SpringSecurity动态配置权限

一、数据库表添加数据

二、代码

package com.example.pojo;

import java.io.Serializable;
import java.util.List;

public class Menu implements Serializable {
    private Integer id;//            `id` int(10) unsigned NOT NULL AUTO_INCREMENT,
    private String url;//  `url` varchar(64) CHARACTER SET utf8 COLLATE utf8_unicode_ci NOT NULL DEFAULT '' COMMENT '请求路径规则',
    private String path;//            `path` varchar(64) DEFAULT NULL COMMENT '路由path',
    private String component;//            `component` varchar(64) DEFAULT NULL COMMENT '组件英文名称',
    private String name;//            `name` varchar(64) DEFAULT NULL COMMENT '组件中文名称',
    private String iconCls;//            `iconCls` varchar(64) DEFAULT NULL COMMENT '菜单图标',
    private Boolean keepAlive;//            `keepAlive` tinyint(1) NOT NULL DEFAULT '0' COMMENT '菜单切换时是否保活',
    private Boolean requireAuth;//            `requireAuth` tinyint(1) NOT NULL DEFAULT '0' COMMENT '是否登录后才能访问',
    private Integer pid;//            `pid` int(10) unsigned DEFAULT NULL COMMENT '父菜单Id',
    private Boolean enabled;//            `enabled` tinyint(1) NOT NULL DEFAULT '1' COMMENT '是否可用',
    private List<Role> roles;

    public Integer getId() {
        return id;
    }

    public void setId(Integer id) {
        this.id = id;
    }

    public String getUrl() {
        return url;
    }

    public void setUrl(String url) {
        this.url = url;
    }

    public String getPath() {
        return path;
    }

    public void setPath(String path) {
        this.path = path;
    }

    public String getComponent() {
        return component;
    }

    public void setComponent(String component) {
        this.component = component;
    }

    public String getName() {
        return name;
    }

    public void setName(String name) {
        this.name = name;
    }

    public String getIconCls() {
        return iconCls;
    }

    public void setIconCls(String iconCls) {
        this.iconCls = iconCls;
    }

    public Boolean getKeepAlive() {
        return keepAlive;
    }

    public void setKeepAlive(Boolean keepAlive) {
        this.keepAlive = keepAlive;
    }

    public Boolean getRequireAuth() {
        return requireAuth;
    }

    public void setRequireAuth(Boolean requireAuth) {
        this.requireAuth = requireAuth;
    }

    public Integer getPid() {
        return pid;
    }

    public void setPid(Integer pid) {
        this.pid = pid;
    }

    public Boolean getEnabled() {
        return enabled;
    }

    public void setEnabled(Boolean enabled) {
        this.enabled = enabled;
    }

    public List<Role> getRoles() {
        return roles;
    }

    public void setRoles(List<Role> roles) {
        this.roles = roles;
    }
}

package com.example.mapper;

import com.example.pojo.Menu;

import java.util.List;

public interface MenuMapper {
    List<Menu> getAllMenus();
}

<?xml version="1.0" encoding="UTF-8" ?>
<!DOCTYPE mapper
        PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
        "http://mybatis.org/dtd/mybatis-3-mapper.dtd">
<mapper namespace="com.example.mapper.MenuMapper">
    <resultMap id="BaseResultMap" type="com.example.pojo.Menu">
        <id property="id" column="id"/>
        <result property="url" column="url"/>
        <collection property="roles" ofType="com.example.pojo.Role">
            <id property="id" column="rid"/>
            <result property="nameEn" column="rnameEn"/>
            <result property="nameCn" column="rnameCn"/>
        </collection>
    </resultMap>

    <select id="getAllMenus" resultMap="BaseResultMap">
        select m.*,r.id as rid,r.nameEn as rnameEn,r.nameCn as rnameCn
            from menu m
                left join menu_role mr on m.id=mr.mid
                left join role r on mr.rid=r.id
    </select>
</mapper>

package com.example.security;


import com.example.mapper.MenuMapper;
import com.example.pojo.Menu;
import com.example.pojo.Role;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.access.ConfigAttribute;
import org.springframework.security.access.SecurityConfig;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.web.FilterInvocation;
import org.springframework.security.web.access.intercept.FilterInvocationSecurityMetadataSource;
import org.springframework.stereotype.Component;
import org.springframework.util.AntPathMatcher;

import javax.annotation.Resource;
import java.util.Collection;
import java.util.List;

@Component
public class DemoFilterInvocationSecurityMetadataSource
        implements FilterInvocationSecurityMetadataSource {
    private static final Logger logger = LoggerFactory.getLogger(WebSecurityConfigurerAdapter.class);
    AntPathMatcher antPathMatcher = new AntPathMatcher();//用来实现ant风格的url匹配
//    @Autowired
    @Resource
    MenuMapper menuMapper;

