08 SSM整合案例（企业权限管理系统）：08.权限控制

04.AdminLTE的基本介绍

05.SSM整合案例的基本介绍

06.产品操作

07.订单操作

08.权限控制

09.用户操作

10.权限关联与控制

11.AOP日志

08.权限控制 

SSM权限操作

 

---

  

 1.数据库与表结构

 如果删除TABLE ，需要先删除多对多创建的中间表后，才能删除其它主键关联的表。

 1.1 用户表 

  本案例使用oracle数据库

-- 1.1.2 sql语句
CREATE TABLE users(
id varchar2(32) default SYS_GUID() PRIMARY KEY,
email VARCHAR2(50) UNIQUE NOT NULL,
username VARCHAR2(50),
PASSWORD VARCHAR2(50),
phoneNum VARCHAR2(20),
STATUS INT
)

  实体类

package cn.bjut.ssm.domain;

import java.util.List;

public class UserInfo {
    private String id;
    private String username;
    private String email;
    private String password;
    private String phoneNum;
    private Integer status;
    //======成员变量是其它实体类的List=====
    private String statusStr;
    private List roles; 

    public String getStatusStr() {
        //状态0 未开启 1 开启
        if(status!=null){
            if(status==0)
                statusStr="未开启";
            if(status==1)
                statusStr="开启";
        }
        
        return statusStr;
    }

    public void setStatusStr(String statusStr) {
        this.statusStr = statusStr;
    }
    //==========其它get/set方法===============

 

 1.2 角色表 

 

-- 1.2.2 sql语句
CREATE TABLE role(
id varchar2(32) default SYS_GUID() PRIMARY KEY,
roleName VARCHAR2(50) ,
roleDesc VARCHAR2(50)
)

  

package cn.bjut.ssm.domain;

import org.springframework.security.core.userdetails.User;

import java.util.List;

    public class Role {
    private String id;
    private String roleName;
    private String roleDesc;
    private List permissions;
    private List users;
    //=====Role与User以及Permission都是多对多的关系

 

1.2.3 用户与角色关联关系

用户与角色之间是多对多关系，我们通过user_role表来描述其关联，在实体类中User中存在List，在Role中有List 

 

-- 用户与角色关联表
CREATE TABLE users_role(
userId varchar2(32),
roleId varchar2(32),
PRIMARY KEY(userId,roleId),
FOREIGN KEY (userId) REFERENCES users(id),
FOREIGN KEY (roleId) REFERENCES role(id)
)

 

 1.3 资源权限表

 

 

 

-- 1.3.2 sql语句
CREATE TABLE permission(
id varchar2(32) default SYS_GUID() PRIMARY KEY,
permissionName VARCHAR2(50) ,
url VARCHAR2(50)
)

    

package cn.bjut.ssm.domain;

import java.util.List;

public class Permission {
    private String id;
    private String permissionName;
    private String url;
    private List roles;
    //=====存在一对多关系，则在一的实体类中的成员变量类型是多的List
    //=====存在一对多关系，则在一的实体类中的成员变量名称是多的names

 1.3.3.权限资源与角色关联关系 

 权限资源与角色是多对多关系，我们使用role_permission表来描述。在实体类Permission中存在List,在Role类中有List

-- 权限资源与角色是多对多关系
CREATE TABLE role_permission(
permissionId varchar2(32),
roleId varchar2(32),
PRIMARY KEY(permissionId,roleId),
FOREIGN KEY (permissionId) REFERENCES permission(id),
FOREIGN KEY (roleId) REFERENCES role(id)
)

  

---

 

2.Spring Security概述

 Spring Security 是 Spring 项目组中用来提供安全服务的框架。 安全包括两个主要操作：

“认证”

“授权” 

 

 maven依赖

　　
　　　　org.springframework.security
　　　　spring-security-web
　　　　5.0.10.RELEASE
　　
　　
　　　　org.springframework.security
　　　　spring-security-config
　　　　5.0.10.RELEASE
　　

 

Spring Security快速入门

1、导入maven依赖坐标

 　 pom.xml

xml version="1.0" encoding="UTF-8"?>

<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
  <modelVersion>4.0.0modelVersion>

  <groupId>cn.bjutgroupId>
  <artifactId>springSecurityTestartifactId>
  <version>1.0-SNAPSHOTversion>
  <packaging>warpackaging>

