1、什么是SpringSecurity
    Spring Security是一个能够为基于Spring的企业应用系统提供声明式的安全访问控制解决方案的安全框架。它提供了一组可以在Spring应用上下文中配置的Bean，充分利用了Spring IoC，DI（控制反转Inversion of Control ,DI:Dependency Injection 依赖注入）和AOP（面向切面编程）功能，为应用系统提供声明式的安全访问控制功能，减少了为企业系统安全控制编写大量重复代码的工作。

    2、结合SpringBoot使用步骤

    1. <!-->spring-boot 整合security -->
    2.         <dependency>
    3.             <groupId>org.springframework.boot</groupId>
    4.             <artifactId>spring-boot-starter-security</artifactId>
    5.         </dependency>

    知道HttpBasic模式与FormLogin模式的区别，代码第29行；
    http.authorizeRequests().antMatchers(“/**”).fullyAuthenticated().and().httpBasic();

    1. @Component
    2. @EnableWebSecurity
    3. public class SecurityConfig extends WebSecurityConfigurerAdapter {
    4.   @Autowired
    5.   private MyAuthenticationFailureHandler failureHandler;
    6.   @Autowired
    7.   private MyAuthenticationSuccessHandler successHandler;
    8.     // 配置认证用户信息和权限
    9.     protected void configure(AuthenticationManagerBuilder auth) throws Exception {
    10.         // 添加admin账号
    11.         auth.inMemoryAuthentication().withUser("admin").password("123456").
    12.         authorities("showOrder","addOrder","updateOrder","deleteOrder");
    13.         // 添加userAdd账号
    14.         auth.inMemoryAuthentication().withUser("userAdd").password("123456").authorities("showOrder","addOrder");
    15.         // 如果想实现动态账号与数据库关联 在该地方改为查询数据库
    17.     }
    19.     // 配置拦截请求资源
    20.     protected void configure(HttpSecurity http) throws Exception {
    21.         // 如何权限控制 给每一个请求路径 分配一个权限名称 让后账号只要关联该名称，就可以有访问权限
    22.         http.authorizeRequests()
    23.         // 配置查询订单权限
    24.         .antMatchers("/showOrder").hasAnyAuthority("showOrder")
    25.         .antMatchers("/addOrder").hasAnyAuthority("addOrder")
    26.         .antMatchers("/login").permitAll()
    27.         .antMatchers("/updateOrder").hasAnyAuthority("updateOrder")
    28.         .antMatchers("/deleteOrder").hasAnyAuthority("deleteOrder")
    29.         .antMatchers("/**").fullyAuthenticated().and().formLogin().loginPage("/login").
    30.         successHandler(successHandler).failureHandler(failureHandler)
    31.         .and().csrf().disable();
    32.     }
    34.     @Bean
    35.     public static NoOpPasswordEncoder passwordEncoder() {
    36.         return (NoOpPasswordEncoder) NoOpPasswordEncoder.getInstance();
    37.     }
    39. }

    处理登陆是否成功的两个过滤器；再加上上边低30的代码；

    2. //认证失败
    3. @Component
    4. public class MyAuthenticationFailureHandler implements AuthenticationFailureHandler {
    6.     public void onAuthenticationFailure(HttpServletRequest req, HttpServletResponse res, AuthenticationException auth)
    7.             throws IOException, ServletException {
    8.         System.out.println("登陆失败!");
    9.         res.sendRedirect("http://mayikt.com");
    11.     }
    13. }


    2. // 认证成功
    3. @Component
    4. public class MyAuthenticationSuccessHandler implements AuthenticationSuccessHandler {
    6.     public void onAuthenticationSuccess(HttpServletRequest req, HttpServletResponse res, Authentication arg2)
    7.             throws IOException, ServletException {
    8.         System.out.println("用户认证成功");
    9.         res.sendRedirect("/");
    10.     }
    12. }

