Spring Security的认证和授权

if(主体.hasRole("总经理角色id")){ 查询工资; }

if(主体.hasRole("总经理角色id") || 主体.hasRole("部门经理角色id")){ 查询工资; }

if(主体.hasPermission("查询工资权限标识")){ 查询工资; }

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>

    <groupId>com.test.security</groupId>
    <artifactId>security-spring-boot</artifactId>
    <version>1.0-SNAPSHOT</version>

    <!-- 指定spring-boot版本 -->
    <parent>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-parent</artifactId>
        <version>2.1.3.RELEASE</version>
    </parent>

    <dependencies>
        <!-- 以下是spring boot依赖-->
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-web</artifactId>
        </dependency>

        <!-- 以下是spring security依赖-->
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-security</artifactId>
        </dependency>

    </dependencies>
</project>

server.port=8080
server.servlet.context-path=/
spring.application.name=security-springboot

@SpringBootApplication
public class SecuritySpringBootApp {
    public static void main(String[] args) {
        SpringApplication.run(SecuritySpringBootApp.class, args);
    }
}

@Configuration//就相当于springmvc.xml文件
public class WebConfig implements WebMvcConfigurer {
    //默认Url根路径跳转到/login，此url为spring security提供 
    @Override
    public void addViewControllers(ViewControllerRegistry registry) {
        registry.addViewController("/").setViewName("redirect:/login");
    }
}

@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

    //定义用户信息服务（查询用户信息）
    @Bean
    public UserDetailsService userDetailsService(){
        InMemoryUserDetailsManager manager = new InMemoryUserDetailsManager();
        manager.createUser(User.withUsername("zhangsan").password("123").authorities("p1").build());
        manager.createUser(User.withUsername("lisi").password("456").authorities("p2").build());
        return manager;
    }

    //密码编码器
    @Bean
    public PasswordEncoder passwordEncoder(){
        return NoOpPasswordEncoder.getInstance();  //不加密密码，明文比对
    }

    //安全拦截机制（最重要）
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests()
                .antMatchers("/r/r1").hasAuthority("p1")
                .antMatchers("/r/r2").hasAuthority("p2")
                .antMatchers("/r/**").authenticated()//所有/r/**的请求必须认证通过
                .anyRequest().permitAll()//除了/r/**，其它的请求可以访问
                .and()
                .formLogin()//允许表单登录
                .successForwardUrl("/login-success");//自定义登录成功的页面地址
    }
}

@RestController
public class LoginController {
    @RequestMapping(value = "/login-success",produces = {"text/plain;charset=UTF-8"})
    public String loginSuccess(){
        //用户登录成功后跳转到该页面
        return "登录成功";
    }

    /**
     * 测试资源1
     * @return
     */
    @GetMapping(value = "/r/r1",produces = {"text/plain;charset=UTF-8"})
    public String r1(){
        return "访问资源1";
    }

    /**
     * 测试资源2
     * @return
     */
    @GetMapping(value = "/r/r2",produces = {"text/plain;charset=UTF-8"})
    public String r2(){
        return "访问资源2";
    }
}

public interface AuthenticationProvider {
    Authentication authenticate(Authentication var1) throws AuthenticationException;
    boolean supports(Class<?> var1);
}

public boolean supports(Class<?> authentication) {
    return UsernamePasswordAuthenticationToken.class.isAssignableFrom(authentication);
}

//Authentication是spring security包中的接口，直接继承自Principal类，而Principal是位于 java.security 包中的。
//它是表示着一个抽象主体身份，任何主体都有一个名称，因此包含一个getName()方法。
public interface Authentication extends Principal, Serializable {
    //权限信息列表，默认是GrantedAuthority接口的一些实现类，通常是代表权限信息的一系列字符串。
    Collection<? extends GrantedAuthority> getAuthorities();

    //凭证信息，用户输入的密码字符串，在认证过后通常会被移除，用于保障安全
    Object getCredentials();

    //细节信息，web应用中的实现接口通常为 WebAuthenticationDetails，它记录了访问者的ip地址和sessionId的值
    Object getDetails();

    //身份信息，大部分情况下返回的是UserDetails接口的实现类，UserDetails代表用户的详细信息，
    //那从Authentication中取出来的UserDetails就是当前登录用户信息，它也是框架中的常用接口之一
    Object getPrincipal();

    boolean isAuthenticated();

    void setAuthenticated(boolean var1) throws IllegalArgumentException;
}

public interface UserDetailsService {
    UserDetails loadUserByUsername(String var1) throws UsernameNotFoundException;
}

public interface UserDetails extends Serializable {
    Collection<? extends GrantedAuthority> getAuthorities();

    String getPassword();

