原文： https://howtodoinjava.com/spring-boot/role-based-security-jaxrs-annotations/

学习使用 Spring Boot 和 Jersey 框架创建 JAX-RS 2.0 REST API ，并使用 JAX-RS 注解添加基于角色的安全性，例如 @PermitAll，@RolesAllowed或@DenyAll。

项目结构

在本教程中创建的应用程序的项目结构如下：

Spring Boot – 带有 JAX-RS 注解的基于角色的安全性 - 图1

Spring Boot JAX-RS 安全性示例 – 项目结构

创建 REST API

  1. 创建 Spring Boot 项目


转到 Spring 初始化器页面，并创建具有 Jersey（JAX-RS）依赖项的 spring boot 应用程序。
Spring Boot – 带有 JAX-RS 注解的基于角色的安全性 - 图2
在 Spring 初始化器中选择 Jersey

  1. 在 Eclipse 中导入


将项目生成为 zip 文件。 将其解压缩到计算机中的某个位置。 将项目作为“现有 maven 应用程序”导入 eclipse。

  1. 检查 Maven 依赖项


检查 Maven 文件中是否具有依赖项。

  1. <dependencies>
  2.     <dependency>
  3.         <groupId>org.springframework.boot</groupId>
  4.         <artifactId>spring-boot-starter-jersey</artifactId>
  5.     </dependency>
  6.     <dependency>
  7.         <groupId>org.springframework.boot</groupId>
  8.         <artifactId>spring-boot-starter-test</artifactId>
  9.         <scope>test</scope>
  10.     </dependency>
  11. </dependencies>

  1. 创建 REST API


现在创建一些 JAX-RS 资源，我们将进入测试阶段。 我创建了UserResource类。
UserResource.java

  1. package com.howtodoinjava.jerseydemo;
  3. import java.net.URI;
  4. import java.net.URISyntaxException;
  5. import java.util.ArrayList;
  6. import java.util.HashMap;
  7. import java.util.Map;
  8. import javax.ws.rs.Consumes;
  9. import javax.ws.rs.DELETE;
  10. import javax.ws.rs.GET;
  11. import javax.ws.rs.POST;
  12. import javax.ws.rs.PUT;
  13. import javax.ws.rs.Path;
  14. import javax.ws.rs.PathParam;
  15. import javax.ws.rs.Produces;
  16. import javax.ws.rs.core.Response;
  17. import javax.xml.bind.annotation.XmlAccessType;
  18. import javax.xml.bind.annotation.XmlAccessorType;
  19. import javax.xml.bind.annotation.XmlRootElement;
  21. @XmlAccessorType(XmlAccessType.NONE)
  22. @XmlRootElement(name = "users")
  23. @Path("/users")
  24. public class UserResource 
  25. {
  26.     private static Map<Integer, User> DB = new HashMap<>(); 
  28.     @GET
  29.     @Produces("application/json")
  30.     public Users getAllUsers() {
  31.         Users users = new Users();
  32.         users.setUsers(new ArrayList<>(DB.values()));
  33.         return users;
  34.     }
  36.     @POST
  37.     @Consumes("application/json")
  38.     public Response createUser(User user) throws URISyntaxException 
  39.     {
  40.         if(user.getFirstName() == null || user.getLastName() == null) {
  41.             return Response.status(400).entity("Please provide all mandatory inputs").build();
  42.         }
  43.         user.setId(DB.values().size()+1);
  44.         user.setUri("/user-management/"+user.getId());
  45.         DB.put(user.getId(), user);
  46.         return Response.status(201).contentLocation(new URI(user.getUri())).build();
  47.     }
  49.     @GET
  50.     @Path("/{id}")
  51.     @Produces("application/json")
  52.     public Response getUserById(@PathParam("id") int id) throws URISyntaxException 
  53.     {
  54.         User user = DB.get(id);
  55.         if(user == null) {
  56.             return Response.status(404).build();
  57.         }
  58.         return Response
  59.                 .status(200)
  60.                 .entity(user)
  61.                 .contentLocation(new URI("/user-management/"+id)).build();
  62.     }
  64.     @PUT
  65.     @Path("/{id}")
  66.     @Consumes("application/json")
  67.     @Produces("application/json")
  68.     public Response updateUser(@PathParam("id") int id, User user) throws URISyntaxException 
  69.     {
  70.         User temp = DB.get(id);
  71.         if(user == null) {
  72.             return Response.status(404).build();
  73.         }
  74.         temp.setFirstName(user.getFirstName());
  75.         temp.setLastName(user.getLastName());
  76.         DB.put(temp.getId(), temp);
  77.         return Response.status(200).entity(temp).build();
  78.     }
  80.     @DELETE
  81.     @Path("/{id}")
  82.     public Response deleteUser(@PathParam("id") int id)    throws URISyntaxException {
  83.         User user = DB.get(id);
  84.         if(user != null) {
  85.             DB.remove(user.getId());
  86.             return Response.status(200).build();
  87.         }
  88.         return Response.status(404).build();
  89.     }
  91.     static 
  92.     {
  93.         User user1 = new User();
  94.         user1.setId(1);
  95.         user1.setFirstName("John");
  96.         user1.setLastName("Wick");
  97.         user1.setUri("/user-management/1");
  99.         User user2 = new User();
  100.         user2.setId(2);
  101.         user2.setFirstName("Harry");
  102.         user2.setLastName("Potter");
  103.         user2.setUri("/user-management/2");
  105.         DB.put(user1.getId(), user1);
  106.         DB.put(user2.getId(), user2);
  107.     }
  108. }