    更改403报错信息下边两个：

    1. /**
    2.  * 自定义 WEB 服务器参数 可以配置默认错误页面
    3.  * @version 2018年11月12日
    4.  */
    5. @Configuration
    6. public class WebServerAutoConfiguration {
    7.     @Bean
    8.     public ConfigurableServletWebServerFactory webServerFactory() {
    9.         TomcatServletWebServerFactory factory = new TomcatServletWebServerFactory();
    10.         ErrorPage errorPage400 = new ErrorPage(HttpStatus.BAD_REQUEST, "/error/400");
    11.         ErrorPage errorPage401 = new ErrorPage(HttpStatus.UNAUTHORIZED, "/error/401");
    12.         ErrorPage errorPage403 = new ErrorPage(HttpStatus.FORBIDDEN, "/error/403");
    13.         ErrorPage errorPage404 = new ErrorPage(HttpStatus.NOT_FOUND, "/error/404");
    14.         ErrorPage errorPage415 = new ErrorPage(HttpStatus.UNSUPPORTED_MEDIA_TYPE, "/error/415");
    15.         ErrorPage errorPage500 = new ErrorPage(HttpStatus.INTERNAL_SERVER_ERROR, "/error/500");
    16.         factory.addErrorPages(errorPage400, errorPage401, errorPage403, errorPage404, errorPage415, errorPage500);
    17.         return factory;
    18.     }
    19. }


    1. @Controller
    2. public class ErrorController {
    4.     // 403权限不足页面
    5.     @RequestMapping("/error/403")
    6.     public String error() {
    7.         return "/error/403";
    8.     }
    10. }


    2.     @Controller
    3.     public class OrderController {
    4.         // 首页
    5.         @RequestMapping("/")
    6.         public String index() {
    7.             return "index";
    8.         }
    10.         // 查询订单
    11.         @RequestMapping("/showOrder")
    12.         public String showOrder() {
    13.             return "showOrder";
    14.         }
    16.         // 添加订单
    17.         @RequestMapping("/addOrder")
    18.         public String addOrder() {
    19.             return "addOrder";
    20.         }
    22.         // 修改订单
    23.         @RequestMapping("/updateOrder")
    24.         public String updateOrder() {
    25.             return "updateOrder";
    26.         }
    28.         // 删除订单
    29.         @RequestMapping("/deleteOrder")
    30.         public String deleteOrder() {
    31.             return "deleteOrder";
    32.         }
    34.         // 自定义登陆页面
    35.         @GetMapping("/login")
    36.         public String login() {
    37.             return "login";
    38.         }
    40.     }

    11.12 PPT.pptxspringboot-security.docx上课代码.zip

    3、将SecurityConfig配置成动态的
    先总结一个什么是RBAC权限模型
    就是基于角色的权限访问控制，在五张表的基础上做扩展；用户表，角色表，权限表，用户角色关联表，角色权限关联表；

    1. public interface UserMapper {
    2.     // 查询用户信息
    3.     @Select(" select * from sys_user where username = #{userName}")
    4.     User findByUsername(@Param("userName") String userName);
    6.     // 查询用户的权限
    7.     @Select(" select permission.* from sys_user user" + " inner join sys_user_role user_role"
    8.             + " on user.id = user_role.user_id inner join "
    9.             + "sys_role_permission role_permission on user_role.role_id = role_permission.role_id "
    10.             + " inner join sys_permission permission on role_permission.perm_id = permission.id where user.username = #{userName};")
    11.     List<Permission> findPermissionByUsername(@Param("userName") String userName);
    12. }
    1. // 设置动态用户信息
    2. @Service
    3. public class MyUserDetailsService implements UserDetailsService {
    4.     @Autowired
    5.     private UserMapper userMapper;
    7.     @Override
    8.     public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
    10.         // 1.根据用户名称查询数据用户信息
    11.         User user = userMapper.findByUsername(username);
    12.         // 2.底层会根据数据库查询用户信息，判断密码是否正确
    13.         // 3. 给用户设置权限
    14.         List<Permission> listPermission = userMapper.findPermissionByUsername(username);
    15.         System.out.println("username:" + username + ",对应权限:" + listPermission.toString());
    16.         if (listPermission != null && listPermission.size() > 0) {
    17.             // 定义用户权限
    18.             List<GrantedAuthority> authorities = new ArrayList<GrantedAuthority>();
    19.             for (Permission permission : listPermission) {
    20.                 authorities.add(new SimpleGrantedAuthority(permission.getPermTag()));
    21.             }
    22.             user.setAuthorities(authorities);
    23.         }
    24.         return user;
    25.     }
    27. }


