1：添加依赖：
<dependency> <groupId>org.thymeleaf.extras</groupId> <artifactId>thymeleaf-extras-springsecurity4</artifactId> </dependency> <dependency> <groupId>org.springframework.boot</groupId> <artifactId>spring-boot-starter-security</artifactId> </dependency>
2：创建验证service集成UserDetailService
package com.qingwenwei.security; import java.util.ArrayList; import java.util.List; import org.apache.logging.log4j.LogManager; import org.apache.logging.log4j.Logger; import org.springframework.beans.factory.annotation.Autowired; import org.springframework.security.core.authority.SimpleGrantedAuthority; import org.springframework.security.core.userdetails.UserDetails; import org.springframework.security.core.userdetails.UserDetailsService; import org.springframework.security.core.userdetails.UsernameNotFoundException; import com.qingwenwei.persistence.model.User; import com.qingwenwei.service.UserService; import org.springframework.stereotype.Service;
//授权认证
@Service public class MyUserDetailsService implements UserDetailsService{ Logger logger = LogManager.getLogger(MyUserDetailsService.class); @Autowired private UserService userService; @Override public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException { logger.debug("得到用户"); User user = this.userService.findByUsername(username); //加密之后的密码。才能进行下面的授权认证。 logger.debug(user.getUsername()+"密码"+user.getPassword()); //加密之后的密码。 if(null == user) { throw new UsernameNotFoundException("Can't find user by username: " + username); } List<SimpleGrantedAuthority> grantedAuthorities = new ArrayList<>(); // grant roles to user for (String role : user.getRolesSet()) { logger.debug(role); grantedAuthorities.add(new SimpleGrantedAuthority(role)); } // user.setGrantedAuthorities(authorities); //用于登录时 @AuthenticationPrincipal 标签取值 return new org.springframework.security.core.userdetails.User(user.getUsername(), user.getPassword(), grantedAuthorities); } }
3:进行配置
package com.qingwenwei.security; import org.springframework.beans.factory.annotation.Autowired; import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Configuration; import org.springframework.security.authentication.AuthenticationProvider; import org.springframework.security.authentication.dao.DaoAuthenticationProvider; import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder; import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity; import org.springframework.security.config.annotation.web.builders.HttpSecurity; import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity; import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter; import org.springframework.security.core.userdetails.UserDetailsService; import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder; @Configuration @EnableWebSecurity @EnableGlobalMethodSecurity(prePostEnabled=true) public class WebSecurityConfig extends WebSecurityConfigurerAdapter { @Bean public BCryptPasswordEncoder bCryptPasswordEncoder() { return new BCryptPasswordEncoder(); } @Autowired MyUserDetailsService myUserDetailsService; // @Bean // UserDetailsService myUserDetailsService() { // register userDetailsService // return new MyUserDetailsService(); // } @Bean public AuthenticationProvider authenticationProvider() { DaoAuthenticationProvider authenticationProvider = new DaoAuthenticationProvider(); // authenticationProvider.setUserDetailsService(this.myUserDetailsService()); authenticationProvider.setUserDetailsService(myUserDetailsService); authenticationProvider.setPasswordEncoder(this.bCryptPasswordEncoder()); return authenticationProvider; } @Autowired public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception { //全局配置 // auth.inMemoryAuthentication() //內存中存在的验证 // .withUser("t").password("t").roles("USER") // .and() // .withUser("admin").password("admin").roles("ADMIN"); auth.userDetailsService(myUserDetailsService).passwordEncoder(this.bCryptPasswordEncoder()); // auth.userDetailsService(myUserDetailsService).passwordEncoder(new BCryptPasswordEncoder()); // auth.authenticationProvider(this.authenticationProvider()); // different approach } @Override protected void configure(HttpSecurity http) throws Exception { http.csrf().disable() .authorizeRequests() .antMatchers("/user/settings").authenticated() // order matters .antMatchers("/", "/js/**", "/css/**","/avatar/**", "/images/**", "/fonts/**", "/bootstrap-select/**", "/bootstrap-datetimepicker/**", "/custom/**", "/daterangepicker/**", "/chartjs/**").permitAll() // these paths are configure not to require any authentication .antMatchers("/post/**").permitAll() // all posts are allowed to be viewed without authentication .antMatchers("/user/**").permitAll() // all user profiles are allowed to be viewed without authentication .antMatchers("/category/**").permitAll() // all categories are allowed to be viewed without authentication .antMatchers("/user/registration").permitAll() .antMatchers("/avatar/**").permitAll() // temp .antMatchers("/avatar1/**").permitAll() // temp .anyRequest().authenticated() // every request requires the user to be authenticated .and() .formLogin() .loginPage("/user/login") .permitAll() // login URL can be accessed by anyone .and() .logout() .invalidateHttpSession(true) .clearAuthentication(true) .logoutSuccessUrl("/?logout") .permitAll(); } }