Users.java

  1. package com.howtodoinjava.jerseydemo;
  3. import java.util.ArrayList;
  4. import javax.xml.bind.annotation.XmlAccessType;
  5. import javax.xml.bind.annotation.XmlAccessorType;
  6. import javax.xml.bind.annotation.XmlElement;
  7. import javax.xml.bind.annotation.XmlRootElement;
  9. @XmlAccessorType(XmlAccessType.NONE)
  10. @XmlRootElement(name = "users")
  11. public class Users {
  13.     @XmlElement(name="user")
  14.     private ArrayList<User> users;
  16.     public ArrayList<User> getUsers() {
  17.         return users;
  18.     }
  20.     public void setUsers(ArrayList<User> users) {
  21.         this.users = users;
  22.     }
  23. }


User.java

  1. package com.howtodoinjava.jerseydemo;
  3. import java.io.Serializable;
  4. import javax.xml.bind.annotation.XmlAccessType;
  5. import javax.xml.bind.annotation.XmlAccessorType;
  6. import javax.xml.bind.annotation.XmlAttribute;
  7. import javax.xml.bind.annotation.XmlElement;
  8. import javax.xml.bind.annotation.XmlRootElement;
  10. @XmlAccessorType(XmlAccessType.NONE)
  11. @XmlRootElement(name = "user")
  12. public class User implements Serializable {
  14.     private static final long serialVersionUID = 1L;
  16.     @XmlAttribute(name = "id")
  17.     private int id;
  19.     @XmlAttribute(name="uri")
  20.     private String uri;
  22.     @XmlElement(name = "firstName")
  23.     private String firstName;
  25.     @XmlElement(name = "lastName")
  26.     private String lastName;
  28.     // Getters and Setters
  29. }

  1. 配置 Jersey


现在我们有了一个 JAX-RS 资源，我们想从包含 Jersey 依赖项的 spring boot 应用程序中访问它。 让我们将此资源注册为 Jersey 资源。

  1. package com.howtodoinjava.jerseydemo;
  3. import org.glassfish.jersey.server.ResourceConfig;
  4. import org.springframework.stereotype.Component;
  6. @Component
  7. public class JerseyConfig extends ResourceConfig 
  8. {
  9.     public JerseyConfig() 
  10.     {
  11.         register(SecurityFilter.class);
  12.         register(UserResource.class);
  13.     }
  14. }
  • 查看@Component注解。 它可以在 Spring Boot 自动扫描源文件夹中的 java 类时注册此类。
  • ResourceConfig提供高级功能以简化 JAX-RS 组件的注册。
  • SecurityFilter类是实际的身份验证详细信息处理器，我们将在本教程的后面部分看到。

`SpringBootServletInitializer````java package com.howtodoinjava.jerseydemo;

import org.springframework.boot.autoconfigure.SpringBootApplication; import org.springframework.boot.builder.SpringApplicationBuilder; import org.springframework.boot.web.support.SpringBootServletInitializer;

@SpringBootApplication public class JerseydemoApplication extends SpringBootServletInitializer { public static void main(String[] args) { new JerseydemoApplication().configure(new SpringApplicationBuilder(JerseydemoApplication.class)).run(args); } }