    1. // Security 配置
    2. @Component
    3. @EnableWebSecurity
    4. public class SecurityConfig extends WebSecurityConfigurerAdapter {
    5.     @Autowired
    6.     private MyAuthenticationFailureHandler failureHandler;
    7.     @Autowired
    8.     private MyAuthenticationSuccessHandler successHandler;
    9.     @Autowired
    10.     private MyUserDetailsService myUserDetailsService;
    11.     @Autowired
    12.     private PermissionMapper permissionMapper;
    14.     // 配置认证用户信息和权限
    15.     protected void configure(AuthenticationManagerBuilder auth) throws Exception {
    16.         // // 添加admin账号
    17.         // auth.inMemoryAuthentication().withUser("admin").password("123456").
    18.         // authorities("showOrder","addOrder","updateOrder","deleteOrder");
    19.         // // 添加userAdd账号
    20.         // auth.inMemoryAuthentication().withUser("userAdd").password("123456").authorities("showOrder","addOrder");
    21.         // 如果想实现动态账号与数据库关联 在该地方改为查询数据库
    22.         //如果需要加密则增加passwordEncoder，如果不需要则不用加；
    23.         auth.userDetailsService(myUserDetailsService).passwordEncoder(new PasswordEncoder() {
    25.             // 加密的密码与数据库密码进行比对CharSequence rawPassword 表单字段 encodedPassword
    26.             // 数据库加密字段
    27.             public boolean matches(CharSequence rawPassword, String encodedPassword) {
    28.                 System.out.println("rawPassword:" + rawPassword + ",encodedPassword:" + encodedPassword);
    29.                 // 返回true 表示认证成功 返回fasle 认证失败
    30.                 return MD5Util.encode((String) rawPassword).equals(encodedPassword);
    31.             }
    33.             // 对表单密码进行加密
    34.             public String encode(CharSequence rawPassword) {
    35.                 System.out.println("rawPassword:" + rawPassword);
    36.                 return MD5Util.encode((String) rawPassword);
    37.             }
    38.         });
    39.     }
    41.     // 配置拦截请求资源
    42.     protected void configure(HttpSecurity http) throws Exception {
    43.         ExpressionUrlAuthorizationConfigurer<HttpSecurity>.ExpressionInterceptUrlRegistry authorizeRequests = http
    44.                 .authorizeRequests();
    45.         // 1.读取数据库权限列表
    46.         List<Permission> listPermission = permissionMapper.findAllPermission();
    47.         for (Permission permission : listPermission) {
    48.             // 设置权限
    49.             authorizeRequests.antMatchers(permission.getUrl()).hasAnyAuthority(permission.getPermTag());
    50.         }
    51.         authorizeRequests.antMatchers("/login").permitAll().antMatchers("/**").fullyAuthenticated().and().formLogin()
    52.                 .loginPage("/login").successHandler(successHandler).and().csrf().disable();
    54.     }
    56.     @Bean
    57.     public static NoOpPasswordEncoder passwordEncoder() {
    58.         return (NoOpPasswordEncoder) NoOpPasswordEncoder.getInstance();
    59.     }
    61. }

    工具类学习

    public class MD5Util {

    // 加盐
    private static final String SALT = "mayikt";

    public static String encode(String password) {
        password = password + SALT;
        MessageDigest md5 = null;
        try {
            md5 = MessageDigest.getInstance("MD5");
        } catch (Exception e) {
            throw new RuntimeException(e);
        }
        char[] charArray = password.toCharArray();
        byte[] byteArray = new byte[charArray.length];

        for (int i = 0; i < charArray.length; i++)
            byteArray[i] = (byte) charArray[i];
        byte[] md5Bytes = md5.digest(byteArray);
        StringBuffer hexValue = new StringBuffer();
        for (int i = 0; i < md5Bytes.length; i++) {
            int val = ((int) md5Bytes[i]) & 0xff;
            if (val < 16) {
                hexValue.append("0");
            }

            hexValue.append(Integer.toHexString(val));
        }
        return hexValue.toString();
    }

    public static void main(String[] args) {
        System.out.println(MD5Util.encode("123456"));

    }
}

    其实用户权限的信息存放在session里的，应用spring-session框架可以做一些优化处理；

    springboot-security.docx上课代码.zip11.12 PPT.pptx