    String getUsername();

    boolean isAccountNonExpired();

    boolean isAccountNonLocked();

    boolean isCredentialsNonExpired();

    boolean isEnabled();
}

@Service
public class SpringDataUserDetailsService implements UserDetailsService {
    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        //登录账号
        System.out.println("username=" + username);
        // 根据账号去数据库查询...
        // 这里暂时使用静态数据
        UserDetails userDetails = User.withUsername(username).password("123").authorities("p1").build();
        return userDetails;
    }
}

 //定义用户信息服务（查询用户信息）
/* @Bean
 public UserDetailsService userDetailsService(){
     InMemoryUserDetailsManager manager = new InMemoryUserDetailsManager();
     manager.createUser(User.withUsername("zhangsan").password("123").authorities("p1").build());
     manager.createUser(User.withUsername("lisi").password("456").authorities("p2").build());
     return manager;
 }*/

public interface PasswordEncoder {
    String encode(CharSequence var1);

    boolean matches(CharSequence var1, String var2);

    default boolean upgradeEncoding(String encodedPassword) {
        return false;
    }
}

@Bean
public PasswordEncoder passwordEncoder(){
    return NoOpPasswordEncoder.getInstance();
}

//密码编码器
@Bean
public PasswordEncoder passwordEncoder(){
    //return NoOpPasswordEncoder.getInstance();
    return new BCryptPasswordEncoder();
}

<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-test</artifactId>
    <scope>test</scope>
</dependency>

@RunWith(SpringRunner.class)
public class TestBCrypt {
    @Test
    public void test1() {
        //对原始密码加密
        String hashpw = BCrypt.hashpw("123", BCrypt.gensalt());
        System.out.println(hashpw);
        //校验原始密码和BCrypt密码是否一致
        boolean checkpw = BCrypt.checkpw("123", "$2a$10$NlBC84MVb7F95EXYTXwLneXgCca6/GipyWR5NHm8K0203bSQMLpvm");
        System.out.println(checkpw);
    }
}

manager.createUser(User.withUsername("zhangsan").password("$2a$10$1b5mIkehqv5c4KRrX9bUj.A4Y2hug3I GCnMCL5i4RpQrYV12xNKye").authorities("p1").build());

http.authorizeRequests()
               .antMatchers("/r/r1").hasAuthority("p1")
               .antMatchers("/r/r2").hasAuthority("p2")
               ...

public interface AccessDecisionManager { 
    /** * 通过传递的参数来决定用户是否有访问对应受保护资源的权限 */
    void decide(Authentication authentication , Object object, Collection<ConfigAttribute> 
                configAttributes) throws AccessDeniedException, InsufficientAuthenticationException; 
    //略.. 
}

public interface AccessDecisionVoter<S> {
    int ACCESS_GRANTED = 1;
    int ACCESS_ABSTAIN = 0;
    int ACCESS_DENIED = -1;

    boolean supports(ConfigAttribute var1);

    boolean supports(Class<?> var1);

    int vote(Authentication var1, S var2, Collection<ConfigAttribute> var3);
}

<%@ page contentType="text/html;charset=UTF-8" pageEncoding="utf-8" %>
<html>
<head>
    <title>用户登录</title>
</head>
<body>
<form action="login" method="post">
    用户名：<input type="text" name="username"><br>
    密&nbsp;&nbsp;&nbsp;码:
    <input type="password" name="password"><br>
    <input type="submit" value="登录">
</form>
</body>
</html>

<!--用于编译jsp -->
<dependency>
    <groupId>org.apache.tomcat.embed</groupId>
    <artifactId>tomcat-embed-jasper</artifactId>
</dependency>
<!--jsp页面使用jstl标签 -->
<dependency>
    <groupId>javax.servlet</groupId>
    <artifactId>jstl</artifactId>
</dependency>

spring.mvc.view.prefix=/WEB-INF/view/
spring.mvc.view.suffix=.jsp

public class WebConfig implements WebMvcConfigurer {
    @Override
    public void addViewControllers(ViewControllerRegistry registry) {
        registry.addViewController("/").setViewName("redirect:/login‐view");
        registry.addViewController("/login‐view").setViewName("login");
    }
}

@Override
protected void configure(HttpSecurity http) throws Exception {
    http.authorizeRequests()
            .antMatchers("/r/**").authenticated()//所有/r/**的请求必须认证通过
            .anyRequest().permitAll()//除了/r/**，其它的请求可以访问
            .and()
            .formLogin()//允许表单登录
            .loginPage("/login-view")//指定我们自己的登录页,spring security以重定向方式跳转到/login-view
            .loginProcessingUrl("/login")//指定登录处理的URL，也就是用户名、密码表单提交的目的路径，此URL由Spring Security提供
            .successForwardUrl("/login-success");//指定登录成功后的跳转URL，自定义登录成功的页面地址
}

@Override
   protected void configure(HttpSecurity http) throws Exception {
       http.csrf().disable()  //屏蔽CSRF控制，即spring security不再限制CSRF
               ...
   }

