源代码

package club.zstuca.myzstu.filter;import club.zstuca.myzstu.entity.Resource;
import club.zstuca.myzstu.entity.Role;
import club.zstuca.myzstu.mapper.ResourceMapper;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.security.access.ConfigAttribute;
import org.springframework.security.access.SecurityConfig;
import org.springframework.security.web.FilterInvocation;
import org.springframework.security.web.access.intercept.FilterInvocationSecurityMetadataSource;
import org.springframework.stereotype.Component;
import org.springframework.util.AntPathMatcher;import java.util.Collection;
import java.util.List;/*** @Author ShenTuZhiGang* @Version 1.0.0* @Date 2020-03-07 21:57*/
@Component
public class CustomFilterInvocationSecurityMetadataSourceimplements FilterInvocationSecurityMetadataSource {AntPathMatcher antPathMatcher = new AntPathMatcher();@Autowiredprivate ResourceMapper resourceMapper;@Overridepublic Collection<ConfigAttribute> getAttributes(Object o) throws IllegalArgumentException {String ruquestUrl = ((FilterInvocation) o).getRequestUrl();List<Resource> resources = resourceMapper.getAllResource();for (Resource resource : resources){if(antPathMatcher.match(resource.getPattern(),ruquestUrl)){List<Role> roles = resource.getRoles();String[] roleArr = new String[roles.size()];for (int i = 0; i < roleArr.length;i++ ){roleArr[i] = roles.get(i).getName();}return SecurityConfig.createList(roleArr);}}return SecurityConfig.createList("ROLE_LOGIN");}@Overridepublic Collection<ConfigAttribute> getAllConfigAttributes() {return null;}@Overridepublic boolean supports(Class<?> aClass) {return FilterInvocation.class.isAssignableFrom(aClass);}
}

package club.zstuca.myzstu.filter;import org.springframework.security.access.AccessDecisionManager;
import org.springframework.security.access.AccessDeniedException;
import org.springframework.security.access.ConfigAttribute;
import org.springframework.security.authentication.InsufficientAuthenticationException;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.stereotype.Component;import java.util.Collection;/*** @Author ShenTuZhiGang* @Version 1.0.0* @Date 2020-03-07 22:26*/
@Component
public class CustomAccessDecisionManager implements AccessDecisionManager {@Overridepublic void decide(Authentication authentication, Object o, Collection<ConfigAttribute> collection) throws AccessDeniedException, InsufficientAuthenticationException {Collection<? extends GrantedAuthority> auths = authentication.getAuthorities();for(ConfigAttribute configAttribute:collection){if("ROLE_LOGIN".equals(configAttribute.getAttribute())&& authentication instanceof UsernamePasswordAuthenticationToken){return;}for(GrantedAuthority authority : auths){if(configAttribute.getAttribute().equals(authority.getAuthority())){return;}}}throw new AccessDeniedException("权限不足");}@Overridepublic boolean supports(ConfigAttribute configAttribute) {return true;}@Overridepublic boolean supports(Class<?> aClass) {return true;}
}

package club.zstuca.myzstu.config;import club.zstuca.myzstu.dto.ApiResponse;
import club.zstuca.myzstu.handler.AuthenticationAccessDeniedHandler;
import club.zstuca.myzstu.security.CustomAccessDecisionManager;
import club.zstuca.myzstu.security.CustomFilterInvocationSecurityMetadataSource;
import club.zstuca.myzstu.service.IUserService;
import club.zstuca.myzstu.utils.ApiResponseUtil;
import com.fasterxml.jackson.databind.ObjectMapper;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.ObjectPostProcessor;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.builders.WebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.AuthenticationException;
import org.springframework.security.crypto.password.NoOpPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.web.access.intercept.FilterSecurityInterceptor;
import org.springframework.security.web.authentication.AuthenticationFailureHandler;
import org.springframework.security.web.authentication.AuthenticationSuccessHandler;import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
import java.io.PrintWriter;/*** @Author ShenTuZhiGang* @Version 1.0.0* @Date 2020-03-07 16:48*/
@Configuration
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class MyZSTUWebSecurityConfig extends WebSecurityConfigurerAdapter {@AutowiredIUserService iUserService;@AutowiredCustomFilterInvocationSecurityMetadataSource customFilterInvocationSecurityMetadataSource;@AutowiredCustomAccessDecisionManager customAccessDecisionManager;@AutowiredAuthenticationAccessDeniedHandler authenticationAccessDeniedHandler;@BeanPasswordEncoder passwordEncoder(){return NoOpPasswordEncoder.getInstance();}@Overridepublic void configure(WebSecurity web){web.ignoring().antMatchers("/index.html");}@Overrideprotected void configure(AuthenticationManagerBuilder auth)throws Exception{auth.userDetailsService(iUserService);}@Overrideprotected void configure(HttpSecurity http)throws Exception{http.authorizeRequests().withObjectPostProcessor(new ObjectPostProcessor<FilterSecurityInterceptor>() {@Overridepublic <O extends FilterSecurityInterceptor> O postProcess(O object) {object.setSecurityMetadataSource(customFilterInvocationSecurityMetadataSource);object.setAccessDecisionManager(customAccessDecisionManager);return object;}}).and().formLogin()//.loginPage("/login").loginProcessingUrl("/login").usernameParameter("username").passwordParameter("password").failureHandler(new AuthenticationFailureHandler() {@Overridepublic void onAuthenticationFailure(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, AuthenticationException e) throws IOException, ServletException {httpServletResponse.setContentType("application/json;charset=UTF-8");ApiResponse retTemp = ApiResponseUtil.getRetTemp();retTemp.setCode("400");retTemp.setMsg("登录失败");PrintWriter out = httpServletResponse.getWriter();out.write(new ObjectMapper().writeValueAsString(retTemp));out.flush();out.close();}}).successHandler(new AuthenticationSuccessHandler() {@Overridepublic void onAuthenticationSuccess(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, Authentication authentication) throws IOException, ServletException {httpServletResponse.setContentType("application/json;charset=UTF-8");ApiResponse retTemp = ApiResponseUtil.getRetTemp();retTemp.setCode("200");retTemp.setMsg("登录成功");retTemp.setData(authentication.getPrincipal());PrintWriter out = httpServletResponse.getWriter();out.write(new ObjectMapper().writeValueAsString(retTemp));out.flush();out.close();}}).permitAll().and().logout().permitAll().and().csrf().disable().exceptionHandling().accessDeniedHandler(authenticationAccessDeniedHandler);}
}

