Spring Security的持久化用户和授权实现

一.使用JdbcUserDetailsManager（UserDetailsService另一种实现）实现数据库读取用户

1.引入jdbc和相关数据库驱动

<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-jdbc</artifactId>
</dependency>
<dependency>
    <groupId>org.postgresql</groupId>
    <artifactId>postgresql</artifactId>
    <scope>runtime</scope>
</dependency>

2.创建数据库表

--用户表
CREATE TABLE users( 
    username VARCHAR(50)  NOT NULL PRIMARY KEY --用户名, 
    password VARCHAR(500) NOT NULL             --密码, 
    enabled  BOOLEAN      NOT NULL             --有效性
);
--权限表
CREATE TABLE authorities( 
    username  VARCHAR(50) NOT NULL  --用户名, 
    authority VARCHAR(50) NOT NULL  --权限, 
    constraint fk FOREIGN KEY(username) REFERENCES users(username)
);
CREATE unique index ix_auth_username ON authorities (username, authority);

3.配置数据库连接（application.yml）

spring:
    datasource:
        driver-class-name: org.postgresql.Driver
        url: jdbc:postgresql://localhost:5432/security
        username:postgres
        password: postgres

4.修改SecurityConfig配置

@Configuration
public class SecurityConfig {
    //配置Security过滤链
    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        //配置哪些接口需要认证(.anyRequest().authenticated()代表任何请求都需认证)
        http.authorizeHttpRequests(authorize -> {
            authorize.anyRequest().authenticated();
        });
        //配置post表单请求/login接口
        http.formLogin(Customizer.withDefaults());
        //csrf攻击：开发环境可不配方便调试，上线环境需配置，否则会遭csrf攻击
        http.csrf(AbstractHttpConfigurer::disable);
        //返回Security过滤链对象
        return http.build();
    }

    @Bean //配置JdbcUserDetailsManager实现数据库存储用户
    public UserDetailsService userDetailsService(DataSource dataSource) {
        return new JdbcUserDetailsManager(dataSource);
    }
}

二.实现Spring Security授权功能

1.创建接口

@RestController
public class HelloController{

    @RequestMapping("/hello")
    public String hello() { 
        return "Hello Security"; 
    }

    @RequestMapping("/hello1")
    public String hello1() { 
        return "Hello Security1"; 
    }

}

2.配置数据库账号和权限（DbUser用户拥有hello和hello1权限、DbUser1只拥有hello1权限）

3.修改SecurityConfig配置

@Configuration
public class SecurityConfig {
    //配置Security过滤链
    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        //配置哪些接口需要认证(.anyRequest().authenticated()代表任何请求都需认证)
        http.authorizeHttpRequests(authorize -> {
            authorize.requestMatchers("/hello").hasAuthority("hello");
            authorize.requestMatchers("/hello1").hasAuthority("hello1");
            authorize.anyRequest().authenticated();
        });
        //配置post表单请求/login接口
        http.formLogin(Customizer.withDefaults());
        //csrf攻击：开发环境可不配方便调试，上线环境需配置，否则会遭csrf攻击
        http.csrf(AbstractHttpConfigurer::disable);
        //返回Security过滤链对象
        return http.build();
    }

    @Bean //配置JdbcUserDetailsManager实现数据库存储用户
    public UserDetailsService userDetailsService(DataSource dataSource) {
        return new JdbcUserDetailsManager(dataSource);
    }
}