springboot-29-security(二)用户角色权限控制

/*
Navicat MySQL Data Transfer
Source Server : 本地
Source Host : localhost:3306
Source Database : test
Target Server Type : MYSQL
Date: 2017-8-14 22:17:33
*/SET FOREIGN_KEY_CHECKS=;-- ----------------------------
-- Table structure for `sys_user`
-- ----------------------------
DROP TABLE IF EXISTS `sys_user`;
CREATE TABLE `sys_user` (
`id` INT () NOT NULL AUTO_INCREMENT COMMENT '主键id',
`username` varchar() DEFAULT NULL COMMENT '用户名',
`password` varchar() DEFAULT NULL COMMENT '密码',
PRIMARY KEY (`id`)
) ENGINE=InnoDB AUTO_INCREMENT= DEFAULT CHARSET=utf8;-- ----------------------------
-- Table structure for `sys_role`
-- ----------------------------
DROP TABLE IF EXISTS `sys_role`;
CREATE TABLE `sys_role` (
`id` INT () NOT NULL AUTO_INCREMENT COMMENT '主键id',
`name` varchar() DEFAULT NULL COMMENT '用户名',
PRIMARY KEY (`id`)
) ENGINE=InnoDB AUTO_INCREMENT= DEFAULT CHARSET=utf8;-- ----------------------------
-- Table structure for `sys_permission`
-- ----------------------------
DROP TABLE IF EXISTS `sys_permission`;
CREATE TABLE `sys_permission` (
`id` INT () NOT NULL AUTO_INCREMENT COMMENT '主键id',
`name` varchar() DEFAULT NULL COMMENT '用户名',
`desc` VARCHAR () DEFAULT NULL COMMENT '描述',
`url` VARCHAR () DEFAULT NULL COMMENT 'url',
`pid` INT (),
PRIMARY KEY (`id`)
) ENGINE=InnoDB AUTO_INCREMENT= DEFAULT CHARSET=utf8;-- ----------------------------
-- Table structure for `sys_role_user`
-- ----------------------------
DROP TABLE IF EXISTS `sys_role_user`;
CREATE TABLE `sys_role_user` (
`id` bigint() NOT NULL AUTO_INCREMENT COMMENT '主键id',
`sys_user_id` INT() NOT NULL COMMENT 'user_id',
`sys_role_id` INT() NOT NULL COMMENT 'role_id',
PRIMARY KEY (`id`)
) ENGINE=InnoDB AUTO_INCREMENT= DEFAULT CHARSET=utf8;ALTER TABLE sys_role_user ADD CONSTRAINT sys_FK1 FOREIGN KEY(sys_user_id) REFERENCES sys_user(id);
ALTER TABLE sys_role_user ADD CONSTRAINT role_FK2 FOREIGN KEY(sys_role_id) REFERENCES sys_role(id);-- ----------------------------
-- Table structure for `sys_permission_role`
-- ----------------------------
DROP TABLE IF EXISTS `sys_permission_role`;
CREATE TABLE `sys_permission_role` (
`id` bigint() NOT NULL AUTO_INCREMENT COMMENT '主键id',
`sys_role_id` INT() NOT NULL COMMENT 'role_id',
`sys_permission_id` INT() NOT NULL COMMENT 'permission_id',
PRIMARY KEY (`id`)
) ENGINE=InnoDB AUTO_INCREMENT= DEFAULT CHARSET=utf8;
ALTER TABLE sys_permission_role ADD CONSTRAINT sys_FK3 FOREIGN KEY(sys_role_id) REFERENCES sys_role(id);
ALTER TABLE sys_permission_role ADD CONSTRAINT role_FK4 FOREIGN KEY(sys_permission_id) REFERENCES sys_permission(id);

insert into SYS_USER (id,username, password) values (,'vini', '');
insert into SYS_USER (id,username, password) values (,'bronk', '');insert into SYS_ROLE(id,name) values(,'ROLE_ADMIN');
insert into SYS_ROLE(id,name) values(,'ROLE_USER');insert into SYS_ROLE_USER(SYS_USER_ID,sys_role_id) values(,);
insert into SYS_ROLE_USER(SYS_USER_ID,sys_role_id) values(,);BEGIN;
INSERT INTO `sys_permission` VALUES ('', 'ROLE_HOME', 'home', '/', null),
('', 'ROLE_ADMIN', 'ABel', '/admin', null);
COMMIT;BEGIN;
INSERT INTO `sys_permission_role` VALUES ('', '', ''), ('', '', ''), ('', '', '');
COMMIT;

