Spring Boot安全管理_spring-boot-starter-security

一.Spring Security快速⼊⻔

1.添加security启动器

<!-- Spring Security 提供的安全管理依赖启动器 -->

<dependency>

<groupId> org.springframework.boot </groupId>

<artifactId> spring-boot-starter-security </artifactId>

</dependency>

项⽬启动测试

 这种默认安全管理⽅式存在诸多问题。例如，只有唯⼀的默认登录⽤户user，密码随机⽣成且过于暴露、登录⻚⾯ 及错误提示⻚⾯不是我们想要的等。

1.MVC Security安全配置介绍

1.下⾯我们通过Spring Security API查看WebSecurityConfigurerAdapter的主要⽅法，具体如下表

@EnableWebSecurity // 开启MVC Security安全⽀持
public class SecurityConfig extends WebSecurityConfigurerAdapter {
 
//定制基于HTTP请求的⽤户访问控制
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        super.configure(http);
    }
//定制⽤户认证管理器来实现⽤户认证
    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        super.configure(auth);
    }
}

 4 ⾃定义⽤户认证

        1.In-Memory Authentication：内存身份认证

        2.JDBC Authentication：JDBC身份认证

        3.UserDetailsService：身份详情服务

        4.LDAP Authentication：LDAP身份认证

        5.AuthenticationProvider：身份认证提供商

4.1.2 使⽤内存进⾏身份认证   写一个配置类即可

package com.cy.config;
import
org.springframework.security.config.annotation.authentication.builders.AuthenticationMa
nagerBuilder;
import
org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import
org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerA
dapter;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
/**
* MVC Security管理配置的⾃定义WebSecurityConfigurerAdapter类
*/
@EnableWebSecurity // 开启MVC Security安全⽀持
public class SecurityConfig extends WebSecurityConfigurerAdapter {
 /** ⽤户身份认证⾃定义配置 */
 @Override
 protected void configure(AuthenticationManagerBuilder auth) throws Exception {
 // 密码需要设置编码器
 BCryptPasswordEncoder encoder = new BCryptPasswordEncoder();
 // 1.使⽤内存⽤户信息，作为测试使⽤(设置⽤户名、密码和⻆⾊)
 auth.inMemoryAuthentication().passwordEncoder(encoder)
.withUser("tom").password(encoder.encode("123456")).roles("common")
 .and()
 .withUser("李四").password(encoder.encode("123456")).roles("vip");
 }
}

4.3 UserDetailsService身份认证

1.1.在项⽬的pom.xml⽂件中添加Mybaits依赖启动器和lombok依赖。

<dependency>
    <groupId>com.baomidou</groupId>
    <artifactId>mybatis-plus-boot-starter</artifactId>
    <version>3.5.2</version>
</dependency>

<dependency>

<groupId> org.projectlombok </groupId>

<artifactId> lombok </artifactId>

</dependency>

package com.example.demo.service.imp;
 
import com.example.demo.pojo.Authority;
import com.example.demo.pojo.Customer;
import com.example.demo.service.CustomerService;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.core.authority.SimpleGrantedAuthority;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.core.userdetails.UsernameNotFoundException;
import org.springframework.stereotype.Service;
import java.util.List;
import java.util.stream.Collectors;
/** ⾃定义⼀个UserDetailsService接⼝实现类进⾏⽤户认证信息封装 */
@Service
public class UserDetailsServiceImpl implements UserDetailsService {
    @Autowired
    /* 内有提供自定义用户查询和权限查询的方法
    * getCustomer  根据名字查询用户信息 的方法
    * 
    * getCustomerAuthority  根据名字查询用户权限 的方法
    * */
    
    private CustomerService customerService;
    @Override
    public UserDetails loadUserByUsername(String username) throws
            UsernameNotFoundException {
        // 通过业务⽅法获取⽤户及权限信息
        Customer customer = customerService.getCustomer(username);
        List<Authority> authorities = customerService.getCustomerAuthority(username);
        // 对⽤户权限进⾏封装
        List<SimpleGrantedAuthority> list = authorities.stream().map(authority -> new
                SimpleGrantedAuthority(authority.getAuthority())).collect(Collectors.toList());
        // 返回封装的UserDetails⽤户详情类
        if (customer != null) {
            UserDetails userDetails = new User(customer.getUsername(),
                    customer.getPassword(), list);
            return userDetails;
        } else {
            // 如果查询的⽤户不存在（⽤户名不存在），必须抛出此异常
            throw new UsernameNotFoundException("当前⽤户不存在！");
        }}}

package com.example.demo.config;
 
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.WebSecurityConfigurer;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.web.authentication.rememberme.JdbcTokenRepositoryImpl;
 
import javax.sql.DataSource;
import java.util.Date;
import java.util.HashMap;
 
//开启安全管理的支持
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {
    @Autowired //Hikari连接池，自动将mysql配置信息加载连接池对象上
    private DataSource dataSource;
    //1.用户身份认证的配置
    @Autowired
    private UserDetailsService userDetailsService;
 
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests() // 开启基于HttpServletRequest请求访问的限制
                .antMatchers("/").permitAll() // 开启Ant⻛格的路径匹配。⽆条件对请求进⾏放⾏
                .antMatchers("/login/**").permitAll()
                .antMatchers("/detail/common/**").hasRole("common") // 匹配⽤户是否有某⼀个⻆⾊
                .antMatchers("/detail/vip/**").hasRole("vip")
                .anyRequest().authenticated()// 匹配任何请求。匹配已经登录认证的⽤户
                .and() // 功能连接符
                .formLogin(); // 开启基于表单的⽤户登录
              http.formLogin() // 开启基于表单的⽤户登录
                // ⽤户登录⻚⾯跳转路径，默认为get请求的/login。⽆条件对请求进⾏放⾏
                .loginPage("/userLogin").permitAll()
                .usernameParameter("name") // 登录⽤户的⽤户名参数， 默认为username
                .passwordParameter("pwd") // 登录⽤户的密码参数，默认为password
                .defaultSuccessUrl("/") // ⽤户直接登录后默认跳转地址
                .failureUrl("/userLogin?error"); // ⽤户登录失败后的跳转地址，默认为/login?erro
        // ⾃定义⽤户退出控制
        http.logout()
                .logoutUrl("/mylogout")
                .logoutSuccessUrl("/");
 
        // 定制Remember-me记住我功能
        http.rememberMe()
                .rememberMeParameter("rememberme")
                .tokenValiditySeconds(200)
                // 对Cookie信息进⾏持久化管理
                .tokenRepository(tokenRepository());
    }
 
    @Bean
    /** 持久化Token存储 */
    public JdbcTokenRepositoryImpl tokenRepository() {
        JdbcTokenRepositoryImpl jti = new JdbcTokenRepositoryImpl();
        jti.setDataSource(dataSource);
        //自动创建数据库表字段
        jti.setCreateTableOnStartup(true);
        return jti;
    }
    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        // 密码需要设置编码器
        BCryptPasswordEncoder encoder = new BCryptPasswordEncoder();
 
        auth.userDetailsService(userDetailsService).passwordEncoder(encoder);
 
    }
    }
 

完成以上配置基于内存进⾏身份认证  就结束了

接下来是配置的信息

以上就是一些比较常用的配置信息