springSecurity

• 权限管理一般有以下几张表

用户表t_user、权限表t_permission、角色表t_role、菜单表t_menu、用户角色关系表t_user_role、角

色权限关系表t_role_permission、角色菜单关系表t_role_menu。

• 
• 在web.xml中配置

<filter>
    <filter-name>springSecurityFilterChain</filter-name>
    <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>
<filter-mapping>
    <filter-name>springSecurityFilterChain</filter-name>
    <url-pattern>/*</url-pattern>
</filter-mapping>

• springSecurityFilterChain不能变，只能是这个名字
• pom.xml

<dependency>

<groupId>org.springframework.security</groupId>

<artifactId>spring-security-web</artifactId>

<version>5.0.5.RELEASE</version>

</dependency>

<dependency>

<groupId>org.springframework.security</groupId>

<artifactId>spring-security-config</artifactId>

<version>5.0.5.RELEASE</version>

</dependency>

• springSecurity底层使用过滤器进行实现的，所以所有的页面请求都会默认被过滤器拦截
• 配置拦截规则
• 设置不过滤资源

<security:http security="none" pattern="/login.html"/>
<security:http security="none" pattern="/css/**"/>
<security:http security="none" pattern="/ElementUI/**"/>
<security:http security="none" pattern="/img/**"/>
<security:http security="none" pattern="/js/**"/>
<security:http security="none" pattern="/template/**"/>

• 配置认证管理器
• <!--配置认证管理器-->
  <security:authentication-manager>
  <security:authentication-provider user-service-ref="securityService">
  <!-- <security:user-service>
  &lt;!&ndash; <security:user name="admin" authorities="ROLE_ADMIN" password="{noop}1234"/>&ndash;&gt;
  </security:user-service>-->
  
  <security:password-encoder ref="passwordEncoder" />//配置密码
      </security:authentication-provider>
  </security:authentication-manager>
  <bean id="securityService" class="com.ssw.service.SecurityService"/>
• java类中

@Component
public class SecurityService implements UserDetailsService {
    @Reference
    UserService userService;
    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        User user = userService.find(username);
        if(user==null){
            return null;
        }
        List list = new ArrayList();
        Set<Role> roles = user.getRoles();
        for (Role role : roles) {
            list.add(new SimpleGrantedAuthority(role.getKeyword()));
            Set<Permission> permissions = role.getPermissions();
            for (Permission permission : permissions) {
                list.add(new SimpleGrantedAuthority(permission.getKeyword()));
            }
        }
        org.springframework.security.core.userdetails.User securityUser = new org.springframework.security.core.userdetails.User( ,user.getPassword(),list);

        return securityUser;
    }
}

• 授权的配置

<!--
    auto-config默认是否用框架提供的默认的一些功能，默认登录页面等
-->
    <security:http auto-config="true">

//frame页面设置不过滤
        <security:headers>
            <security:frame-options policy="SAMEORIGIN"></security:frame-options>
        </security:headers>

<!--拥有add权限就可以访问b.html页面-->

<security:intercept-url pattern="/b.html" access="hasAuthority('add')" />

        <security:intercept-url pattern="/pages/**" access="isAuthenticated()"/>

//指定自定义的登录页面
        <security:form-login login-page="/login.html"
                             username-parameter="username"
                             password-parameter="password"
                             login-processing-url="/login.do"
                             default-target-url="/pages/main.html"
                             authentication-failure-url="/login.html"/>

//自定义页面必须关闭csrf过滤器，负责登录页面会被过滤掉。
        <security:csrf disabled="true"></security:csrf>
//自定义退出
        <security:logout logout-url="/logout.do" logout-success-url="/login.html" invalidate-session="true"/>
    </security:http>

• 对密码加密

<bean id="passwordEncoder" class="org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder" />

• 使用注解方式
• <security:global-method-security pre-post-annotations="enabled" />
• @RequestMapping("/delete")
• @PreAuthorize("hasRole('ROLE_ADMIN')")//表示用户必须拥有ROLE_ADMIN角色才能调用当前方法

public String delete(){

System.out.println("delete...");

return "success";

}

•