package com.wenbronk.security.entity/**
* Created by wenbronk on 2017/8/17.
*/
class SysPermission {
int id
String name
String desc
String url
int pid
}

http.addFilterBefore(myFilterSecurityInterceptor, FilterSecurityInterceptor.class)

package com.wenbronk.security.security.configimport com.wenbronk.security.security.interceptor.MyFilterSecurityInterceptor
import com.wenbronk.security.security.service.CustomUserService
import org.springframework.beans.factory.annotation.Autowired
import org.springframework.context.annotation.Configuration
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder
import org.springframework.security.config.annotation.web.builders.HttpSecurity
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter
import org.springframework.security.web.access.intercept.FilterSecurityInterceptorimport javax.inject.Inject
/**
* Created by wenbronk on 2017/8/15.
*/
@Configuration
@EnableWebSecurity
class WebSecurityConfig extends WebSecurityConfigurerAdapter { @Inject
CustomUserService customUserService;
@Autowired
MyFilterSecurityInterceptor myFilterSecurityInterceptor @Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
auth.userDetailsService(customUserService);
} @Override
protected void configure(HttpSecurity http) throws Exception {
http.authorizeRequests()
.anyRequest().authenticated() // 任何请求都拦截
.and()
.formLogin()
.loginPage("/login")
.failureUrl("/login?error")
.permitAll() // 登陆后可访问任意页面
.and()
.logout().permitAll(); // 注销后任意访问
http.addFilterBefore(myFilterSecurityInterceptor, FilterSecurityInterceptor.class)
}
}

package com.wenbronk.security.security.interceptorimport com.wenbronk.security.security.config.MyAccessDecisonManager
import org.springframework.beans.factory.annotation.Autowired
import org.springframework.security.access.SecurityMetadataSource
import org.springframework.security.access.intercept.AbstractSecurityInterceptor
import org.springframework.security.access.intercept.InterceptorStatusToken
import org.springframework.security.web.FilterInvocation
import org.springframework.security.web.access.intercept.FilterInvocationSecurityMetadataSource
import org.springframework.stereotype.Componentimport javax.inject.Inject
import javax.servlet.*/**
* Created by wenbronk on 2017/8/17.
*/
@Component
class MyFilterSecurityInterceptor extends AbstractSecurityInterceptor implements Filter { @Inject
FilterInvocationSecurityMetadataSource securityMetadataSource @Autowired
public void setMyAccessDecisionManager(MyAccessDecisonManager myAccessDecisonManager) {
super.setAccessDecisionManager(myAccessDecisonManager)
} @Override
void init(FilterConfig filterConfig) throws ServletException { } /**
* fi中有一个被拦截的url
* 里面调用MyInvocationSecurityMetadataSource的getAttributes(Object object)这个方法获取fi对应的所有权限
//再调用MyAccessDecisionManager的decide方法来校验用户的权限是否足够
*/
@Override
void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
FilterInvocation fi = new FilterInvocation(request, response, chain)
invoke(fi)
} void invoke(FilterInvocation filterInvocation) {
InterceptorStatusToken token = super.beforeInvocation(filterInvocation)
try {
filterInvocation.getChain().doFilter(filterInvocation.getRequest(), filterInvocation.getResponse())
} finally {
super.afterInvocation(token, null)
}
} @Override
void destroy() { } @Override
Class<?> getSecureObjectClass() {
return FilterInvocation.class
} @Override
SecurityMetadataSource obtainSecurityMetadataSource() {
return this.securityMetadataSource
}
}

