问题：
公司主营业务：成都网站建设、做网站、移动网站开发等业务。帮助企业客户真正实现互联网宣传，提高企业的竞争能力。创新互联是一支青春激扬、勤奋敬业、活力青春激扬、勤奋敬业、活力澎湃、和谐高效的团队。公司秉承以“开放、自由、严谨、自律”为核心的企业文化，感谢他们对我们的高要求，感谢他们从不同领域给我们带来的挑战，让我们激情的团队有机会用头脑与智慧不断的给客户带来惊喜。创新互联推出龙文免费做网站回馈大家。
如何在springboot项目中使用springsecurity去实现角色权限管理呢？本文将尽可能简单的一步步实现对接口的角色权限管理。
项目框架：
sql:
user表：
CREATE TABLE `user` ( `Id` int NOT NULL AUTO_INCREMENT, `UserName` varchar(255) NOT NULL, `CreatedDT` datetime DEFAULT NULL, `Age` int DEFAULT NULL, `Gender` int DEFAULT NULL, `Password` varchar(255) NOT NULL, PRIMARY KEY (`Id`) ) ENGINE=InnoDB AUTO_INCREMENT=2 DEFAULT CHARSET=utf8;
role表：
CREATE TABLE `role` ( `Id` int NOT NULL AUTO_INCREMENT, `UserId` int DEFAULT NULL, `Role` varchar(255) DEFAULT NULL, `CreatedDT` datetime DEFAULT NULL, PRIMARY KEY (`Id`) ) ENGINE=InnoDB AUTO_INCREMENT=3 DEFAULT CHARSET=utf8;
maven：
在pom.xml中加入
org.projectlombok lombok true org.springframework.boot spring-boot-starter-security cn.hutool hutool-all 4.5.7
model:
实体类User要实现springsecurity的基本接口UserDetails,UserDetails里继承了Serializable，不用担心序列化
@Data
public class User implements UserDetails {
public User() {
}
private static final long serialVersionUID = 1L;
private Integer id;
private String userName;
private Date createdDT;
private Integer age;
private Integer gender;
private String passWord;
private String role;
private List authorities;
public User(String userName, String passWord, List authorities) {
this.userName = userName;
this.passWord = passWord;
this.authorities = authorities;
}
@Override
public Collection<? extends GrantedAuthority> getAuthorities() {
return authorities;
}
@Override
public String getPassword() {
return this.passWord;
}
@Override
public String getUsername() {
return this.userName;
}
@Override
public boolean isAccountNonExpired() {
return true;
}
@Override
public boolean isAccountNonLocked() {
return true;
}
@Override
public boolean isCredentialsNonExpired() {
return true;
}
@Override
public boolean isEnabled() {
return true;
}
} 实体类role:
@Data
public class Role implements Serializable {
private Integer id;
private String role;
private Date createdDT;
private Integer userId;
} mapper:
@Mapper
public interface UserMapper{
User selectOneByName(User user);
}service:
public interface UserService{
User selectOneByName(User user) throws ServiceException;
}serviceImpl:
@Service
public class UserServiceImpl implements UserService {
@Autowired
private UserMapper mapper;
@Override
public User selectOneByName(User user) throws ServiceException {
return mapper.selectOneByName(user);
}
}mapper.xml:
<?xml version="1.0" encoding="UTF-8"?> Id, UserName, CreatedDT, Age, Gender,Password
config:
首先实现UserDetailsService类。自定义获取用户信息和角色信息。
@Component
public class CustomUserDetailsService implements UserDetailsService {
@Autowired
private UserService userService;
@Autowired
private HttpServletRequest request;
@Override
public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
// 通过用户名从数据库获取用户信息
User user = userService.selectOneByName(new User(){
{
setUserName(username);
}
});
if (user == null) {
throw new UsernameNotFoundException("用户不存在");
}
HttpSession session = request.getSession();
session.setAttribute(session.getId(),user);
// 得到用户角色
String role = user.getRole();
// 角色集合
List authorities = new ArrayList<>();
// 角色必须以`ROLE_`开头，数据库中没有，则在这里加
authorities.add(new SimpleGrantedAuthority("ROLE_" + role));
return new User(
user.getUsername(),
user.getPassword(),
authorities
);
}
} 自定义错误提示
@Component
public class MyAccessDeniedHandler implements AccessDeniedHandler {
@Override
public void handle(HttpServletRequest request, HttpServletResponse response, AccessDeniedException accessDeniedException) throws IOException, ServletException {
response.setCharacterEncoding("UTF-8");
response.setContentType("application/json");
response.getWriter().println("{'code':'403','message':'没有访问权限'}");
response.getWriter().flush();
}
}终于来到security的配置了
@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
@Autowired
private CustomUserDetailsService userDatailService;
@Autowired
private MyAccessDeniedHandler accessDeniedHandler;
@Bean
public PasswordEncoder passwordEncoder(){
return new BCryptPasswordEncoder();
}
@Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
auth
.userDetailsService(userDatailService)
.passwordEncoder(passwordEncoder());
}
@Override
protected void configure(HttpSecurity http) throws Exception {
http
.headers().frameOptions().disable()
.and()
.authorizeRequests()
.antMatchers("不限制访问的路径，如：'/user/*'").permitAll()
.antMatchers("用户拥有规定角色才允许访问的路径，如：'/user/delte'").hasRole("admin")
.antMatchers("规定ip才允许访问的路径，如：'/*'").hasIpAddress("192.168.1.1/24");
.anyRequest().authenticated() // 所有请求都需要验证
.and()
// 跳转自定义成功页
.formLogin().defaultSuccessUrl("/html/index.html")
.and()
.exceptionHandling()
//用户无权限访问链接，给出友好提示
.accessDeniedHandler(accessDeniedHandler)
.and()
.csrf().disable();// post请求要关闭csrf验证,不然访问报错；实际开发中要开启。
}
}至此，springsecurity的角色权限管理就完成了，如果想要实现方法级的角色权限限制，可以在方法前加入 @PreAuthorize("hasRole('角色')")注解,多个角色可以使用hasAnyRole(),就可以限制拥有规定角色权限的用户才能访问了。
@PreAuthorize("hasRole('admin')")
@RequestMapping(value = "/delete")
public CommonResult delete(@RequestBody int id) {
int i = userService.delete(new User() {
{
setId(id);
}
});
return i > 0 ? processSuccess("删除成功") : processFailure("删除失败");
}到此这篇关于springsecurity轻松实现角色权限的示例代码的文章就介绍到这了,更多相关springsecurity 角色权限内容请搜索创新互联以前的文章或继续浏览下面的相关文章希望大家以后多多支持创新互联！