Spring boot Security 用于权限管理,用户添加等。

        <dependency>

        <groupId>org.thymeleaf.extras</groupId>

        <artifactId>thymeleaf-extras-springsecurity4</artifactId>

    </dependency>

        <dependency>

            <groupId>org.springframework.boot</groupId>

            <artifactId>spring-boot-starter-security</artifactId>

        </dependency>

package com.qingwenwei.security;

import java.util.ArrayList;

import java.util.List;

import org.apache.logging.log4j.LogManager;

import org.apache.logging.log4j.Logger;

import org.springframework.beans.factory.annotation.Autowired;

import org.springframework.security.core.authority.SimpleGrantedAuthority;

import org.springframework.security.core.userdetails.UserDetails;

import org.springframework.security.core.userdetails.UserDetailsService;

import org.springframework.security.core.userdetails.UsernameNotFoundException;

import com.qingwenwei.persistence.model.User;

import com.qingwenwei.service.UserService;

import org.springframework.stereotype.Service;


//授权认证

@Service

public class MyUserDetailsService implements UserDetailsService{

    Logger logger = LogManager.getLogger(MyUserDetailsService.class);

    @Autowired

    private UserService userService;

    @Override

    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {

        logger.debug("得到用户");

        User user = this.userService.findByUsername(username);      //加密之后的密码。才能进行下面的授权认证。

        logger.debug(user.getUsername()+"密码"+user.getPassword());  //加密之后的密码。

        if(null == user) {

            throw new UsernameNotFoundException("Can't find user by username: " + username);

        }

        List<SimpleGrantedAuthority> grantedAuthorities = new ArrayList<>();

        // grant roles to user

        for (String role : user.getRolesSet()) {

            logger.debug(role);

            grantedAuthorities.add(new SimpleGrantedAuthority(role));

        }

//        user.setGrantedAuthorities(authorities); //用于登录时 @AuthenticationPrincipal 标签取值

        return new org.springframework.security.core.userdetails.User(user.getUsername(), user.getPassword(), grantedAuthorities);

    }

}

package com.qingwenwei.security;

import org.springframework.beans.factory.annotation.Autowired;

import org.springframework.context.annotation.Bean;

import org.springframework.context.annotation.Configuration;

import org.springframework.security.authentication.AuthenticationProvider;

import org.springframework.security.authentication.dao.DaoAuthenticationProvider;

import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;

import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;

import org.springframework.security.config.annotation.web.builders.HttpSecurity;

import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;

import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;

import org.springframework.security.core.userdetails.UserDetailsService;

import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;

@Configuration

@EnableWebSecurity

@EnableGlobalMethodSecurity(prePostEnabled=true)

public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

    @Bean

    public BCryptPasswordEncoder bCryptPasswordEncoder() {

        return new BCryptPasswordEncoder();

    }

    @Autowired

    MyUserDetailsService myUserDetailsService;

//    @Bean

//    UserDetailsService myUserDetailsService() { // register userDetailsService

//        return new MyUserDetailsService();

//    }

    @Bean

    public AuthenticationProvider authenticationProvider() {

        DaoAuthenticationProvider authenticationProvider = new DaoAuthenticationProvider();

//        authenticationProvider.setUserDetailsService(this.myUserDetailsService());

        authenticationProvider.setUserDetailsService(myUserDetailsService);

        authenticationProvider.setPasswordEncoder(this.bCryptPasswordEncoder());

        return authenticationProvider;

    }

    @Autowired

    public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {  //全局配置

//        auth.inMemoryAuthentication()  //內存中存在的验证

//                .withUser("t").password("t").roles("USER")

//                .and()

//                .withUser("admin").password("admin").roles("ADMIN");

        auth.userDetailsService(myUserDetailsService).passwordEncoder(this.bCryptPasswordEncoder());

//        auth.userDetailsService(myUserDetailsService).passwordEncoder(new BCryptPasswordEncoder());

//        auth.authenticationProvider(this.authenticationProvider()); // different approach

    }

    @Override

    protected void configure(HttpSecurity http) throws Exception {

        http.csrf().disable()