<form action="login" method="post"> 
    <input type="hidden" name="${_csrf.parameterName}" value="${_csrf.token}"/>
    ... 
</form>

//创建user_db数据库
CREATE DATABASE `user_db` CHARACTER SET 'utf8' COLLATE 'utf8_general_ci';
//创建t_user表
CREATE TABLE `t_user` ( 
    `id` bigint(20) NOT NULL COMMENT '用户id', 
    `username` varchar(64) NOT NULL, 
    `password` varchar(64) NOT NULL, 
    `fullname` varchar(255) NOT NULL COMMENT '用户姓名', 
    `mobile` varchar(11) DEFAULT NULL COMMENT '手机号', 
    PRIMARY KEY (`id`) USING BTREE 
) ENGINE=InnoDB DEFAULT CHARSET=utf8 ROW_FORMAT=DYNAMIC

spring.datasource.url=jdbc:mysql://localhost:3306/user_db 
spring.datasource.username=root 
spring.datasource.password=mysql 
spring.datasource.driver‐class‐name=com.mysql.jdbc.Driver

<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-jdbc</artifactId>
</dependency>
<dependency>
    <groupId>mysql</groupId>
    <artifactId>mysql-connector-java</artifactId>
    <version>5.1.47</version>
</dependency>

@Data
public class UserDto {
    private String id;
    private String username;
    private String password;
    private String fullname;
    private String mobile;
}

@Repository
public class UserDao {
    @Autowired
    JdbcTemplate jdbcTemplate;

    public UserDto getUserByUsername(String username) {
        String sql = "select id,username,password,fullname from t_user where username = ?";
        List<UserDto> list = jdbcTemplate.query(sql, new Object[]{username}, new BeanPropertyRowMapper<>(UserDto.class));
        if (list.size() <= 0) {
            return null;
        }
        return list.get(0);
    }
}

@Service
public class SpringDataUserDetailsService implements UserDetailsService {
    @Autowired
    private UserDao userDao;

    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        //登录账号
        System.out.println("username=" + username);
        // 根据账号去数据库查询...
        UserDto user = userDao.getUserByUsername(username);
        if (user == null)
            return null;
        UserDetails userDetails = User.withUsername(user.getUsername()).password(user.getPassword()).authorities("p1").build();
        return userDetails;
    }
}

/*** 获取当前登录用户名
 * @return
 */
private String getUsername() {
    Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
    if (!authentication.isAuthenticated()) {
        return null;
    }
    Object principal = authentication.getPrincipal();
    String username = null;
    if (principal instanceof org.springframework.security.core.userdetails.UserDetails) {
        username = ((org.springframework.security.core.userdetails.UserDetails) principal).getUsername();
    } else {
        username = principal.toString();
    }
    return username;
}

@Override
protected void configure(HttpSecurity http) throws Exception {
    http.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.IF_REQUIRED);
}

server.servlet.session.timeout=3600s

http.sessionManagement().invalidSessionUrl("/login‐view?error=INVALID_SESSION").maximumSessions(1)
                .expiredUrl("/login‐view?error=EXPIRED_SESSION");

server.servlet.session.cookie.http‐only=true //如果为true，那么浏览器脚本将无法访问cookie 
server.servlet.session.cookie.secure=true //如果为true，则cookie将仅通过HTTPS连接发送 

http.csrf().disable()
                .authorizeRequests()
				...
                .and()
                .logout()               //提供系统退出支持，使用 WebSecurityConfigurerAdapter 会自动被应用
                .logoutUrl("/logout")   //设置触发退出操作的URL (默认是 /logout )
                .logoutSuccessUrl("/login‐view?logout")        //退出之后跳转的URL。默认是 /login?logout
                .logoutSuccessHandler(logoutSuccessHandler)    //定制的 LogoutSuccessHandler，用于实现用户退出成功时的处理。如果指定了这个选项那么 logoutSuccessUrl() 的设置会被忽略
                .addLogoutHandler(logoutHandler)    //添加一个 LogoutHandler ，用于实现用户退出时的清理工作.默认 SecurityContextLogoutHandler 会被添加为最后一个 LogoutHandler
                .invalidateHttpSession(true);       //指定是否在退出时让 HttpSession 无效。 默认设置为 true

//创建角色表
CREATE TABLE `t_role` ( 
    `id` varchar(32) NOT NULL, 
    `role_name` varchar(255) DEFAULT NULL, 
    `description` varchar(255) DEFAULT NULL, 
    `create_time` datetime DEFAULT NULL, 
    `update_time` datetime DEFAULT NULL, 
    `status` char(1) NOT NULL, 
    PRIMARY KEY (`id`), 
    UNIQUE KEY `unique_role_name` (`role_name`) 
) ENGINE=InnoDB DEFAULT CHARSET=utf8 
insert into `t_role`(`id`,`role_name`,`description`,`create_time`,`update_time`,`status`) 
values ('1','管理员',NULL,NULL,NULL,'');