4:userController.java
package com.qingwenwei.web.controller; import com.qingwenwei.exception.BadRequestException; import com.qingwenwei.exception.ResourceNotFoundException; import com.qingwenwei.persistence.model.User; import com.qingwenwei.service.UserService; import com.qingwenwei.util.NewUserFormValidator; import com.qingwenwei.web.dto.UserRegistrationDto; import com.qingwenwei.web.dto.UserSettingsDto; import org.apache.catalina.servlet4preview.http.HttpServletRequest; import org.apache.logging.log4j.LogManager; import org.apache.logging.log4j.Logger; import org.springframework.beans.factory.annotation.Autowired; import org.springframework.stereotype.Controller; import org.springframework.ui.Model; import org.springframework.validation.BindingResult; import org.springframework.web.bind.annotation.*; import javax.validation.Valid; import java.util.Map; @Controller public class UserController { Logger logger = LogManager.getLogger(UserController.class); // private static final Logger logger = LoggerFactory.getLogger(UserController.class); @Autowired private UserService userService; @Autowired private NewUserFormValidator userValidator; @RequestMapping(value = "/user/{userId}", method = RequestMethod.GET) public String showUserProfilePage(@RequestParam(value = "tab", required = false) String tabType, @PathVariable Long userId, Model model) { if (null == userId) { throw new BadRequestException("Path variable userId cound not be null."); } Map<String, Object> attributes = this.userService.getUserProfileAndPostsByUserIdByTabType(userId, tabType); if (null == attributes) { throw new ResourceNotFoundException("attributes not found."); } model.addAllAttributes(attributes); return "forum/user-profile"; } @RequestMapping(value = "/user/registration", method = RequestMethod.GET) public String showRegistrationPage(Model model) { model.addAttribute("userDto", new UserRegistrationDto()); return "forum/user-registration"; //注册页面 } @RequestMapping(value = "/user/registration", method = RequestMethod.POST) //提交注册 public String registerNewUser(@Valid @ModelAttribute("userDto") UserRegistrationDto userDto, BindingResult bindingResult, Model model, HttpServletRequest request) { /* * form validation, check username and email uniqueness */ this.userValidator.validate(userDto, bindingResult); if (bindingResult.hasErrors()) { logger.info("BindingResult has errors >> " + bindingResult.getFieldError()); return "forum/user-registration"; } logger.debug("注册"+userDto.getMatchingPassword()); Map<String, Object> attributes = this.userService.registerUserAccount(userDto, request); if (null == attributes) { throw new ResourceNotFoundException("attributes not found."); } model.addAllAttributes(attributes); return "forum/user-registration-result"; } @RequestMapping(value = "/user/login", method = RequestMethod.GET) public String displayLoginPage(Model model) { logger.debug("user/login登录"); model.addAttribute("title", "用户登陆"); return "forum/user-login"; //登录界面，验证没通过。 } @RequestMapping(value = "/user/login-success", method = RequestMethod.GET) public String showAdminPage() { logger.debug("登录成功"); return "forum/user-login"; // return "/"; } @RequestMapping(value = "/confirm", method = RequestMethod.GET) public String confirmRegistration(@RequestParam("token") String token) { return "forum/confirmation"; } @RequestMapping(value = "/confirm", method = RequestMethod.POST) public String processConfirmation() { return "forum/confirmation"; } @RequestMapping(value = "/user/settings", method = RequestMethod.GET) public String showUserSettingsPage(Model model) { Map<String, Object> attributes = this.userService.getUserSettingPage(); if (null == attributes) { throw new ResourceNotFoundException("attributes not found."); } model.addAllAttributes(attributes); return "forum/user-settings"; } @RequestMapping(value = "/user/settings", method = RequestMethod.POST) public String handleFileUpload(@ModelAttribute("userSettingsDto") UserSettingsDto userSettingsDto, Model model) { // User byConfirmationToken = userService.findByConfirmationToken(userSettingsDto.getPasswordConfirmation()); // logger.debug(byConfirmationToken.getPassword()); // logger.debug(userSettingsDto.getPassword()); if (null == userSettingsDto) { throw new BadRequestException("UserSettingsDto cound not be null."); } Map<String, Object> attributes = this.userService.updateUserProfile(userSettingsDto); if (null == attributes) { throw new ResourceNotFoundException("attributes not found."); } model.addAllAttributes(attributes); return "forum/user-settings"; } }