                .authorizeRequests()

                .antMatchers("/user/settings").authenticated() // order matters

                .antMatchers("/", "/js/**", "/css/**","/avatar/**", "/images/**", "/fonts/**", "/bootstrap-select/**", "/bootstrap-datetimepicker/**", "/custom/**", "/daterangepicker/**", "/chartjs/**").permitAll() // these paths are configure not to require any authentication

                .antMatchers("/post/**").permitAll() // all posts are allowed to be viewed without authentication

                .antMatchers("/user/**").permitAll() // all user profiles are allowed to be viewed without authentication

                .antMatchers("/category/**").permitAll() // all categories are allowed to be viewed without authentication

                .antMatchers("/user/registration").permitAll()

                .antMatchers("/avatar/**").permitAll() // temp

                .antMatchers("/avatar1/**").permitAll() // temp

            .anyRequest().authenticated() // every request requires the user to be authenticated

                    .and()

            .formLogin()

                .loginPage("/user/login")

                .permitAll() // login URL can be accessed by anyone

                .and()

            .logout()

                .invalidateHttpSession(true)

                .clearAuthentication(true)

                .logoutSuccessUrl("/?logout")

                .permitAll();

    }

}

package com.qingwenwei.web.controller;

import com.qingwenwei.exception.BadRequestException;

import com.qingwenwei.exception.ResourceNotFoundException;

import com.qingwenwei.persistence.model.User;

import com.qingwenwei.service.UserService;

import com.qingwenwei.util.NewUserFormValidator;

import com.qingwenwei.web.dto.UserRegistrationDto;

import com.qingwenwei.web.dto.UserSettingsDto;

import org.apache.catalina.servlet4preview.http.HttpServletRequest;

import org.apache.logging.log4j.LogManager;

import org.apache.logging.log4j.Logger;

import org.springframework.beans.factory.annotation.Autowired;

import org.springframework.stereotype.Controller;

import org.springframework.ui.Model;

import org.springframework.validation.BindingResult;

import org.springframework.web.bind.annotation.*;

import javax.validation.Valid;

import java.util.Map;

@Controller

public class UserController {

    Logger logger = LogManager.getLogger(UserController.class);

//    private static final Logger logger = LoggerFactory.getLogger(UserController.class);

    @Autowired

    private UserService userService;

    @Autowired

    private NewUserFormValidator userValidator;

    @RequestMapping(value = "/user/{userId}", method = RequestMethod.GET)

    public String showUserProfilePage(@RequestParam(value = "tab", required = false) String tabType,

            @PathVariable Long userId, Model model) {

        if (null == userId) {

            throw new BadRequestException("Path variable userId cound not be null.");

        }

        Map<String, Object> attributes = this.userService.getUserProfileAndPostsByUserIdByTabType(userId, tabType);

        if (null == attributes) {

            throw new ResourceNotFoundException("attributes not found.");

        }

        model.addAllAttributes(attributes);

        return "forum/user-profile";

    }

    @RequestMapping(value = "/user/registration", method = RequestMethod.GET)

    public String showRegistrationPage(Model model) {

        model.addAttribute("userDto", new UserRegistrationDto());

        return "forum/user-registration";  //注册页面

    }

    @RequestMapping(value = "/user/registration", method = RequestMethod.POST)  //提交注册

    public String registerNewUser(@Valid @ModelAttribute("userDto") UserRegistrationDto userDto,

            BindingResult bindingResult, Model model, HttpServletRequest request) {

        /*

         * form validation, check username and email uniqueness

         */

        this.userValidator.validate(userDto, bindingResult);

        if (bindingResult.hasErrors()) {

                logger.info("BindingResult has errors >> " + bindingResult.getFieldError());

                return "forum/user-registration";

        }

        logger.debug("注册"+userDto.getMatchingPassword());

        Map<String, Object> attributes = this.userService.registerUserAccount(userDto, request);

        if (null == attributes) {

            throw new ResourceNotFoundException("attributes not found.");

        }

        model.addAllAttributes(attributes);

        return "forum/user-registration-result";

