffer();
for (int i = 0; i < md5Bytes.length; i++) {
int val = ((int) md5Bytes[i]) & 0xff;
if (val < 16) {
hexValue.append("0");
}

hexValue.append(Integer.toHexString(val));
}
return hexValue.toString();
}

public static void main(String[] args) {
System.out.println(MD5Utils.encode("abel"));
}
}

2, 修改 webSecurityConfig的加密方法

@Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception {

auth.userDetailsService(customUserService()).passwordEncoder(new PasswordEncoder(){
@Override
public String encode(CharSequence rawPassword) {
return MD5Util.encode((String)rawPassword);
}

@Override
public boolean matches(CharSequence rawPassword, String encodedPassword) {
return encodedPassword.equals(MD5Util.encode((String)rawPassword));
}}); //user Details Service验证
}

BCrypt的强hash算法

BCrypt强哈希方法 每次加密的结果都不一样。但是存贮其中一次加密结果 也能够验证成功

1, 修改WebSecurityConfig

@Autowired
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
auth.userDetailsService(customUserService).passwordEncoder(new BCryptPasswordEncoder());
}

2, 进行加密

public SysUser create(User u　user){
//进行加密
BCryptPasswordEncoder encoder =new BCryptPasswordEncoder();
sysUser.setPassword(encoder.encode(user.getRawPassword().trim()));
userDao.create(user);
return sysUser;

原博客地址:

http://blog.csdn.net/u012373815/article/details/54633046

http://blog.csdn.net/u012373815/article/details/60465776