  <name>springSecurityTest Maven Webappname>
  
  <url>http://www.example.comurl>

  <properties>
    <spring.version>5.0.15.RELEASEspring.version>
    <spring.security.version>5.0.10.RELEASEspring.security.version>
  properties>

  <dependencies>
    <dependency>
      <groupId>org.springframeworkgroupId>
      <artifactId>spring-coreartifactId>
      <version>${spring.version}version>
    dependency>
    <dependency>
      <groupId>org.springframeworkgroupId>
      <artifactId>spring-webartifactId>
      <version>${spring.version}version>
    dependency>
    <dependency>
      <groupId>org.springframeworkgroupId>
      <artifactId>spring-webmvcartifactId>
      <version>${spring.version}version>
    dependency>
    <dependency>
      <groupId>org.springframeworkgroupId>
      <artifactId>spring-context-supportartifactId>
      <version>${spring.version}version>
    dependency>
    <dependency>
      <groupId>org.springframeworkgroupId>
      <artifactId>spring-testartifactId>
      <version>${spring.version}version>
    dependency>
    <dependency>
      <groupId>org.springframeworkgroupId>
      <artifactId>spring-jdbcartifactId>
      <version>${spring.version}version>
    dependency>

    <dependency>
      <groupId>org.springframework.securitygroupId>
      <artifactId>spring-security-webartifactId>
      <version>${spring.security.version}version>
    dependency>
    <dependency>
      <groupId>org.springframework.securitygroupId>
      <artifactId>spring-security-configartifactId>
      <version>${spring.security.version}version>
    dependency>
    <dependency>
      <groupId>javax.servletgroupId>
      <artifactId>javax.servlet-apiartifactId>
      <version>3.1.0version>
      <scope>providedscope>
    dependency>
  dependencies>

    <build>
      <finalName>springSecurityTestfinalName>
      <plugins>
        
        <plugin>
          <groupId>org.apache.maven.pluginsgroupId>
          <artifactId>maven-compiler-pluginartifactId>
          <version>3.8.0version>
          <configuration>
            <source>1.8source>
            <target>1.8target>
            <encoding>UTF-8encoding>
          configuration>
        plugin>
        <plugin>
          <groupId>org.apache.tomcat.mavengroupId>
          <artifactId>tomcat7-maven-pluginartifactId>
          <version>2.2version>
          <configuration>
            
            <port>8090port>
            
            <path>/path>
          configuration>
        plugin>
      plugins>
    build>
project>

 

　2、在WEB-INF目录下的 web.xml中配置

xml version="1.0" encoding="UTF-8"?>
<web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xmlns="http://java.sun.com/xml/ns/javaee"
    xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd"
    version="2.5">


    <display-name>SpringSecurityTestdisplay-name>

    <context-param>
        <param-name>contextConfigLocationparam-name>
        <param-value>classpath:spring-security.xmlparam-value>
    context-param>
    <listener>
        <listener-class>org.springframework.web.context.ContextLoaderListenerlistener-class>
    listener>
    <filter>
        <filter-name>springSecurityFilterChainfilter-name>
        <filter-class>org.springframework.web.filter.DelegatingFilterProxyfilter-class>
    filter>
    <filter-mapping>
        <filter-name>springSecurityFilterChainfilter-name>
        <url-pattern>/*url-pattern>
    filter-mapping>
    <welcome-file-list>
        <welcome-file>index.htmlwelcome-file>
        <welcome-file>index.htmwelcome-file>
        <welcome-file>index.jspwelcome-file>
        <welcome-file>default.htmlwelcome-file>
        <welcome-file>default.htmwelcome-file>
        <welcome-file>default.jspwelcome-file>
    welcome-file-list>
web-app>

 3、在 classpath:spring-security.xml 里面配置安全认证用到的用户信息。

 

xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
       xmlns:security="http://www.springframework.org/schema/security"
       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
       xsi:schemaLocation="http://www.springframework.org/schema/beans
    http://www.springframework.org/schema/beans/spring-beans.xsd
    http://www.springframework.org/schema/security
    http://www.springframework.org/schema/security/spring-security.xsd">


    <security:http auto-config="true" use-expressions="false">
        
        <security:intercept-url pattern="/**" access="ROLE_USER" />
        
    security:http>
    <security:authentication-manager>
        <security:authentication-provider>
            <security:user-service>
                <security:user name="user" password="{noop}user"
                               authorities="ROLE_USER" />
                <security:user name="admin" password="{noop}admin"
                               authorities="ROLE_ADMIN" />
            security:user-service>
        security:authentication-provider>
    security:authentication-manager>
beans>