    }

    @RequestMapping(value = "/user/login", method = RequestMethod.GET)

    public String displayLoginPage(Model model) {

        logger.debug("user/login登录");

        model.addAttribute("title", "用户登陆");

        return "forum/user-login"; //登录界面，验证没通过。

    }

    @RequestMapping(value = "/user/login-success", method = RequestMethod.GET)

    public String showAdminPage() {

        logger.debug("登录成功");

        return "forum/user-login";

//        return "/";

    }

    @RequestMapping(value = "/confirm", method = RequestMethod.GET)

    public String confirmRegistration(@RequestParam("token") String token) {

        return "forum/confirmation";

    }

    @RequestMapping(value = "/confirm", method = RequestMethod.POST)

    public String processConfirmation() {

        return "forum/confirmation";

    }

    @RequestMapping(value = "/user/settings", method = RequestMethod.GET)

    public String showUserSettingsPage(Model model) {

        Map<String, Object> attributes = this.userService.getUserSettingPage();

        if (null == attributes) {

            throw new ResourceNotFoundException("attributes not found.");

        }

        model.addAllAttributes(attributes);

        return "forum/user-settings";

    }

    @RequestMapping(value = "/user/settings", method = RequestMethod.POST)

    public String handleFileUpload(@ModelAttribute("userSettingsDto") UserSettingsDto userSettingsDto, Model model) {

//        User byConfirmationToken = userService.findByConfirmationToken(userSettingsDto.getPasswordConfirmation());

//        logger.debug(byConfirmationToken.getPassword());

//        logger.debug(userSettingsDto.getPassword());

        if (null == userSettingsDto) {

            throw new BadRequestException("UserSettingsDto cound not be null.");

        }

        Map<String, Object> attributes = this.userService.updateUserProfile(userSettingsDto);

        if (null == attributes) {

            throw new ResourceNotFoundException("attributes not found.");

        }

        model.addAllAttributes(attributes);

        return "forum/user-settings";

    }

}

package com.qingwenwei.service;

import com.qingwenwei.persistence.model.User;

import com.qingwenwei.web.dto.UserRegistrationDto;

import com.qingwenwei.web.dto.UserSettingsDto;

import javax.servlet.http.HttpServletRequest;

import java.util.Map;

public interface UserService {

    int save(User user);

    User findById(Long id);

    User findByUsername(String username);

    User findByEmail(String email);

    User findByConfirmationToken(String confirmationToken);

    User findAuthenticatedUser();

    Map<String, Object> getUserProfileAndPostsByUserIdByTabType(Long userId, String tabType);

    Map<String, Object> updateUserProfile(UserSettingsDto newUserSettingsForm);

    Map<String, Object> getUserSettingPage();

    Map<String, Object> registerUserAccount(UserRegistrationDto userDto, HttpServletRequest request);

}

package com.qingwenwei.service.impl;

import com.qingwenwei.event.OnRegistrationCompleteEvent;

import com.qingwenwei.persistence.dao.CommentMapper;

import com.qingwenwei.persistence.dao.PostMapper;

import com.qingwenwei.persistence.dao.UserMapper;

import com.qingwenwei.persistence.model.Comment;

import com.qingwenwei.persistence.model.Post;

import com.qingwenwei.persistence.model.User;

import com.qingwenwei.service.StorageService;

import com.qingwenwei.service.UserService;

import com.qingwenwei.web.dto.UserRegistrationDto;

import com.qingwenwei.web.dto.UserSettingsDto;

import org.apache.logging.log4j.LogManager;

import org.springframework.beans.factory.annotation.Autowired;

import org.springframework.context.ApplicationEventPublisher;

import org.springframework.security.core.Authentication;

import org.springframework.security.core.context.SecurityContextHolder;

import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;

import org.springframework.stereotype.Service;

import javax.servlet.http.HttpServletRequest;

import java.sql.Timestamp;

import java.util.*;

@Service("userService")

public class UserServiceImpl implements UserService {

    //    private static final Logger logger = LoggerFactory.getLogger(UserServiceImpl.class);

    org.apache.logging.log4j.Logger logger = LogManager.getLogger(UserServiceImpl.class);