package com.wenbronk.security.security.serviceimport com.wenbronk.security.entity.SysPermission
import com.wenbronk.security.mapper.SysPermissionMapper
import org.springframework.security.access.ConfigAttribute
import org.springframework.security.access.SecurityConfig
import org.springframework.security.web.FilterInvocation
import org.springframework.security.web.access.intercept.FilterInvocationSecurityMetadataSource
import org.springframework.security.web.util.matcher.AntPathRequestMatcher
import org.springframework.stereotype.Serviceimport javax.inject.Inject
import javax.servlet.http.HttpServletRequest/**
* Created by wenbronk on 2017/8/17.
*/
@Service
class MyInvocationSecurityMetadataSourceService implements FilterInvocationSecurityMetadataSource{ @Inject
SysPermissionMapper sysPermissionMapper /**
* 此方法是为了判定用户请求的url 是否在权限表中，
* 如果在权限表中，则返回给 decide 方法，用来判定用户是否有此权限。如果不在权限表中则放行。
*/
@Override
Collection<ConfigAttribute> getAttributes(Object o) throws IllegalArgumentException {
Map<String, Collection<ConfigAttribute>> map = loadResourceDefine()
HttpServletRequest request = ((FilterInvocation) o).getHttpRequest()
map.each {entry ->
AntPathRequestMatcher matcher = new AntPathRequestMatcher(entry.getKey())
if (matcher.matches(request)) {
// 匹配, 返回给decide方法
return entry.getValue()
}
}
return null
} /**
* 加载权限表中所有的权限
*/
public Map<String, Collection<ConfigAttribute>> loadResourceDefine() {
Map<String, Collection<ConfigAttribute>> map = new HashMap<>()
List<SysPermission> permissions = sysPermissionMapper.findAll()
permissions.each {permission ->
List<ConfigAttribute> array = new ArrayList<>()
// 此处只添加了用户的名字，其实还可以添加更多权限的信息，例如请求方法到ConfigAttribute的集合中去。
// 此处添加的信息将会作为MyAccessDecisionManager类的decide的第三个参数。
ConfigAttribute cfg = new SecurityConfig(permission.getName())
array.add(cfg)
// 用权限的url作为key, 权限的名称集合为value
map.put(permission.getUrl(), array);
} return null
} @Override
Collection<ConfigAttribute> getAllConfigAttributes() {
return null
} @Override
boolean supports(Class<?> aClass) {
return true
}
}

package com.wenbronk.security.security.configimport org.springframework.security.access.AccessDecisionManager
import org.springframework.security.access.AccessDeniedException
import org.springframework.security.access.ConfigAttribute
import org.springframework.security.authentication.InsufficientAuthenticationException
import org.springframework.security.core.Authentication
import org.springframework.stereotype.Service/**
* Created by wenbronk on 2017/8/17.
*/
@Service
class MyAccessDecisonManager implements AccessDecisionManager { /**
* 判断是否拥有权限的决策方法
* authentication 是CustomUserService中循环添加到 GrantedAuthority 对象中的权限信息集合.
* object 包含客户端发起的请求的requset信息，可转换为 HttpServletRequest request = ((FilterInvocation) object).getHttpRequest();
* configAttributes 为MyInvocationSecurityMetadataSource的getAttributes(Object object)这个方法返回的结果，
*/
@Override
void decide(Authentication authentication, Object o, Collection<ConfigAttribute> configAttributes) throws AccessDeniedException, InsufficientAuthenticationException {
if (null == configAttributes || configAttributes.size() <= )
return
configAttributes.each {configAttribute ->
String needRole = configAttribute.getAttribute()
authentication.getAuthorities().each {authority ->
if (needRole.trim().equals(authority.getAuthority()))
return
}
}
throw new java.nio.file.AccessDeniedException('no right')
} @Override
boolean supports(ConfigAttribute configAttribute) {
return true
} @Override
boolean supports(Class<?> aClass) {
return true
}
}

package com.wenbronk.security.security.serviceimport com.wenbronk.security.entity.SysPermission
import com.wenbronk.security.entity.SysUser
import com.wenbronk.security.mapper.SysPermissionMapper
import com.wenbronk.security.mapper.SysUserMapper
import org.springframework.security.core.GrantedAuthority
import org.springframework.security.core.authority.SimpleGrantedAuthority
import org.springframework.security.core.userdetails.User
import org.springframework.security.core.userdetails.UserDetails
import org.springframework.security.core.userdetails.UserDetailsService
import org.springframework.security.core.userdetails.UsernameNotFoundException
import org.springframework.stereotype.Serviceimport javax.inject.Inject
/**
* Created by wenbronk on 2017/8/15.
*/
@Service
class CustomUserService implements UserDetailsService { @Inject
SysUserMapper sysUserMapper
@Inject
SysPermissionMapper sysPermissionMapper @Override
UserDetails loadUserByUsername(String s) throws UsernameNotFoundException {
def sysUser = sysUserMapper.findByUserName(s) as SysUser
if (sysUser != null) {
List<SysPermission> permissions = sysPermissionMapper.findByAdminUserId(sysUser.getId())
List<GrantedAuthority> grantedAuthorities = new ArrayList<>()
permissions.each {permission ->
if (permission != null && permission.getName() != null) {
GrantedAuthority grantedAuthority = new SimpleGrantedAuthority(permission.getName())
// 此处将权限信息添加到 GrantedAuthority 对象中，在后面进行全权限验证时会使用GrantedAuthority 对象。
grantedAuthorities.add(grantedAuthority)
}
}
return new User(sysUser.getUsername(), sysUser.getPassword(), grantedAuthorities)
}else {
throw new UsernameNotFoundException('admin: ' + s + ' do not exits')
}
}
}

