spring实战-Spring-security权限认证白名单

第九篇：spring实战-Spring-security权限认证白名单

当我们为程序设置权限认证时，主要是希望能够保护需要保护的功能，并不是说所有的功能都需要被保护起来，比如说系统主页，帮助中心等等

此时我们可以通过白名单的方式，让某些功能对未登录用户公开，Spring-security提供了对固定路径，或者模糊匹配路径的保护

1，在SecurityConfig中重载configure函数

package com.halfworlders.idat.config;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.core.io.ClassPathResource;
import org.springframework.core.io.Resource;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.web.authentication.rememberme.InMemoryTokenRepositoryImpl;

import com.halfworlders.idat.security.IdatUserDetailsService;
import com.halfworlders.idat.security.SecurityWhitelistHandler;
import com.halfworlders.idat.service.Userservice;

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

@Autowired
private Userservice userservice;

@Autowired
private SecurityWhitelistHandler whitelistHandler;

@Bean
public static Resource securityWhitelistResource() {
return new ClassPathResource("/security_whitelist.properties");
}

@Override
protected void configure(HttpSecurity http) throws Exception {
// 通过requiresChannel()来设置请求是否需要安全通道
// 如果request后面使用requiresSecure()，spring
// security回视为请求需要安全通道，并自动把请求重定向到https上
// 如果request后面使用requiresInsecure()，spring security回视为请求不需要安全http通道
// http.requiresChannel().anyRequest().requiresSecure();

whitelistHandler.handle(http)
.authorizeRequests().anyRequest().authenticated()
.and()
.formLogin();
}

@Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception {

/*
* 最好的是基于UserDetailService的接口方式，这样spring-security并不知道系统通过什么样的方式来实现用户数据验证
* 开发人员可以在接口内以任意方式实现，增加了系统的灵活性
*/
auth.userDetailsService(new IdatUserDetailsService(userservice));
}
}

用来定义如何保护路径的配置方法有：





2，构建白名单操作类

package com.halfworlders.idat.security;

import java.util.Collection;
import java.util.Properties;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.core.io.Resource;
import org.springframework.core.io.support.PropertiesLoaderUtils;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.stereotype.Component;

@Component
public class SecurityWhitelistHandler {

@Autowired
private Resource securityWhitelistResource;

public HttpSecurity handle(HttpSecurity http) throws Exception {
Properties props = PropertiesLoaderUtils.loadProperties(securityWhitelistResource);
Collection<Object> values = props.values();
String[] liString = new String[values.size()];
values.toArray(liString);
return http
.authorizeRequests()
.regexMatchers(liString)
.permitAll()
.and();
}
}

3，白名单配置文件security_whitelist.properties

home=/home
login=/home/login*
regist=/home/regist*
help=/help

此时，就可以保证/home，/home/login
a0fe
*，/home/regis*，/help页面不需要登录，就可以访问