    @Autowired

    private UserMapper userMapper;

    @Autowired

    private PostMapper postMapper;

    @Autowired

    private CommentMapper commentMapper;

//    @Autowired

//    private VerificationTokenMapper verificationTokenMapper;

    @Autowired

    private StorageService storageService;

    @Autowired

    private BCryptPasswordEncoder bCryptPasswordEncoder;

    @Autowired

    private ApplicationEventPublisher evenPublisher;

    @Override

    public User findById(Long id) {

        return userMapper.findById(id);

    }

    @Override

    public User findByEmail(String email) {

        return userMapper.findByEmail(email);

    }

    @Override

    public User findByConfirmationToken(String confirmationToken) {

        return userMapper.findByConfirmationToken(confirmationToken);

    }

    @Override

    public User findByUsername(String username) {

        return userMapper.findByUsername(username);

    }

    @Override  //重置密码

    public int save(User user) {

        user.setPassword(bCryptPasswordEncoder.encode(user.getPassword()));  //保存时应该将密码编码

        return userMapper.save(user);

    }

//    @Override

//    public int save(User user) {

//        user.setPassword(user.getPassword());

//        return userMapper.save(user);

//    }

    @Override

    public Map<String, Object> getUserProfileAndPostsByUserIdByTabType(Long userId, String tabType) {

        if (null == userId) {

            return null;

        }

        User user = this.userMapper.findById(userId);

        if (null == user) {

            return null;

        }

        Map<String, Object> attributes = new HashMap<>();

        attributes.put("user", user);

        String activeTab = tabType == null ? "posts" : tabType;

        if ("posts".equalsIgnoreCase(activeTab)) {

            List<Post> posts = this.postMapper.findPostsByUserId(userId);

            attributes.put("posts", posts);

        } else if ("comments".equalsIgnoreCase(activeTab)) {

            List<Comment> comments = this.commentMapper.findCommentsByUserId(userId);

            attributes.put("comments", comments);

        }

        attributes.put("activeTab", activeTab);

        return attributes;

    }

    @Override

    public User findAuthenticatedUser() {

        Authentication auth = SecurityContextHolder.getContext().getAuthentication();

        String username = auth.getName();

        return this.userMapper.findByUsername(username);

    }

    /**

     * 更新用户profile

     * @param userSettingsDto

     * @return

     */

    @Override

    public Map<String, Object> updateUserProfile(UserSettingsDto userSettingsDto) {

        Map<String, Object> attributes = new HashMap<>();

//        String authenticatedUsername = this.findAuthenticatedUser().getUsername();

        User authenticatedUser = this.findAuthenticatedUser();

        String authenticatedUsername = authenticatedUser.getUsername();

        String password = authenticatedUser.getPassword();

        logger.debug("passward"+password);

        if (null == authenticatedUsername || authenticatedUsername.equalsIgnoreCase("")

                || null == userSettingsDto

                || userSettingsDto.getEmail().isEmpty()

                || userSettingsDto.getEmail().equals("")) {

            attributes.put("uploadResultMessage", "uploadFailure");

            return attributes;

        }

        // update user profile

        User user = this.storageService.store(userSettingsDto.getAvatar(), authenticatedUsername);

        if (null == user) {

            attributes.put("uploadResultMessage", "uploadFailure");

            user = this.findAuthenticatedUser(); // find authenticated user if no user found

        }

        user.setPassword(password);

        user.setEmail(userSettingsDto.getEmail());

        user.setBio(userSettingsDto.getBio());

        this.userMapper.update(user);

        // return attributes

        attributes.put("user", user);

        attributes.put("uploadResultMessage", "uploadSuccess");

        return attributes;

    }

    @Override

    public Map<String, Object> getUserSettingPage() {

        User user = this.findAuthenticatedUser();

        UserSettingsDto newUserSettingsForm = new UserSettingsDto();

        newUserSettingsForm.setBio(user.getBio());

        newUserSettingsForm.setEmail(user.getEmail());

        Map<String, Object> attributes = new HashMap<>();

        attributes.put("user", user);

        attributes.put("userSettingsDto", newUserSettingsForm);

        return attributes;