5:UserService.java UserServiceImpl.java
package com.qingwenwei.service; import com.qingwenwei.persistence.model.User; import com.qingwenwei.web.dto.UserRegistrationDto; import com.qingwenwei.web.dto.UserSettingsDto; import javax.servlet.http.HttpServletRequest; import java.util.Map; public interface UserService { int save(User user); User findById(Long id); User findByUsername(String username); User findByEmail(String email); User findByConfirmationToken(String confirmationToken); User findAuthenticatedUser(); Map<String, Object> getUserProfileAndPostsByUserIdByTabType(Long userId, String tabType); Map<String, Object> updateUserProfile(UserSettingsDto newUserSettingsForm); Map<String, Object> getUserSettingPage(); Map<String, Object> registerUserAccount(UserRegistrationDto userDto, HttpServletRequest request); }
package com.qingwenwei.service.impl; import com.qingwenwei.event.OnRegistrationCompleteEvent; import com.qingwenwei.persistence.dao.CommentMapper; import com.qingwenwei.persistence.dao.PostMapper; import com.qingwenwei.persistence.dao.UserMapper; import com.qingwenwei.persistence.model.Comment; import com.qingwenwei.persistence.model.Post; import com.qingwenwei.persistence.model.User; import com.qingwenwei.service.StorageService; import com.qingwenwei.service.UserService; import com.qingwenwei.web.dto.UserRegistrationDto; import com.qingwenwei.web.dto.UserSettingsDto; import org.apache.logging.log4j.LogManager; import org.springframework.beans.factory.annotation.Autowired; import org.springframework.context.ApplicationEventPublisher; import org.springframework.security.core.Authentication; import org.springframework.security.core.context.SecurityContextHolder; import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder; import org.springframework.stereotype.Service; import javax.servlet.http.HttpServletRequest; import java.sql.Timestamp; import java.util.*; @Service("userService") public class UserServiceImpl implements UserService { // private static final Logger logger = LoggerFactory.getLogger(UserServiceImpl.class); org.apache.logging.log4j.Logger logger = LogManager.getLogger(UserServiceImpl.class); @Autowired private UserMapper userMapper; @Autowired private PostMapper postMapper; @Autowired private CommentMapper commentMapper; // @Autowired // private VerificationTokenMapper verificationTokenMapper; @Autowired private StorageService storageService; @Autowired private BCryptPasswordEncoder bCryptPasswordEncoder; @Autowired private ApplicationEventPublisher evenPublisher; @Override public User findById(Long id) { return userMapper.findById(id); } @Override public User findByEmail(String email) { return userMapper.findByEmail(email); } @Override public User findByConfirmationToken(String confirmationToken) { return userMapper.findByConfirmationToken(confirmationToken); } @Override public User findByUsername(String username) { return userMapper.findByUsername(username); } @Override //重置密码 public int save(User user) { user.setPassword(bCryptPasswordEncoder.encode(user.getPassword())); //保存时应该将密码编码 return userMapper.save(user); } // @Override // public int save(User user) { // user.setPassword(user.getPassword()); // return userMapper.save(user); // } @Override public Map<String, Object> getUserProfileAndPostsByUserIdByTabType(Long userId, String tabType) { if (null == userId) { return null; } User user = this.userMapper.findById(userId); if (null == user) { return null; } Map<String, Object> attributes = new HashMap<>(); attributes.put("user", user); String activeTab = tabType == null ? "posts" : tabType; if ("posts".equalsIgnoreCase(activeTab)) { List<Post> posts = this.postMapper.findPostsByUserId(userId); attributes.put("posts", posts); } else if ("comments".equalsIgnoreCase(activeTab)) { List<Comment> comments = this.commentMapper.findCommentsByUserId(userId); attributes.put("comments", comments); } attributes.put("activeTab", activeTab); return attributes; } @Override public