  2. <a name="a26694ef"></a>
  3. ## 使用 JAX-RS 注解的安全 REST API
  5. 现在，当我们的 API 准备就绪时，我们将开始保护它们。 让我们根据 **JAX-RS 注解**对其进行注解，具体取决于它们的期望访问级别和允许访问它们的用户角色。
  7. ```java
  8. package com.howtodoinjava.jerseydemo;
  10. @XmlAccessorType(XmlAccessType.NONE)
  11. @XmlRootElement(name = "users")
  12. @Path("/users")
  13. public class UserResource 
  14. {
  15.     private static Map<Integer, User> DB = new HashMap<>(); 
  17.     @GET
  18.     @PermitAll
  19.     @Produces("application/json")
  20.     public Users getAllUsers() {
  21.         Users users = new Users();
  22.         users.setUsers(new ArrayList<>(DB.values()));
  23.         return users;
  24.     }
  26.     @POST
  27.     @Consumes("application/json")
  28.     @RolesAllowed("ADMIN")
  29.     public Response createUser(User user) throws URISyntaxException 
  30.     {
  31.         if(user.getFirstName() == null || user.getLastName() == null) {
  32.             return Response.status(400).entity("Please provide all mandatory inputs").build();
  33.         }
  34.         user.setId(DB.values().size()+1);
  35.         user.setUri("/user-management/"+user.getId());
  36.         DB.put(user.getId(), user);
  37.         return Response.status(201).contentLocation(new URI(user.getUri())).build();
  38.     }
  40.     @GET
  41.     @Path("/{id}")
  42.     @Produces("application/json")
  43.     @PermitAll
  44.     public Response getUserById(@PathParam("id") int id) throws URISyntaxException 
  45.     {
  46.         User user = DB.get(id);
  47.         if(user == null) {
  48.             return Response.status(404).build();
  49.         }
  50.         return Response
  51.                 .status(200)
  52.                 .entity(user)
  53.                 .contentLocation(new URI("/user-management/"+id)).build();
  54.     }
  56.     @PUT
  57.     @Path("/{id}")
  58.     @Consumes("application/json")
  59.     @Produces("application/json")
  60.     @RolesAllowed("ADMIN")
  61.     public Response updateUser(@PathParam("id") int id, User user) throws URISyntaxException 
  62.     {
  63.         User temp = DB.get(id);
  64.         if(user == null) {
  65.             return Response.status(404).build();
  66.         }
  67.         temp.setFirstName(user.getFirstName());
  68.         temp.setLastName(user.getLastName());
  69.         DB.put(temp.getId(), temp);
  70.         return Response.status(200).entity(temp).build();
  71.     }
  73.     @DELETE
  74.     @Path("/{id}")
  75.     @RolesAllowed("ADMIN")
  76.     public Response deleteUser(@PathParam("id") int id)    throws URISyntaxException {
  77.         User user = DB.get(id);
  78.         if(user != null) {
  79.             DB.remove(user.getId());
  80.             return Response.status(200).build();
  81.         }
  82.         return Response.status(404).build();
  83.     }
  85.     static 
  86.     {
  87.         User user1 = new User();
  88.         user1.setId(1);
  89.         user1.setFirstName("John");
  90.         user1.setLastName("Wick");
  91.         user1.setUri("/user-management/1");
  93.         User user2 = new User();
  94.         user2.setId(2);
  95.         user2.setFirstName("Harry");
  96.         user2.setLastName("Potter");
  97.         user2.setUri("/user-management/2");
  99.         DB.put(user1.getId(), user1);
  100.         DB.put(user2.getId(), user2);
  101.     }
  102. }

您可以在上面突出显示的行中查看与安全相关的 JAX-RS 注解。

使用 JAX-RS ContainerRequestFilter编写安全过滤器

现在是时候编写我们的安全过滤器了，该过滤器将检查传入的请求，获取授权信息（在此示例中为基本认证），然后匹配用户名和密码，最后将通过其角色来验证用户的访问级别。 如果一切都匹配，则将访问 API，否则用户将获得拒绝访问响应。