    }

    @Override

    public Map<String, Object> registerUserAccount(UserRegistrationDto userDto, HttpServletRequest request) {

        Map<String, Object> attributes = new HashMap<>();

        // save newly registered user

        User user = new User();

        user.setPassword(bCryptPasswordEncoder.encode(userDto.getPassword()));  //保存时应该将密码编码

//        user.setPassword(userDto.getPassword());

        user.setUsername(userDto.getUsername());

        user.setEmail(userDto.getEmail());

        user.setDateCreated(new Timestamp(System.currentTimeMillis()));

        user.activated(true);

        user.setRoles(User.USER);

        user.setConfirmationToken(UUID.randomUUID().toString());

        // save new user and get number of affected row

        logger.debug("用户注册");

        int affectedRow = userMapper.save(user);

        logger.debug("用户注册成功");

        // publish registration event

        String appUrl = "http://" + request.getServerName() + ":" + request.getServerPort();

        Locale locale = request.getLocale();

        OnRegistrationCompleteEvent event = new OnRegistrationCompleteEvent(user.getUsername(), appUrl, locale);

        this.evenPublisher.publishEvent(event);

        // populate attributes

        String registrationResult = affectedRow == 1 ? "success" : "failure";

        attributes.put("userRegistrationResult", registrationResult);

        return attributes;

    }

}

package com.qingwenwei.persistence.dao;

import com.qingwenwei.persistence.model.User;

import org.apache.ibatis.annotations.Mapper;

import org.apache.ibatis.annotations.Param;

import java.util.List;

@Mapper

public interface UserMapper {

    int save(@Param("user") User user);

    int update(@Param("user") User user);

    List<User> findAll();

    User findById(Long id);

    User findByUsername(String username);

    User findByEmail(String email);

    User findByConfirmationToken(String confirmationToken);

}

<?xml version="1.0" encoding="UTF-8" ?>

<!DOCTYPE mapper PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN" "http://mybatis.org/dtd/mybatis-3-mapper.dtd">

<mapper namespace="com.qingwenwei.persistence.dao.UserMapper">

    <resultMap id="UserResultMap" type="com.qingwenwei.persistence.model.User">

        <id property="id" column="id"/>

        <result property="username" column="username"/>

        <result property="password" column="password"/>

        <result property="email" column="email"/>

        <result property="confirmationToken" column="confirmation_token"/>

        <result property="activated" column="activated"/>

        <result property="dateCreated" column="date_created"/>

        <result property="avatarLocation" column="avatar_location"/>

        <result property="bio" column="bio"/>

    </resultMap>

    <sql id="baseColumns" >

        id, username, password, email, activated, date_created, avatar_location, bio，roles

    </sql>

    <insert id="save" parameterType="com.qingwenwei.persistence.model.User">

        INSERT INTO `T_USER`

            (

            username,

            password,

            email,

            confirmation_token,

            activated,

            date_created,

            avatar_location,

            bio,

            roles

            )

        VALUES

            (

            #{user.username},

            #{user.password},

            #{user.email},

            #{user.confirmationToken},

            #{user.activated},

            #{user.dateCreated},

            #{user.avatarLocation},

            #{user.bio},

            #{user.roles}

            )

    </insert>

    <select id="findById" parameterType="Long" resultMap="UserResultMap">

        SELECT

            id,

            username,

            password,

            email,

            activated,

            date_created,

            avatar_location,

            bio,

            roles

        FROM T_USER

        WHERE id = #{id}

    </select>

    <select id="findByUsername" parameterType="String" resultMap="UserResultMap">

        SELECT

            id,

            username,

            password,

            email,

            activated,

            date_created,

            avatar_location,

            bio,

            roles

        FROM T_USER

        WHERE username = #{username}

    </select>

    <select id="findByEmail" parameterType="String" resultMap="UserResultMap">

        SELECT

            id,

            username,

            password,

            email,

            activated,

            date_created,

            avatar_location,

            bio,

            roles

        FROM T_USER

        WHERE email = #{email}

    </select>

    <select id="findByConfirmationToken" parameterType="String" resultMap="UserResultMap">