User findAuthenticatedUser() { Authentication auth = SecurityContextHolder.getContext().getAuthentication(); String username = auth.getName(); return this.userMapper.findByUsername(username); } /** * 更新用户profile * @param userSettingsDto * @return */ @Override public Map<String, Object> updateUserProfile(UserSettingsDto userSettingsDto) { Map<String, Object> attributes = new HashMap<>(); // String authenticatedUsername = this.findAuthenticatedUser().getUsername(); User authenticatedUser = this.findAuthenticatedUser(); String authenticatedUsername = authenticatedUser.getUsername(); String password = authenticatedUser.getPassword(); logger.debug("passward"+password); if (null == authenticatedUsername || authenticatedUsername.equalsIgnoreCase("") || null == userSettingsDto || userSettingsDto.getEmail().isEmpty() || userSettingsDto.getEmail().equals("")) { attributes.put("uploadResultMessage", "uploadFailure"); return attributes; } // update user profile User user = this.storageService.store(userSettingsDto.getAvatar(), authenticatedUsername); if (null == user) { attributes.put("uploadResultMessage", "uploadFailure"); user = this.findAuthenticatedUser(); // find authenticated user if no user found } user.setPassword(password); user.setEmail(userSettingsDto.getEmail()); user.setBio(userSettingsDto.getBio()); this.userMapper.update(user); // return attributes attributes.put("user", user); attributes.put("uploadResultMessage", "uploadSuccess"); return attributes; } @Override public Map<String, Object> getUserSettingPage() { User user = this.findAuthenticatedUser(); UserSettingsDto newUserSettingsForm = new UserSettingsDto(); newUserSettingsForm.setBio(user.getBio()); newUserSettingsForm.setEmail(user.getEmail()); Map<String, Object> attributes = new HashMap<>(); attributes.put("user", user); attributes.put("userSettingsDto", newUserSettingsForm); return attributes; } @Override public Map<String, Object> registerUserAccount(UserRegistrationDto userDto, HttpServletRequest request) { Map<String, Object> attributes = new HashMap<>(); // save newly registered user User user = new User(); user.setPassword(bCryptPasswordEncoder.encode(userDto.getPassword())); //保存时应该将密码编码 // user.setPassword(userDto.getPassword()); user.setUsername(userDto.getUsername()); user.setEmail(userDto.getEmail()); user.setDateCreated(new Timestamp(System.currentTimeMillis())); user.activated(true); user.setRoles(User.USER); user.setConfirmationToken(UUID.randomUUID().toString()); // save new user and get number of affected row logger.debug("用户注册"); int affectedRow = userMapper.save(user); logger.debug("用户注册成功"); // publish registration event String appUrl = "http://" + request.getServerName() + ":" + request.getServerPort(); Locale locale = request.getLocale(); OnRegistrationCompleteEvent event = new OnRegistrationCompleteEvent(user.getUsername(), appUrl, locale); this.evenPublisher.publishEvent(event); // populate attributes String registrationResult = affectedRow == 1 ? "success" : "failure"; attributes.put("userRegistrationResult", registrationResult); return attributes; } }
6:UserMapper.java
package com.qingwenwei.persistence.dao; import com.qingwenwei.persistence.model.User; import org.apache.ibatis.annotations.Mapper; import org.apache.ibatis.annotations.Param; import java.util.List; @Mapper public interface UserMapper { int save(@Param("user") User user); int update(@Param("user") User user); List<User> findAll(); User findById(Long id); User findByUsername(String username); User findByEmail(String email); User findByConfirmationToken(String confirmationToken); }
7;UserMapper.xml
<?xml version="1.0" encoding="UTF-8" ?> <!DOCTYPE mapper PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN" "http://mybatis.org/dtd/mybatis-3-mapper.dtd"> <mapper namespace="com.qingwenwei.persistence.dao.UserMapper"> <resultMap id="UserResultMap" type="com.qingwenwei.persistence.model.User"> <id property="id" column="id"/> <result property="username" column="username"/> <result property="password" column="password"/> <result property="email" column="email"/> <result property="confirmationToken" column="confirmation_token"/> <result property="activated" column="activated"/> <result property="dateCreated" column="date_created"/> <result property="avatarLocation" column="avatar_location"/> <result property="bio" column="bio"/> </resultMap> <sql id="baseColumns" > id, username, password, email, activated, date_created, avatar_location, bio，roles </sql> <insert id="save" parameterType="com.qingwenwei.persistence.model.User"> INSERT INTO `T_USER` ( username, password, email, confirmation_token, activated, date_created, avatar_location, bio, roles ) VALUES ( #{user.username}, #{user.password}, #{user.email}, #{user.confirmationToken}, #{user.activated}, #{user.dateCreated}, #{user.avatarLocation}, #{user.bio}, #{user.roles} ) </insert> <select id="findById" parameterType="Long" resultMap="UserResultMap"> SELECT id, username, password, email, activated, date_created, avatar_location, bio, roles FROM T_USER WHERE id = #{id} </select> <select id="findByUsername" parameterType="String" resultMap="UserResultMap"> SELECT id, username, password, email, activated, date_created, avatar_location, bio, roles FROM T_USER WHERE username = #{username} </select> <select id="findByEmail" parameterType="String" resultMap="UserResultMap"> SELECT id, username, password, email, activated, date_created, avatar_location, bio, roles FROM T_USER WHERE email = #{email} </select> <select id="findByConfirmationToken" parameterType="String" resultMap="UserResultMap"> SELECT id, username, password, email, activated, date_created, avatar_location, bio, confirmation_token, roles FROM T_USER WHERE confirmation_token = #{confirmationToken} </select> <select id="findAll" resultMap="UserResultMap"> SELECT id, username, password, email, activated, date_created, avatar_location, bio, confirmation_token, roles FROM T_USER </select> <update id="update" parameterType="com.qingwenwei.persistence.model.User"> UPDATE T_USER SET password = #{user.password}, email = #{user.email}, date_created = #{user.dateCreated}, avatar_location = #{user.avatarLocation}, bio = #{user.bio} WHERE id = #{user.id} </update> </mapper>
8;User.java
package com.qingwenwei.persistence.model; import java.io.Serializable; import java.sql.Timestamp; import java.util.Arrays; import java.util.Collections; import java.util.HashSet; import java.util.Set; public class User implements Serializable { private static final long serialVersionUID = 1L; // constants public static String USER = "USER"; //两种用户 public static String ADMIN = "ADMIN"; private Long id; private String username; private String password; private String email; private String confirmationToken; private Long activated; private Timestamp dateCreated; private String avatarLocation; private String bio; private String roles; public User() { } public Long getId() { return id; } public void setId(Long id) { this.id = id; } public String getUsername() { return username; } public void setUsername(String userName) { this.username = userName; } public String getPassword() { return password; } public void setPassword(String password) { this.password = password; } public String getEmail() { return email; } public void setEmail(String email) { this.email = email; } public String getConfirmationToken() { return confirmationToken; } public void setConfirmationToken(String confirmationToken) { this.confirmationToken = confirmationToken; } public Long getActivated() { return activated; } public void setActivated(Long activated) { this.activated = activated; } public static void setUSER(String USER) { User.USER = USER; } public static void setADMIN(String ADMIN) { User.ADMIN = ADMIN; } public static long getSerialVersionUID() { return serialVersionUID; } public static String getUSER() { return USER; } public static String getADMIN() { return ADMIN; } public Timestamp getDateCreated() { return dateCreated; } public void setDateCreated(Timestamp dateCreated) { this.dateCreated = dateCreated; } public String getAvatarLocation() { return avatarLocation; } public void setAvatarLocation(String avatarLocation) { this.avatarLocation = avatarLocation; } public String getBio() { return bio; } public void setBio(String bio) { this.bio = bio; } public String getRoles() { return roles; } public void setRoles(String roles) { this.roles = roles; } //赋予该用户的角色 public Set<String> getRolesSet() { if (null == roles) { return null; } return Collections.unmodifiableSet( new HashSet<String>(Arrays.asList(getRoles().split(",")))); } public void addRole(String role) { String currRoles = this.getRoles(); if (null == currRoles || this.getRoles().contains(role)) { return; } this.setRoles(currRoles + "," + role); } public void activated(boolean activated) { this.setActivated(activated == true ? 1L : 0L); } @Override public String toString() { return "User [id=" + id + ", username=" + username + ", password=" + password + ", email=" + email + ", confirmationToken=" + confirmationToken + ", activated=" + activated + ", dateCreated=" + dateCreated + ", avatarLocation=" + avatarLocation + ", bio=" + bio + ", roles=" + roles + "]"; } }
9：配置成功。