  1. package com.howtodoinjava.jerseydemo;
  3. import java.lang.reflect.Method;
  4. import java.util.Arrays;
  5. import java.util.Base64;
  6. import java.util.HashSet;
  7. import java.util.List;
  8. import java.util.Set;
  9. import java.util.StringTokenizer;
  11. import javax.annotation.security.DenyAll;
  12. import javax.annotation.security.PermitAll;
  13. import javax.annotation.security.RolesAllowed;
  14. import javax.ws.rs.container.ContainerRequestContext;
  15. import javax.ws.rs.container.ResourceInfo;
  16. import javax.ws.rs.core.Context;
  17. import javax.ws.rs.core.MultivaluedMap;
  18. import javax.ws.rs.core.Response;
  19. import javax.ws.rs.ext.Provider;
  21. /**
  22.  * This filter verify the access permissions for a user based on 
  23.  * user name and password provided in request
  24.  * */
  25. @Provider
  26. public class SecurityFilter implements javax.ws.rs.container.ContainerRequestFilter
  27. {
  28.     private static final String AUTHORIZATION_PROPERTY = "Authorization";
  29.     private static final String AUTHENTICATION_SCHEME = "Basic";
  30.     private static final Response ACCESS_DENIED = Response.status(Response.Status.UNAUTHORIZED).build();
  31.     private static final Response ACCESS_FORBIDDEN = Response.status(Response.Status.FORBIDDEN).build();
  32.     private static final Response SERVER_ERROR = Response.status(Response.Status.INTERNAL_SERVER_ERROR).build();
  34.     @Context
  35.     private ResourceInfo resourceInfo;
  37.     @Override
  38.     public void filter(ContainerRequestContext requestContext)
  39.     {
  40.         Method method = resourceInfo.getResourceMethod();
  41.         //Access allowed for all 
  42.         if( ! method.isAnnotationPresent(PermitAll.class))
  43.         {
  44.             //Access denied for all 
  45.             if(method.isAnnotationPresent(DenyAll.class))
  46.             {
  47.                 requestContext.abortWith(ACCESS_FORBIDDEN);
  48.                 return;
  49.             }
  51.             //Get request headers
  52.             final MultivaluedMap<String, String> headers = requestContext.getHeaders();
  54.             //Fetch authorization header
  55.             final List<String> authorization = headers.get(AUTHORIZATION_PROPERTY);
  57.             //If no authorization information present; block access
  58.             if(authorization == null || authorization.isEmpty())
  59.             {
  60.                 requestContext.abortWith(ACCESS_DENIED);
  61.                 return;
  62.             }
  64.             //Get encoded username and password
  65.             final String encodedUserPassword = authorization.get(0).replaceFirst(AUTHENTICATION_SCHEME + " ", "");
  67.             //Decode username and password
  68.             String usernameAndPassword = null;
  69.             try {
  70.                 usernameAndPassword = new String(Base64.getDecoder().decode(encodedUserPassword));
  71.             } catch (Exception e) {
  72.                 requestContext.abortWith(SERVER_ERROR);
  73.                 return;
  74.             }
  76.             //Split username and password tokens
  77.             final StringTokenizer tokenizer = new StringTokenizer(usernameAndPassword, ":");
  78.             final String username = tokenizer.nextToken();
  79.             final String password = tokenizer.nextToken();
  81.             //Verifying Username and password
  82.             if(!(username.equalsIgnoreCase("admin") && password.equalsIgnoreCase("password"))){
  83.                 requestContext.abortWith(ACCESS_DENIED);
  84.                 return;
  85.             }
  87.             //Verify user access
  88.             if(method.isAnnotationPresent(RolesAllowed.class))
  89.             {
  90.                 RolesAllowed rolesAnnotation = method.getAnnotation(RolesAllowed.class);
  91.                 Set<String> rolesSet = new HashSet<String>(Arrays.asList(rolesAnnotation.value()));
  93.                 //Is user valid?
  94.                 if( ! isUserAllowed(username, password, rolesSet))
  95.                 {
  96.                     requestContext.abortWith(ACCESS_DENIED);
  97.                     return;
  98.                 }
  99.             }
  100.         }
  101.     }
  102.     private boolean isUserAllowed(final String username, final String password, final Set<String> rolesSet) 
  103.     {
  104.         boolean isAllowed = false;
  106.         //Step 1\. Fetch password from database and match with password in argument
  107.         //If both match then get the defined role for user from database and continue; else return isAllowed [false]
  108.         //Access the database and do this part yourself
  109.         //String userRole = userMgr.getUserRole(username);
  110.         String userRole = "ADMIN";
  112.         //Step 2\. Verify user role
  113.         if(rolesSet.contains(userRole))
  114.         {
  115.             isAllowed = true;
  116.         }
  117.         return isAllowed;
  118.     }
  119. }

示例

将项目作为 Spring 启动应用程序运行。 现在测试其余资源。

访问 GET /users资源

Spring Boot – 带有 JAX-RS 注解的基于角色的安全性 - 图3

GET 用户集合

访问 POST /users资源，没有身份验证详细信息

查看返回的状态代码 401 。

Spring Boot – 带有 JAX-RS 注解的基于角色的安全性 - 图4

POST API 所需的认证

已添加身份验证详细信息的访问 POST /users资源

使用此链接生成 base64 编码的用户名和密码组合，以传递到Authorization标头中。

Spring Boot – 带有 JAX-RS 注解的基于角色的安全性 - 图5

使用认证信息请求成功

将我的问题放在评论部分。

学习愉快！