Spring Security中使用注解进行用户授权

Posted 2021-08-15 爱上口袋的天空

tags:

篇首语：本文由小常识网(cha138.com)小编为大家整理，主要介绍了Spring Security中使用注解进行用户授权相关的知识，希望对你有一定的参考价值。

1、@Secured

功能：判断是否具有角色，另外需要注意的是这里匹配的字符串需要添加前缀“ROLE_”。

使用@EnableGlobalMethodSecurity(securedEnabled=true)开启该注解功能。

package com.kgf.security;

import org.mybatis.spring.annotation.MapperScan;
import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;

@EnableGlobalMethodSecurity(securedEnabled = true)
@MapperScan(value = "com.kgf.security.mapper")
@SpringBootApplication
public class SecurityApplication {

    public static void main(String[] args) {

        SpringApplication.run(SecurityApplication.class,args);

    }

}

在控制器方法上添加注解@Secured

package com.kgf.security.controller;

import org.springframework.security.access.annotation.Secured;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RestController;

@RequestMapping("test")
@RestController
public class TestController {


    @RequestMapping("hello")
    public String test(){
        return "hello security";
    }

    @RequestMapping("index")
    public String index(){
        return "hello index";
    }
    @RequestMapping("unauth")
    public String unauth(){
        return "unauth";
    }

    @GetMapping("update")
    @Secured({"ROLE_sale","ROLE_manager"})
    public String update() {
        return "hello update";
    }

}

设置数据库查询的角色：

package com.kgf.security.service;

import com.baomidou.mybatisplus.core.conditions.query.QueryWrapper;
import com.kgf.security.mapper.UsersMapper;
import com.kgf.security.model.Users;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.authority.AuthorityUtils;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.core.userdetails.UsernameNotFoundException;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.stereotype.Service;

import javax.annotation.Resource;
import java.util.List;

/***
 * spring security查询用户的时候会自动到这个类中去查找
 */
@Service("userDetailsService")
public class MyUserDetailsService implements UserDetailsService {

    @Resource
    private UsersMapper usersMapper;

    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {

        QueryWrapper<Users> usersQueryWrapper = new QueryWrapper<>();
        usersQueryWrapper.eq("username",username);
        Users users = usersMapper.selectOne(usersQueryWrapper);
        if (users==null){
            throw new UsernameNotFoundException("用户名不存在!");
        }
        //这里我们就不去查询数据库了，直接new一个对象
        List<GrantedAuthority> authorityList = AuthorityUtils.commaSeparatedStringToAuthorityList("ROLE_sale");
        return new User(username,users.getPassword(),authorityList);
    }
}

测试：

2、@PreAuthorize

功能：注解适合进入方法前的权限验证，@PreAuthorize可以将登录用户的roles/permissions参数传到方法中。

示例：
先开启注解功能：

package com.kgf.security;

import org.mybatis.spring.annotation.MapperScan;
import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;

@EnableGlobalMethodSecurity(securedEnabled = true,prePostEnabled = true)
@MapperScan(value = "com.kgf.security.mapper")
@SpringBootApplication
public class SecurityApplication {

    public static void main(String[] args) {

        SpringApplication.run(SecurityApplication.class,args);

    }

}

控制器中加入注解：

设置数据库查询的角色：

package com.kgf.security.service;

import com.baomidou.mybatisplus.core.conditions.query.QueryWrapper;
import com.kgf.security.mapper.UsersMapper;
import com.kgf.security.model.Users;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.authority.AuthorityUtils;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.core.userdetails.UsernameNotFoundException;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.stereotype.Service;

import javax.annotation.Resource;
import java.util.List;

/***
 * spring security查询用户的时候会自动到这个类中去查找
 */
@Service("userDetailsService")
public class MyUserDetailsService implements UserDetailsService {

    @Resource
    private UsersMapper usersMapper;

    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {

        QueryWrapper<Users> usersQueryWrapper = new QueryWrapper<>();
        usersQueryWrapper.eq("username",username);
        Users users = usersMapper.selectOne(usersQueryWrapper);
        if (users==null){
            throw new UsernameNotFoundException("用户名不存在!");
        }
        //这里我们就不去查询数据库了，直接new一个对象
        List<GrantedAuthority> authorityList = AuthorityUtils.commaSeparatedStringToAuthorityList("manager");
        return new User(username,users.getPassword(),authorityList);
    }
}

测试：