第一节-spring-security配置权限规则

零、maven依赖

        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-security</artifactId>
        </dependency>

        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-web</artifactId>
        </dependency>



        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-freemarker</artifactId>
        </dependency>

一、项目包结构

二、MemberService的代码

@RestController
public class MemberService {
    /**
     * 增加成员
     * @return 添加成功
     */
    @RequestMapping("/addMember")
    public String addMember(){
        return"addMember";
    }
    
    /**
     * 删除成员
     * @return 删除成功
     */
    @RequestMapping("/deleteMember")
    public String deleteMember(){
        return"deleteMember";
    }
    
    /**
     * 修改成员信息
     * @return 修改成功
     */
    @RequestMapping("/updateMember")
    public String updateMember(){
        return"updateMember";
    }
    
    /**
     * 查询成员
     * @return 成员信息
     */
    @RequestMapping("/selectMember")
    public String selectMember(){
        return"selectMember";
    }
}

三、在utils包中创建SecurityConfig类用来配置权限规则

（1）继承WebSecurityConfigurerAdapter类

注意！在SpringBoot2.5的以下的版本中，WebSecurityConfigurerAdapter才不会报错

    <parent>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-parent</artifactId>
        <version>2.5.15</version>
        <relativePath/> <!-- lookup parent from repository -->
    </parent>

（2）重写两个configure方法

@Component//注入到spring容器中
@EnableWebSecurity //开启权限设置
public class SecurityConfig extends WebSecurityConfigurerAdapter {
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        super.configure(http);
    }

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        super.configure(auth);
    }
}

（3）配置权限规则

    // 配置权限
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests().antMatchers("/addMember").hasAuthority("addMember")//接口addMember需要addMember权限
                .antMatchers("/deleteMember").hasAuthority("deleteMember")//接口deleteMember需要deleteMember权限
                .antMatchers("/updateMember").hasAuthority("updateMember")//接口updateMember需要updateMember权限
                .anyRequest().authenticated()//其他接口都需要认证
                .and().formLogin();//允许表单登录
    }

(4)分配用户权限

    // 配置用户权限
    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        //用户addUser拥有addMember权限
        auth.inMemoryAuthentication().withUser("addUser").password("123456").authorities("addMember");
        //用户deleteUser拥有deleteMember权限
        auth.inMemoryAuthentication().withUser("deleteUser").password("123456").authorities("deleteMember");
        //用户updateUser拥有updateMember权限
        auth.inMemoryAuthentication().withUser("updateUser").password("123456").authorities("updateMember");
        //用户admin拥有所有权限
        auth.inMemoryAuthentication().withUser("admin").password("123456").authorities("addMember","deleteMember","updateMember");
    }

四、启动项目

（1）浏览器输入http://localhost:8080/

（2）跳转到表单检验界面

（3）测试用户addUser，输入账号和密码

Spring Security5.x 对所配置的密码必须带上加密方式，如果没有带，就会解析不出来，所以抛错。

重新改写代码

    // 配置用户权限
    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        //用户addUser拥有addMember权限
        auth.inMemoryAuthentication().passwordEncoder(new BCryptPasswordEncoder()).withUser("addUser").password(new BCryptPasswordEncoder().encode("123456")).roles("addUser");
        //用户deleteUser拥有deleteMember权限
        auth.inMemoryAuthentication().passwordEncoder(new BCryptPasswordEncoder()).withUser("deleteUser").password(new BCryptPasswordEncoder().encode("123456")).roles("deleteUser");
        //用户updateUser拥有updateMember权限
        auth.inMemoryAuthentication().passwordEncoder(new BCryptPasswordEncoder()).withUser("updateUser").password(new BCryptPasswordEncoder().encode("123456")).roles("updateUser");
        //管理员拥有所有权限
        auth.inMemoryAuthentication().passwordEncoder(new BCryptPasswordEncoder()).withUser("admin").password(new BCryptPasswordEncoder().encode("123456")).roles("addMember","deleteMember","updateMember");
    }
}

重新运行,输入addUser账户，还是报错

找好久，原因是代码中authorities不能替代为roles

    // 配置用户权限
    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        //用户addUser拥有addMember权限
        auth.inMemoryAuthentication().passwordEncoder(new BCryptPasswordEncoder()).withUser("addUser").password(new BCryptPasswordEncoder().encode("123456")).authorities("addMember");
        //用户deleteUser拥有deleteMember权限
        auth.inMemoryAuthentication().passwordEncoder(new BCryptPasswordEncoder()).withUser("deleteUser").password(new BCryptPasswordEncoder().encode("123456")).authorities("deleteMember");
        //用户updateUser拥有updateMember权限
        auth.inMemoryAuthentication().passwordEncoder(new BCryptPasswordEncoder()).withUser("updateUser").password(new BCryptPasswordEncoder().encode("123456")).authorities("updateMember");
        //管理员拥有所有权限
        auth.inMemoryAuthentication().passwordEncoder(new BCryptPasswordEncoder()).withUser("admin").password(new BCryptPasswordEncoder().encode("123456")).authorities("addMember","deleteMember","updateMember");
    }

（4）成功后输入接口