//创建用户角色关联表
CREATE TABLE `t_user_role` ( 
    `user_id` varchar(32) NOT NULL, 
    `role_id` varchar(32) NOT NULL, 
    `create_time` datetime DEFAULT NULL, 
    `creator` varchar(255) DEFAULT NULL, 
    PRIMARY KEY (`user_id`,`role_id`) 
) ENGINE=InnoDB DEFAULT CHARSET=utf8 
insert into `t_user_role`(`user_id`,`role_id`,`create_time`,`creator`) 
values ('1','1',NULL,NULL);

//创建权限表
CREATE TABLE `t_permission` ( 
    `id` varchar(32) NOT NULL, 
    `code` varchar(32) NOT NULL COMMENT '权限标识符', 
    `description` varchar(64) DEFAULT NULL COMMENT '描述', 
    `url` varchar(128) DEFAULT NULL COMMENT '请求地址', 
    PRIMARY KEY (`id`) 
) ENGINE=InnoDB DEFAULT CHARSET=utf8 
insert into `t_permission`(`id`,`code`,`description`,`url`) 
values ('1','p1','测试资源 1','/r/r1'),('2','p3','测试资源2','/r/r2');

//角色权限关联表
CREATE TABLE `t_role_permission` ( 
    `role_id` varchar(32) NOT NULL, 
    `permission_id` varchar(32) NOT NULL, 
    PRIMARY KEY (`role_id`,`permission_id`) 
) ENGINE=InnoDB DEFAULT CHARSET=utf8 
insert into `t_role_permission`(`role_id`,`permission_id`) values ('1','1'),('1','2');

//根据用户id查询用户权限
public List<String> findPermissionsByUserId(String userId) {
    String sql = "SELECT * FROM t_permission WHERE id IN(\n" +
            "SELECT permission_id FROM t_role_permission WHERE role_id IN(\n" +
            "\tSELECT role_id FROM t_user_role WHERE user_id = ? \n" +
            ")\n" +
            ")";
    List<PermissionDto> list = jdbcTemplate.query(sql, new Object[]{userId}, new BeanPropertyRowMapper<>(PermissionDto.class));
    List<String> permissions = new ArrayList<>();
    list.iterator().forEachRemaining(c-> permissions.add(c.getCode()));
    return permissions;
}

@Override
public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
    //登录账号
    System.out.println("username=" + username);
    // 根据账号去数据库查询...
    UserDto user = userDao.getUserByUsername(username);
    if (user == null)
        return null;
    //查询用户权限
    List<String> permissions = userDao.findPermissionsByUserId(user.getId());
    String[] perarray = new String[permissions.size()];
    permissions.toArray(perarray);
    UserDetails userDetails = User.withUsername(user.getUsername()).password(user.getPassword()).authorities(perarray).build();
    return userDetails;
}

http.authorizeRequests()         //http.authorizeRequests()方法有多个子节点，每个macher按照他们的声明顺序执行
    .antMatchers("/r/r1").hasAuthority("p1")   //指定"/r/r1"URL，拥有p1权限能够访问
    .antMatchers("/r/r2").hasAuthority("p2")   //指定"/r/r2"URL，拥有p2权限能够访问
    .antMatchers("/r/r3").access("hasAuthority('p1') and hasAuthority('p2')")  //指定了"/r/r3"URL，同时拥有p1和p2权限才能够访问，这里使用SpEL（Spring Expression Language）表达式
    .antMatchers("/r/**").authenticated()  //指定了除了r1、r2、r3之外的"/r/**"资源，只要通过身份认证就能够访问
    .anyRequest().permitAll()         //剩余的尚未匹配的资源，不做保护

@EnableGlobalMethodSecurity(securedEnabled = true)
@Configuration
public class MethodSecurityConfig {// ...} 

public interface BankService { 
    @Secured("IS_AUTHENTICATED_ANONYMOUSLY")
    public Account readAccount(Long id); 

    @Secured("IS_AUTHENTICATED_ANONYMOUSLY")
    public Account[] findAccounts(); 
    
    @Secured("ROLE_TELLER")
    public Account post(Account account, double amount); 
} 

@EnableGlobalMethodSecurity(prePostEnabled = true) 
@Configuration
public class MethodSecurityConfig {// ...} 

public interface BankService { 
    @PreAuthorize("isAnonymous()") 
    public Account readAccount(Long id); 
    
    @PreAuthorize("isAnonymous()") 
    public Account[] findAccounts();
    
    @PreAuthorize("hasAuthority('p_transfer') and hasAuthority('p_read_account')") 
    public Account post(Account account, double amount);
}