Spring Security --- 权限控制安全框架入门简介

一、Spring Security简介

 

Spring Security是一个能够为基于Spring的企业应用系统提供声明式的安全访问控制解决方案的安全框架。它提供了一组可以在Spring应用上下文中配置的Bean，充分利用了Spring IoC，DI（控制反转Inversion of Control ,DI:Dependency Injection 依赖注入）和AOP（面向切面编程）功能，为应用系统提供声明式的安全访问控制功能，减少了为企业系统安全控制编写大量重复代码的工作。

 

二、入门案例

 

1、引入Jar

 

                org.springframework.security
                spring-security-web
                4.1.0.RELEASE
            
            
                org.springframework.security
                spring-security-config
                4.1.0.RELEASE
            

2、web.xml配置

 

 

        contextConfigLocation
        classpath:spring/spring-security.xml
    
    
        
            org.springframework.web.context.ContextLoaderListener
        
    

    
        springSecurityFilterChain
        org.springframework.web.filter.DelegatingFilterProxy
    
    
        springSecurityFilterChain
        /*
    

3、spring-security.xml配置

 

 

4、UserDetailsServiceImpl实现类

 

 

package com.xxx.shop.service;

import com.xxx.pojo.TbSeller;
import com.xxx.sellergoods.service.SellerService;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.authority.SimpleGrantedAuthority;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.core.userdetails.UsernameNotFoundException;

import java.util.ArrayList;
import java.util.List;

public class UserDetailsServiceImpl implements UserDetailsService{

    private SellerService sellerService;

    public void setSellerService(SellerService sellerService) {
        this.sellerService = sellerService;
    }

    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        System.out.println("UserDetailsServiceImpl");

        // 构建角色列表
        List grantAuths = new ArrayList<>();
        grantAuths.add(new SimpleGrantedAuthority("ROLE_SELLER"));

        TbSeller seller = sellerService.findOne(username);
        if (seller != null)
            if (seller.getStatus().equals("1"))
                return new User(username,seller.getPassword(),grantAuths);

        return null;

    }
}

参考资料：

 

http://blog.csdn.net/bao19901210/article/details/52574340