场景
代码
springboot+springsecurity+mysql(jpa)实现：
1.pom依赖：
org.springframework.boot
spring-boot-starter-security
org.springframework.boot
spring-boot-starter-thymeleaf
org.springframework.boot
spring-boot-starter-data-jpa
mysql
mysql-connector-java
2.application配置：
spring.thymeleaf.prefix=classpath:/page/
#mysql连接地址 spring.datasource.url=jdbc:mysql://localhost:3307/springboot_test #mysql用户名和密码 spring.datasource.username=root spring.datasource.password=root #driver驱动 spring.datasource.driver-class-name=com.mysql.jdbc.Driver #show sql spring.jpa.show-sql=true # Hibernate ddl auto (create, create-drop, update) #### hibernate的ddl-auto=update配置表名，数据库的表和列会自动创建(根据Java实体) spring.jpa.hibernate.ddl-auto=update # 方言 spring.jpa.properties.hibernate.dialect=org.hibernate.dialect.MySQL5Dialect
3.连接数据库：db->bean->dao->service
public interface UserDao extends JpaRepository{
User findByUserName(String userName);
User findByUserNameAndPassword(String userName, String password);
}
@Servicepublic classUserService {
@AutowiredprivateUserDao userDao;publicUser findById(Long id){returnuserDao.findOne(id);
}publicUser findByUserName(String userName){returnuserDao.findByUserName(userName);
}publicUser login(String userName, String password){returnuserDao.findByUserNameAndPassword(userName, password);
}public ListuserList(){returnuserDao.findAll();
}
}
实体类User
@Entity
@Table(name= "user")public class User implementsUserDetails {
@Id
@GeneratedValue(strategy=GenerationType.AUTO)privateLong id;privateString userName;privateString password;privateString pwdBak;privateString role;publicLong getId() {returnid;
}public voidsetId(Long id) {this.id =id;
}publicString getUserName() {returnuserName;
}public voidsetUserName(String userName) {this.userName =userName;
}
@Overridepublic Collection extends GrantedAuthority>getAuthorities() {
List auths = new ArrayList<>();
auths.add(new SimpleGrantedAuthority(this.getRole()));returnauths;
}publicString getPassword() {returnpassword;
}
@OverridepublicString getUsername() {return this.userName;
}
@Overridepublic booleanisAccountNonExpired() {return true;
}
@Overridepublic booleanisAccountNonLocked() {return true;
}
@Overridepublic booleanisCredentialsNonExpired() {return true;
}
@Overridepublic booleanisEnabled() {return true;
}public voidsetPassword(String password) {this.password =password;
}publicString getPwdBak() {returnpwdBak;
}public voidsetPwdBak(String pwdBak) {this.pwdBak =pwdBak;
}publicString getRole() {returnrole;
}public voidsetRole(String role) {this.role =role;
}
@OverridepublicString toString() {return "User{" +
"id=" + id +
", userName='" + userName + '\'' +
", password='" + password + '\'' +
", pwdBak='" + pwdBak + '\'' +
", role='" + role + '\'' +
'}';
}
}
4.websecurity配置：
@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled= true)//开启进入Controller之前，检验权限。这个注解配置后，[emailprotected]("hasAnyAuthority('ADMIN')")才会生效
public class WebSecurityConfig extendsWebSecurityConfigurerAdapter{
@SuppressWarnings("SpringJavaAutowiringInspection")
@AutowiredprivateMyUDService myUDService;
@Bean
@Overrideprotected AuthenticationManager authenticationManager() throwsException {return super.authenticationManager();
}
@Overrideprotected void configure(HttpSecurity httpSecurity) throwsException {
httpSecurity.authorizeRequests()