教学资源

https://www.bilibili.com/video/av73730658?p=13

常见问题

Filter过滤器注入Bean时注入失败[NULL]

参考文章

https://blog.csdn.net/qushapos/article/details/84940810

https://segmentfault.com/a/1190000010232638

https://blog.csdn.net/lichuangcsdn/article/details/95041605

https://github.com/lenve/vhr

Spring Boot——配置Spring Security配置类DEMO相关推荐

Spring Security 实战：Spring Boot 下的自动配置
点击上方蓝色"程序猿DD",选择"设为星标" 回复"资源"获取独家整理的学习资料! 来源 | 公众号「码农小胖哥」 1. 前言我们在前几篇 ...
springboot 读取配置文件_使用 @ConfigurationProperties 在 Spring Boot 中加载配置
本文地址: 使用 @ConfigurationProperties 在 Spring Boot 中加载配置使用 Spring Boot 加载配置文件的配置非常便利,我们只需要使用一些注解配置一下就能 ...
Spring Boot 2.0 的配置详解（图文教程）
本文来自作者泥瓦匠 @ bysocket.com 在 GitChat 上分享「Spring Boot 2.0 的配置详解(图文教程)」编辑 | 哈比 Spring Boot 配置,包括自动配置和 ...
boot spring 接口接收数据_在 Spring Boot 中使用 Dataway 配置数据查询接口
Dataway介绍 Dataway 是基于 DataQL 服务聚合能力,为应用提供的一个接口配置工具.使得使用者无需开发任何代码就配置一个满足需求的接口. 整个接口配置.测试.冒烟.发布.一站式都通过 ...
datav本地部署 java,Spring Boot对Spring Data JPA的自动配置
一点睛 Spring Boot对Spring Data JPA的自动配置放置在如下路径: 二源码分析 1 JpaRepositoriesAutoConfiguration类分析 @Configur ...
Spring Boot Validation提示信息国际化配置
引言之前介绍过Spring Boot Validation的使用及扩展,可参见:<SpringBoot Validation> 本文在此基础上重点讲解下Spring Boot Valid ...
Spring Boot 灵活实现自动配置背后的故事~用起来更香了
最近一直忙着在做新应届生的员工技术培训和面试 ,培训的则是Spring Boot部分的内容,这部分也是面试常问的点,于是想到了各位读者大大,特地的把内容分享大家一份. 不知道大家第一次搭Spring ...
spring boot通过命令行配置属性
spring boot通过命令行配置属性命令:java -jar xxx.jar --server.port=8888,通过使用–-server.port属性来设置xxx.jar应用的端口为8888 ...
chrome charset使用_使用JWT保护你的Spring Boot应用 Spring Security实战
关键词 Spring Boot.OAuth 2.0.JWT.Spring Security.SSO.UAA 写在前面最近安静下来,重新学习一些东西,最近一年几乎没写过代码.整天疲于奔命的日子终于结束 ...
使用JWT保护你的Spring Boot应用 - Spring Security实战
使用JWT保护你的Spring Boot应用 - Spring Security实战作者 freewolf 原创文章转载请标明出处关键词 Spring Boot.OAuth 2.0.JWT.Spr ...

Spring Boot——配置Spring Security配置类DEMO

源代码

教学资源

常见问题

参考文章

Spring Boot——配置Spring Security配置类DEMO相关推荐

最新文章

热门文章