    /**
     *
     * @param object
     * @return Collection<ConfigAttribute>:请求当前url所需要的角色
     * @throws IllegalArgumentException
     */
    @Override
    public Collection<ConfigAttribute> getAttributes(Object object)
            throws IllegalArgumentException {
        String requestUrl = ((FilterInvocation) object).getRequestUrl();//提取当前请求的url
        List<Menu> allMenus = menuMapper.getAllMenus();//从数据库中获取Menu相关信息，也可以保存到缓存再从缓存（Redis）获取
        for (Menu menu : allMenus) {//遍历获取访问当前url所需要的所有角色，将它们返回
            if (antPathMatcher.match(menu.getUrl(), requestUrl)) {
                List<Role> roles = menu.getRoles();
                String[] roleArr = new String[roles.size()];
                for (int i = 0; i < roleArr.length; i++) {
                    roleArr[i] = roles.get(i).getNameEn();
                }
                logger.info("=====DemoFilterInvocationSecurityMetadataSource=======roleArr==="+roleArr.toString());
                return SecurityConfig.createList(roleArr);
            }
        }
        logger.info("=====DemoFilterInvocationSecurityMetadataSource=======ROLE_LOGIN===");
        return SecurityConfig.createList("ROLE_LOGIN");//请求的url在数据库表中不存在相应模式，就假设该请求登录即可访问，直接返回 ROLE_LOGIN
    }
    @Override
    public Collection<ConfigAttribute> getAllConfigAttributes() {
        return null;
    }
    @Override
    public boolean supports(Class<?> clazz) {
        return FilterInvocation.class.isAssignableFrom(clazz);
    }
}

package com.example.security;

import org.springframework.security.access.AccessDecisionManager;
import org.springframework.security.access.AccessDeniedException;
import org.springframework.security.access.ConfigAttribute;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.stereotype.Component;

import java.util.Collection;

@Component
public class DemoAccessDecisionManager
        implements AccessDecisionManager {
    //判断当前登录用户是否具有请示当前url所需要的角色，如不具备抛出异常，具备则不做任何操作
    @Override
    public void decide(Authentication auth,//auth:当前用户登录信息
                       Object object,//FilterInvocation 对象，可以获取当前请求的对象
                       Collection<ConfigAttribute> ca){//FilterInvocationSecurityMetadataSource中getAttributes()返回值，即当前url所需要的角色
        Collection<? extends GrantedAuthority> auths = auth.getAuthorities();
        for (ConfigAttribute configAttribute : ca) {
            if ("ROLE_LOGIN".equals(configAttribute.getAttribute())//如果需要的角色是ROLE_LOGIN，说明当前url是登录登录即可访问的url
                    && auth instanceof UsernamePasswordAuthenticationToken) {////如果auth是UsernamePasswordAuthenticationToken实例，说明当前用户已经登录
                return;
            }
            for (GrantedAuthority authority : auths) {
                if (configAttribute.getAttribute().equals(authority.getAuthority())) {
                    return;
                }
            }
        }
        throw new AccessDeniedException("权限不足");
    }

    @Override
    public boolean supports(ConfigAttribute attribute) {
        return true;
    }

    @Override
    public boolean supports(Class<?> clazz) {
        return true;
    }
}

package com.example.security;

import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.ObjectPostProcessor;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.builders.WebSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.authority.AuthorityUtils;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.core.userdetails.UsernameNotFoundException;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.web.access.intercept.FilterSecurityInterceptor;
import org.springframework.security.web.authentication.SavedRequestAwareAuthenticationSuccessHandler;
import org.springframework.security.web.authentication.logout.LogoutSuccessHandler;

import javax.annotation.Resource;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;

@Configuration
@EnableWebSecurity
public class DemoSecurityConfig extends WebSecurityConfigurerAdapter {
    private static final Logger logger = LoggerFactory.getLogger(WebSecurityConfigurerAdapter.class);

    @Autowired
    DemoUserDetailsService demoUserDetailsService;

    @Bean
    public PasswordEncoder passwordEncoder(){
//        return NoOpPasswordEncoder.getInstance();
        return new BCryptPasswordEncoder();
    }

    @Bean
    DemoFilterInvocationSecurityMetadataSource dfisms() {
        return new DemoFilterInvocationSecurityMetadataSource();
    }
    @Bean
    DemoAccessDecisionManager dadm() {
        return new DemoAccessDecisionManager();
    }