.antMatchers("/", "/login", "/err/*").permitAll() //无需验证权限
.anyRequest().authenticated() //其他地址的访问均需验证权限
.and().formLogin().loginPage("/login").defaultSuccessUrl("/home").permitAll()//指定登录页是"/login"//登录成功后默认跳转到"/home"
.and().logout().logoutSuccessUrl("/login").permitAll(); //退出登录后的默认url是"/login"
}/*** 全局配置
*@parambuilder
*@throwsException*/@Autowiredpublic void configure(AuthenticationManagerBuilder builder) throwsException {
builder
.userDetailsService(myUDService)
.passwordEncoder(this.passwordEncoder());
}/*** 设置用户密码的加密方式：MD5加密
*@return
*/@BeanpublicPasswordEncoder passwordEncoder(){
PasswordEncoder pe= new PasswordEncoder() {//自定义密码加密方式//加密
@OverridepublicString encode(CharSequence charSequence) {returnMD5Util.encode((String)charSequence);
}//校验密码
@Overridepublic booleanmatches(CharSequence charSequence, String s) {returnMD5Util.encode((String)charSequence).equals(s);
}
};returnpe;
}
}
5.用户权限查询类UserDetailsService：
@Componentpublic class MyUDService implementsUserDetailsService {
@AutowiredprivateUserService userService;
@Overridepublic UserDetails loadUserByUsername(String s) throwsUsernameNotFoundException {
User user=userService.findByUserName(s);if(user == null) {throw new UsernameNotFoundException("UserName " + s + " not found");
}
System.out.println("用户" + s + "：" +user);returnuser;
}
}
6.启动类：
@SpringBootApplicationpublic classStart02App {public static voidmain(String[] args) {
SpringApplication.run(Start02App.class, args);
}/*** 自定义异常页*/@BeanpublicEmbeddedServletContainerCustomizer containerCustomizer() {return newEmbeddedServletContainerCustomizer(){
@Overridepublic voidcustomize(ConfigurableEmbeddedServletContainer container) {
container.addErrorPages(new ErrorPage(HttpStatus.NOT_FOUND, "/error/404"));
container.addErrorPages(new ErrorPage(HttpStatus.INTERNAL_SERVER_ERROR, "/error/500"));
container.addErrorPages(new ErrorPage(java.lang.Throwable.class,"/error/500"));
container.addErrorPages(new ErrorPage(HttpStatus.FORBIDDEN,"/error/403"));
}
};
}
}
7.页面
8.往数据库插入数据(单元测试)：
@RunWith(SpringRunner.class)
@SpringBootTest(classes= Start02App.class)public classUserServiceTest {
@AutowiredprivateUserDao userDao;
@AutowiredprivateUserService userService;private ObjectMapper objectMapper = newObjectMapper();
@Testpublic void testAll() throwsJsonProcessingException {this.saveUser();this.list();
}private void saveUser() throwsJsonProcessingException {
User admin= newUser();
admin.setUserName("admin");
admin.setPassword(MD5Util.encode("admin"));
admin.setPwdBak("admin");
admin.setRole("ADMIN");
User adminSave=userDao.save(admin);for(int i=0;i<=5;i++) {
System.out.println("admin save--->:" +objectMapper.writeValueAsString(adminSave));
User user= newUser();
user.setUserName("test"+i);
user.setPassword(MD5Util.encode("user" +i));
user.setPwdBak("user" +i);
user.setRole("USER");
User userSave=userDao.save(user);
System.out.println("user save--->:" +objectMapper.writeValueAsString(userSave));
}
}private void list() throwsJsonProcessingException {
List userList =userService.userList();
System.out.println("用户列表：" +objectMapper.writeValueAsString(userList));
}
}
查看数据库：
效果
启动app类，访问：http://localhost:8080/
测试：
先点击“去主页”或“查看用户列表”，要求输入用户名密码：
使用admin登录，跳转到主页：
返回后，点击去“用户列表”，跳转到403，提示没有权限：
注销后使用普通用户登录，可以跳转到用户列表页面：
测试500页面：
测试404页面：
mysql 权限信息存储库_springboot-security02FromDB 权限管理（用户信息和角色信息保存在数据库）详解...
