Spring Security的配置

使用和配置spring security，一个基本的权限管理模块

 

引入这两个包，版本自选，目前是2.5

 

		
			org.springframework.security
			spring-security-web
			${springSecuroty.version}
		

		
			org.springframework.security
			spring-security-config
			${springSecuroty.version}
		

 

 

新建一个class，目的是配置启动web app时加载spring security

因为是简单配置，所以没有重写里面的任何方法，实际项目中可以根据需求重写里面的方法

 

package com.demo.config.spring;

import org.springframework.core.Ordered;
import org.springframework.core.annotation.Order;
import org.springframework.security.web.context.AbstractSecurityWebApplicationInitializer;

@Order(Ordered.HIGHEST_PRECEDENCE)
public class SecurityInit extends AbstractSecurityWebApplicationInitializer {

}

 

 

具体的spring security权限配置

用户名和密码读取数据库进行鉴权的配置

如下：

 

package com.demo.config.spring;

import javax.sql.DataSource;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;

@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

	@Autowired
	private DataSource dataSourceMySQL;

	@Autowired
	public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
		auth
			.jdbcAuthentication()
			.dataSource(dataSourceMySQL)
			.usersByUsernameQuery(this.getUserQuery())
			.authoritiesByUsernameQuery(this.getAuthoritiesQuery());
	}

	@Override
	protected void configure(HttpSecurity http) throws Exception {
		
		http
			.csrf() //防止csrf
				.disable()
			.authorizeRequests() //css js的目录设为不需要验证
				.antMatchers("/resources/**")
				.permitAll()
			.anyRequest() //所有请求都要经过验证
				.authenticated()
				.and()
			.formLogin() //登陆页面设为不需要验证
				.loginPage("/login")
				.permitAll()
				.and()
			.logout() //登出请求设为不需要验证
				.permitAll()
				.and()
			.headers() //如果使用iframe的话需要这段配置
				.frameOptions()
				.sameOrigin()
				.httpStrictTransportSecurity()
				.disable(); 
	
	}

	private String getUserQuery() {
		return "SELECT t.user_name as 'username', t.pass_word as 'password', t.enabled as 'enabled' FROM demo.users t WHERE t.user_name = ?";
	}

	private String getAuthoritiesQuery() {
		return "SELECT t.user_name as 'username', t.user_auth as 'authority' FROM demo.authorities t WHERE t.user_name = ?";
	}
	
}

 

数据库里面有两张表

user表，字段有username，password，enable

authority表，权限等级表，字段有id，username，authority

 

另外，如果想要根据自己的需求定制登陆登出

新建一个这样的controller：

import javax.servlet.http.HttpServletRequest;

import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RestController;
import org.springframework.web.servlet.ModelAndView;

@RestController
public class AuthenticationController {
	
	@RequestMapping(value = "/login", produces = "text/html; charset=utf-8")
	public ModelAndView login(HttpServletRequest request){
		return new ModelAndView("loginPage");
	}
	
}

 

以及一个个性化的登录页面，处理所有的登录和登出：

<%@ page language="java" contentType="text/html" pageEncoding="UTF-8" isELIgnored="false"%>
<%@ taglib uri="http://java.sun.com/jsp/jstl/core" prefix="c"%>





	

		
		

			
				
Invalid username and password.
			
			
				
You have been logged out.
			
			
Please Login
			Username  Password
			
			

				Log in
			
		
	

 

补充：

1. 登陆自动转发请求/login，可以参考前面SecurityConfig.class的代码进行修改。

2. 如果输错密码，会自动转发请求/login?error

3. 登出自动转发请求/login?logout

 

个性化的页面，加密方式，等等都可以按需定制，spring security很强大的。

配置完成，网站有了全局的权限管理咯

 

以上