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
//        auth.userDetailsService(userService);
        auth.userDetailsService(demoUserDetailsService);
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        logger.info("==============configure==================================");
//        super.configure(http);
        http.csrf().disable();
//        http.authorizeRequests() //对请求进行授权
////                .antMatchers("/login").permitAll()
////                .antMatchers("/admin/**").hasRole("admin")
////                .antMatchers("/db/**").hasRole("dba")
////                .antMatchers("/user/**").hasRole("user")
//                .anyRequest() //任何请求
//                .authenticated()//都要进行身份认证
//                .and()
//                .formLogin()//表单登录
//                .loginPage("/login")//登录页面
//                .loginProcessingUrl("/login")
//                .permitAll();//和登录相关的接口都不需要认证即可访问

        http.authorizeRequests()
                .withObjectPostProcessor(new ObjectPostProcessor<FilterSecurityInterceptor>() {
                    @Override
                    public <O extends FilterSecurityInterceptor> O postProcess(O object) {
                        object.setSecurityMetadataSource(dfisms());
                        object.setAccessDecisionManager(dadm());
                        return object;
                    }
                })
                .anyRequest() //任何请求
                .authenticated()//都要进行身份认证
                .and()
                .formLogin()//表单登录
                .loginPage("/login")//登录页面
//                .loginProcessingUrl("/login")
                .permitAll();//和登录相关的接口都不需要认证即可访问

//        http.authorizeRequests().
//                antMatchers("/static/**").permitAll().anyRequest().authenticated().
//                and().formLogin().loginPage("/login").permitAll().successHandler(loginSuccessHandler()).
//                and().logout().permitAll().invalidateHttpSession(true).
//                deleteCookies("JSESSIONID").logoutSuccessHandler(logoutSuccessHandler()).
//                and().sessionManagement().maximumSessions(10).expiredUrl("/login");

    }

    //======================================================================

    /**
     * 配置忽略的静态文件，不加的话，登录之前页面的css,js不能正常使用，得登录之后才能正常.
     */
    @Override
    public void configure(WebSecurity web) throws Exception {
        // 忽略URL
        web.ignoring().antMatchers("/**/*.js", "/lang/*.json", "/**/*.css", "/**/*.js", "/**/*.map", "/**/*.html",
                "/**/*.png");
    }

    @Bean
    public LogoutSuccessHandler logoutSuccessHandler() { //登出处理
        return new LogoutSuccessHandler() {
            @Override
            public void onLogoutSuccess(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, Authentication authentication) throws IOException, ServletException {

            }
//            @Override
//            public void onLogoutSuccess(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, Authentication authentication) throws IOException, ServletException {
//                try {
//                    SecurityUser user = (SecurityUser) authentication.getPrincipal();
////                    logger.info("USER : " + user.getUsername() + " LOGOUT SUCCESS !  ");
//                } catch (Exception e) {
////                    logger.info("LOGOUT EXCEPTION , e : " + e.getMessage());
//                }
//                httpServletResponse.sendRedirect("/login");
//            }
        };
    }

    @Bean
    public SavedRequestAwareAuthenticationSuccessHandler loginSuccessHandler() { //登入处理
        return new SavedRequestAwareAuthenticationSuccessHandler() {
            @Override
            public void onAuthenticationSuccess(HttpServletRequest request, HttpServletResponse response, Authentication authentication) throws IOException, ServletException {
                User userDetails = (User) authentication.getPrincipal();
                logger.info("USER : " + userDetails.getUsername() + " LOGIN SUCCESS !  ");
                super.onAuthenticationSuccess(request, response, authentication);
            }
        };
    }

//    @Bean
//    UserDetailsService demoUserDetailsService() {
//        return new DemoUserDetailsService();
//    }

    @Bean
    public UserDetailsService userDetailsService() {    //用户登录实现

//        return new DemoUserDetailsService();
        return new UserDetailsService() {
            //            @Override
//            public UserDetails loadUserByUsername(String s) throws UsernameNotFoundException {
//                return null;
//            }
//            @Autowired
//            private UserRepository userRepository;
            @Resource
            private PasswordEncoder passwordEncoder;

            @Override
            public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
                logger.info("=-======loadUserByUsername======-=-========d================"+username);
//                User user = userRepository.findByUsername(s);
//                if (user == null) throw new UsernameNotFoundException("Username " + s + " not found");
//                return new SecurityUser(user);
                return new User(username,passwordEncoder.encode("123456"),
                        true,true,true,true,
                        AuthorityUtils.commaSeparatedStringToAuthorityList("admin"));
            }
        };
    }

//    @Autowired
//    public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
//        auth.userDetailsService(userDetailsService()).passwordEncoder(passwordEncoder());
//        auth.eraseCredentials(false);
//    }
}