@Configuration
class WebMvcConfig extends WebMvcConfigurerAdapter{ @Override
void addViewControllers(ViewControllerRegistry registry) {
registry.addViewController("/login").setViewName("login")
// registry.addViewController("/home").setViewName("home")
}
}

<!DOCTYPE html>
<html xmlns:th="http://www.thymeleaf.org"
xmlns:sec="http://www.thymeleaf.org/thymeleaf-extras-springsecurity4">
<head>
<meta content="text/html;charset=UTF-8"/>
<title sec:authentication="name"></title>
<link rel="stylesheet" th:href="@{css/bootstrap.min.css}" />
<style type="text/css">
body {
padding-top: 50px;
}
.starter-template {
padding: 40px 15px;
text-align: center;
}
</style>
</head>
<body>
<nav class="navbar navbar-inverse navbar-fixed-top">
<div class="container">
<div class="navbar-header">
<a class="navbar-brand" href="#">Spring Security演示</a>
</div>
<div id="navbar" class="collapse navbar-collapse">
<ul class="nav navbar-nav">
<li><a th:href="@{/}"> 首页 </a></li>
<li><a th:href="@{/admin}"> admin </a></li>
</ul>
</div><!--/.nav-collapse -->
</div>
</nav> <div class="container"> <div class="starter-template">
<h1 th:text="${msg.title}"></h1> <p class="bg-primary" th:text="${msg.content}"></p> <div sec:authorize="hasRole('ROLE_HOME')"> <!-- 用户类型为ROLE_ADMIN 显示 -->
<p class="bg-info" th:text="${msg.etraInfo}"></p>
</div> <div sec:authorize="hasRole('ROLE_ADMIN')"> <!-- 用户类型为 ROLE_USER 显示 -->
<p class="bg-info">恭喜, 有ROLE_ADMIN的权限</p>
</div> <form th:action="@{/logout}" method="post">
<input type="submit" class="btn btn-primary" value="注销"/>
</form>
</div> </div>
</body></html>

package com.wenbronk.security.toolsimport java.security.MessageDigest/**
* Created by wenbronk on 2017/8/17.
*/
class MD5Utils {
private static final String SALT = "tamboo"; public static String encode(String password) {
password = password + SALT;
MessageDigest md5 = null;
try {
md5 = MessageDigest.getInstance("MD5");
} catch (Exception e) {
throw new RuntimeException(e);
}
char[] charArray = password.toCharArray();
byte[] byteArray = new byte[charArray.length]; for (int i = ; i < charArray.length; i++)
byteArray[i] = (byte) charArray[i];
byte[] md5Bytes = md5.digest(byteArray);
StringBuffer hexValue = new StringBuffer();
for (int i = ; i < md5Bytes.length; i++) {
int val = ((int) md5Bytes[i]) & 0xff;
if (val < ) {
hexValue.append("");
} hexValue.append(Integer.toHexString(val));
}
return hexValue.toString();
} public static void main(String[] args) {
System.out.println(MD5Utils.encode("abel"));
}
}

@Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
auth.userDetailsService(customUserService()).passwordEncoder(new PasswordEncoder(){
@Override
public String encode(CharSequence rawPassword) {
return MD5Util.encode((String)rawPassword);
} @Override
public boolean matches(CharSequence rawPassword, String encodedPassword) {
return encodedPassword.equals(MD5Util.encode((String)rawPassword));
}}); //user Details Service验证
}

@Autowired
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
auth.userDetailsService(customUserService).passwordEncoder(new BCryptPasswordEncoder());
}

public SysUser create(User uuser){
//进行加密
BCryptPasswordEncoder encoder =new BCryptPasswordEncoder();
sysUser.setPassword(encoder.encode(user.getRawPassword().trim()));
userDao.create(user);
return sysUser;