        SELECT

            id,

            username,

            password,

            email,

            activated,

            date_created,

            avatar_location,

            bio,

            confirmation_token,

            roles

        FROM T_USER

        WHERE confirmation_token = #{confirmationToken}

    </select>

    <select id="findAll" resultMap="UserResultMap">

        SELECT

            id,

            username,

            password,

            email,

            activated,

            date_created,

            avatar_location,

            bio,

            confirmation_token,

            roles

        FROM T_USER

    </select>

    <update id="update" parameterType="com.qingwenwei.persistence.model.User">

        UPDATE T_USER SET

            password = #{user.password},

            email = #{user.email},

            date_created = #{user.dateCreated},

            avatar_location = #{user.avatarLocation},

            bio = #{user.bio}

        WHERE id = #{user.id}

    </update>    

</mapper>

package com.qingwenwei.persistence.model;

import java.io.Serializable;

import java.sql.Timestamp;

import java.util.Arrays;

import java.util.Collections;

import java.util.HashSet;

import java.util.Set;

public class User implements Serializable {

    private static final long serialVersionUID = 1L;

    // constants

    public static String USER = "USER";  //两种用户

    public static String ADMIN = "ADMIN";

    private Long id;

    private String username;

    private String password;

    private String email;

    private String confirmationToken;

    private Long activated;

    private Timestamp dateCreated;

    private String avatarLocation;

    private String bio;

    private String roles;

    public User() {

    }

    public Long getId() {

        return id;

    }

    public void setId(Long id) {

        this.id = id;

    }

    public String getUsername() {

        return username;

    }

    public void setUsername(String userName) {

        this.username = userName;

    }

    public String getPassword() {

        return password;

    }

    public void setPassword(String password) {

        this.password = password;

    }

    public String getEmail() {

        return email;

    }

    public void setEmail(String email) {

        this.email = email;

    }

    public String getConfirmationToken() {

        return confirmationToken;

    }

    public void setConfirmationToken(String confirmationToken) {

        this.confirmationToken = confirmationToken;

    }

    public Long getActivated() {

        return activated;

    }

    public void setActivated(Long activated) {

        this.activated = activated;

    }

    public static void setUSER(String USER) {

        User.USER = USER;

    }

    public static void setADMIN(String ADMIN) {

        User.ADMIN = ADMIN;

    }

    public static long getSerialVersionUID() {

        return serialVersionUID;

    }

    public static String getUSER() {

        return USER;

    }

    public static String getADMIN() {

        return ADMIN;

    }

    public Timestamp getDateCreated() {

        return dateCreated;

    }

    public void setDateCreated(Timestamp dateCreated) {

        this.dateCreated = dateCreated;

    }

    public String getAvatarLocation() {

        return avatarLocation;

    }

    public void setAvatarLocation(String avatarLocation) {

        this.avatarLocation = avatarLocation;

    }

    public String getBio() {

        return bio;

    }

    public void setBio(String bio) {

        this.bio = bio;

    }

    public String getRoles() {

        return roles;

    }

    public void setRoles(String roles) {

        this.roles = roles;

    }  //赋予该用户的角色

    public Set<String> getRolesSet() {

        if (null == roles) {

            return null;

        }

        return Collections.unmodifiableSet(

                new HashSet<String>(Arrays.asList(getRoles().split(","))));

    }

    public void addRole(String role) {

        String currRoles = this.getRoles();

        if (null == currRoles || this.getRoles().contains(role)) {

            return;

        }

        this.setRoles(currRoles + "," + role);

    }

    public void activated(boolean activated) {

        this.setActivated(activated == true ? 1L : 0L);

    }

    @Override

    public String toString() {

        return "User [id=" + id + ", username=" + username + ", password=" + password + ", email=" + email

                + ", confirmationToken=" + confirmationToken + ", activated=" + activated + ", dateCreated="

                + dateCreated + ", avatarLocation=" + avatarLocation + ", bio=" + bio + ", roles=" + roles + "]";

    }

}