SpringSecurity概念及整合ssm框架的示例详解

<!-- SpringSecurity 对 WEB 应用进行权限管理 -->
<dependency>
<groupId>org.springframework.security</groupId>
<artifactId>spring-security-web</artifactId>
<version>4.2.10.RELEASE</version>
</dependency>
<!-- SpringSecurity 配置 -->
<dependency>
<groupId>org.springframework.security</groupId>
<artifactId>spring-security-config</artifactId>
<version>4.2.10.RELEASE</version>
</dependency>
<!-- SpringSecurity 标签库 -->
<dependency>
<groupId>org.springframework.security</groupId>
<artifactId>spring-security-taglibs</artifactId>
<version>4.2.10.RELEASE</version>
</dependency>

    <filter>
        <filter-name>springSecurityFilterChain</filter-name>
        <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
    </filter>
    <filter-mapping>
        <filter-name>springSecurityFilterChain</filter-name>
        <url-pattern>
    @PreAuthorize("hasAuthority('role:get') or hasAnyRole('经理')")// 需要有role:get权限才可以访问
    @ResponseBody
    @GetMapping("/role/get/page/info.JSON")
    public ResultEntity<PageInfo<Role>> getPageInfo(
            @RequestParam(value = "pageNum", defaultValue = "1") Integer pageNum,
            @RequestParam(value = "pageSize", defaultValue = "4") Integer pageSize,
            @RequestParam(value = "keyWord", defaultValue = "") String keyword
    ) {
        // 获取页面数据
        PageInfo<Role> pageInfo = roleService.getRoleByKeyword(pageNum, pageSize, keyword);
        // 如果出现异常，dispatcherServlet会进行处理
        return ResultEntity.successWithData(pageInfo);
    }

@PostAuthorize("returnObject.data.loginAcct == principal.username")

@PreFilter(value="filterObject%2==0")
@ResponseBody
@RequestMapping("/admin/test/pre/filter")
public ResultEntity<List<Integer>> saveList(@RequestBody List<Integer> valueList) {
return ResultEntity.successWithData(valueList);
}

package com.atguigu.crowd.mvc.config;

import com.atguigu.crowd.entity.Admin;
import com.atguigu.crowd.entity.Role;
import com.atguigu.crowd.service.api.AdminService;
import com.atguigu.crowd.service.api.AuthService;
import com.atguigu.crowd.service.api.RoleService;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.authority.SimpleGrantedAuthority;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.core.userdetails.UsernameNotFoundException;
import org.springframework.stereotype.Component;

import java.util.ArrayList;
import java.util.List;

@Component
public class CrowdUserDetailsService implements UserDetailsService {
    @Autowired
    private AdminService adminService;
    @Autowired
    private RoleService roleService;
    @Autowired
    private AuthService authService;

    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        // 1、根据账号名称查找Admin对象
        Admin admin = adminService.getAdminByLoginAcct(username);
        // 2、获取adminId
        Integer adminId = admin.getId();
        // 3、根据adminId查询角色信息
        List<Role> roles = roleService.getAssignedRole(adminId);
        // 4、根据adminId查询权限名字信息
        List<String> auths = authService.getAssignedAuthNameByAdminId(adminId);
        // 5、创建集合对象来存储GrantedAuthority
        ArrayList<GrantedAuthority> authorities = new ArrayList<>();
        // 6、遍历存入角色消息
        for (int i = 0; i < roles.size(); i++) {
            // 需要加前缀，因为SpringSecurity就是通过ROLE_来区分是角色还是权限
            String roleName = "ROLE_" + roles.get(i).getName();
            SimpleGrantedAuthority authority = new SimpleGrantedAuthority(roleName);
            authorities.add(authority);
        }
        // 7、遍历存入权限信息
        for (int i = 0; i < auths.size(); i++) {
            String authName = auths.get(i);
            SimpleGrantedAuthority authority = new SimpleGrantedAuthority(authName);
            authorities.add(authority);
        }
        // 8、封装到SecurityAdmin对象中，它继承了SpringSecurity的User类
        SecurityAdmin securityAdmin = new SecurityAdmin(admin, authorities);
        return securityAdmin;
    }
}

<%--需要导入taglib--%>
<%@ taglib uri="Http://www.springframework.org/security/tags" prefix="security" %>
<%--principal 是我们自己封装的 SecurityAdmin 对象(返回的SpringSecurity的User对象)--%>
<security:authentication property="principal.originalAdmin.userName"/>

<%--需要导入taglib--%>
<%@ taglib uri="http://www.springframework.org/security/tags" prefix="security" %>
<security:authorize access="hasRole('经理')">
    <!-- 开始和结束标签之间是要进行权限控制的部分。检测当前用户是否有权限，有权限
    就显示这里的内容，没有权限就不显示。 --> ……
</security:authorize>

### 标签库控制

```html
<%--需要导入taglib--%>
<%@ taglib uri="http://www.springframework.org/security/tags" prefix="security" %>
<security:authorize access="hasRole('经理')">
    <!-- 开始和结束标签之间是要进行权限控制的部分。检测当前用户是否有权限，有权限
    就显示这里的内容，没有权限就不显示。 --> ……
</security:authorize>