SpringBoot整合SpringSecurity

最新推荐文章于 2025-01-16 21:33:51 发布

好好学习天天向上W

最新推荐文章于 2025-01-16 21:33:51 发布

阅读量99

点赞数

CC 4.0 BY-SA版权

本文链接：https://blog.csdn.net/qq_41458842/article/details/108731289

本文介绍如何在Spring Boot项目中集成Spring Security，并通过MyBatis进行用户认证与授权。包括添加依赖、数据库配置、实现UserDetails接口、创建Mapper接口、提供认证服务及配置类等步骤。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

1.导入相关的依赖

        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-web</artifactId>
        </dependency>

        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-security</artifactId>
        </dependency>
        
        <dependency>
            <groupId>mysql</groupId>
            <artifactId>mysql-connector-java</artifactId>
            <version>5.1.47</version>
        </dependency>

        <dependency>
            <groupId>tk.mybatis</groupId>
            <artifactId>mapper-spring-boot-starter</artifactId>
            <version>2.1.5</version>
        </dependency>

2.在配置文件添加数据库的配置

spring:
  datasource:
    driver-class-name: com.mysql.jdbc.Driver
    url: jdbc:mysql:///security
    username: root
    password: root
        
mybatis:
  type-aliases-package: com.itheima.domain
  configuration:
    #  驼峰标识
    map-underscore-to-camel-case: true
        
#显示执行的sql语句
logging:
  level:
    com.itheima: debug

使用SpringSecurity的角色规范，即实现GrantedAuthority

public class SysRole implements GrantedAuthority {
    private Integer id;
    private String roleName;
    private String roleDesc;

    public Integer getId() {
        return id;
    }

    public void setId(Integer id) {
        this.id = id;
    }

    public String getRoleName() {
        return roleName;
    }

    public void setRoleName(String roleName) {
        this.roleName = roleName;
    }

    public String getRoleDesc() {
        return roleDesc;
    }

    public void setRoleDesc(String roleDesc) {
        this.roleDesc = roleDesc;
    }

    @JsonIgnore
    @Override
    public String getAuthority() {
        return roleName;
    }
}

实现SpringSecurity的用户对象接口，并添加角色集合私有属性，即实现UserDetails

public class SysUser implements UserDetails {
    private Integer id;
    private String username;
    private String password;
    private Integer status;
    private List<SysRole> roles;

    @JsonIgnore
    @Override
    public Collection<? extends GrantedAuthority> getAuthorities() {
        return roles;
    }

    @Override
    public String getPassword() {
        return password;
    }

    @Override
    public String getUsername() {
        return username;
    }
    @JsonIgnore
    @Override
    public boolean isAccountNonExpired() {
        return true;
    }
    @JsonIgnore
    @Override
    public boolean isAccountNonLocked() {
        return true;
    }
    @JsonIgnore
    @Override
    public boolean isCredentialsNonExpired() {
        return true;
    }
    @JsonIgnore
    @Override
    public boolean isEnabled() {
        return true;
    }

    public Integer getId() {
        return id;
    }

    public void setId(Integer id) {
        this.id = id;
    }

    public void setUsername(String username) {
        this.username = username;
    }

    public void setPassword(String password) {
        this.password = password;
    }

    public Integer getStatus() {
        return status;
    }

    public void setStatus(Integer status) {
        this.status = status;
    }
}

4.创建相应的Mapper接口

public interface RoleMapper extends Mapper<SysRole> {

    @Select("select r.id,r.role_name roleName,r.role_desc roleDesc " +
            "from sys_role r,sys_user_role ur " +
            "where r.id = ur.rid and ur.uid = #{uid}")a
    public List<SysRole> findByUid(Integer uid);
}

public interface UserMapper  extends Mapper<SysUser> {

    @Select("select * from sys_user where username=#{username}")
    @Results ({
        @Result(id = true,property = "id",column = "id"),
        @Result(property = "roles",column = "id",javaType = List.class,
        many = @Many(select = "com.itheima.mapper.RoleMapper.findByUid"))
    })
    public SysUser findByUsername(String username);
}

5.提供认证接口，需要继承UserDetailsService

public interface UserService extends UserDetailsService {

}

6.提供认证service实现类

@Service
@Transactional
public class UserServiceImpl implements UserService {
    @Autowired
    private UserMapper userMapper;
    
    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        return userMapper.findByUsername(username);
    }
}

7.完成配置类

配置类需要完成两件事情：认证用户的来源，配置SpringSecurity的相关信息

@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(securedEnabled = true)
public class SecurityConfig extends WebSecurityConfigurerAdapter {
  
    @Autowired
    private UserService userService;

    //		设置密码
    @Bean
    public  BCryptPasswordEncoder passwordEncoder(){
        return new BCryptPasswordEncoder();
    }
    
    //    表明认证用户的来源(来自于数据库)
    public void configure(AuthenticationManagerBuilder auth) throws Exception {
       auth.userDetailsService(userService).passwordEncoder(passwordEncoder());
    }
    

    //    配置SpringSecurity的相关信息
    public void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests()
                .antMatchers("/login.jsp", "/failer.jsp", "/css/**", "/img/**", "/plugins/**").permitAll()
                .antMatchers("/**").hasAnyRole("USER")
                .anyRequest()
                .authenticated()
                .and()
                .formLogin()
                .loginPage("/login.jsp")
                .loginProcessingUrl("/login")
                .successForwardUrl("/index.jsp")
                .failureForwardUrl("/failer.jsp")
                .permitAll()
                .and()
                .logout()
                .logoutUrl("/logout")
                .invalidateHttpSession(true)
                .logoutSuccessUrl("/login.jsp")
                .permitAll()
                .and()
                .csrf()
                .disable();
    }
}