 

 2.2.5 springSecurity快速入门：使用自定义页面

 spring-security.xml配置 
 

xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
       xmlns:security="http://www.springframework.org/schema/security"
       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
       xsi:schemaLocation="http://www.springframework.org/schema/beans
    http://www.springframework.org/schema/beans/spring-beans.xsd
    http://www.springframework.org/schema/security
    http://www.springframework.org/schema/security/spring-security.xsd">


    
    <security:http security="none" pattern="/login.html" />
    <security:http security="none" pattern="/failer.html" />
    <security:http auto-config="true" use-expressions="false">
        
        <security:intercept-url pattern="/**" access="ROLE_USER" />
        
        <security:form-login login-page="/login.html"
                             login-processing-url="/login"
                             username-parameter="username" password-parameter="password"
                             authentication-failure-url="/failer.html"
                             authentication-success-forward-url="/success.html"
                             default-target-url="/success.html"
        />
        
        <security:logout invalidate-session="true"
                         logout-url="/logout"
                         logout-success-url="/login.jsp" />
        
        <security:csrf disabled="true" />
    security:http>
    <security:authentication-manager>
        <security:authentication-provider>
            <security:user-service>
                <security:user name="user" password="{noop}user"
                               authorities="ROLE_USER" />
                <security:user name="admin" password="{noop}admin"
                               authorities="ROLE_ADMIN" />
            security:user-service>
        security:authentication-provider>
    security:authentication-manager>
beans>

  

 2.3 Spring Security使用数据库认证

在Spring Security中如果想要使用数据进行认证操作，有很多种操作方式，这里我们介绍使用UserDetails接口、UserDetailsService来完成操作。

UserDetails作用是于封装当前进行认证的用户信息，但由于其是一个接口，
所以我们可以对其进行实现，也可以使用Spring Security提供的一个UserDetails的实现类User来完成操作。

public class User implements UserDetails, CredentialsContainer {
private String password;
private final String username;
private final Set authorities;
private final boolean accountNonExpired; //帐户是否过期
private final boolean accountNonLocked; //帐户是否锁定
private final boolean credentialsNonExpired; //认证是否过期
private final boolean enabled; //帐户是否可用
｝

UserDetailsService

public interface UserDetailsService {
UserDetails loadUserByUsername(String username) throws UsernameNotFoundException;
}

  

 

3. 用户管理 

 

 

3.1 用户登录
 webapp/WEB-INF目录下的

 web.xml

 

xml version="1.0" encoding="UTF-8"?>
<web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xmlns="http://xmlns.jcp.org/xml/ns/javaee"
         xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee http://xmlns.jcp.org/xml/ns/javaee/web-app_3_1.xsd"
         version="3.1">


    
    <context-param>
        <param-name>contextConfigLocationparam-name>
        <param-value>classpath*:applicationContext.xml,classpath*:spring-security.xmlparam-value>
    context-param>

    
    <listener>
        <listener-class>org.springframework.web.context.ContextLoaderListenerlistener-class>
    listener>
    
    <listener>
        <listener-class>org.springframework.web.context.request.RequestContextListenerlistener-class>
    listener>

    
    <servlet>
        <servlet-name>dispatcherServletservlet-name>
        <servlet-class>org.springframework.web.servlet.DispatcherServletservlet-class>
        
        <init-param>
            <param-name>contextConfigLocationparam-name>
            <param-value>classpath:springmvc.xmlparam-value>
        init-param>
        
        <load-on-startup>1load-on-startup>
    servlet>
    <servlet-mapping>
        <servlet-name>dispatcherServletservlet-name>
        <url-pattern>*.dourl-pattern>
    servlet-mapping>

    
    <filter>
        <filter-name>characterEncodingFilterfilter-name>
        <filter-class>org.springframework.web.filter.CharacterEncodingFilterfilter-class>
        <init-param>
            <param-name>encodingparam-name>
            <param-value>UTF-8param-value>
        init-param>
    filter>
    <filter-mapping>
        <filter-name>characterEncodingFilterfilter-name>
        <url-pattern>/*url-pattern>
    filter-mapping>

    
    <filter>
        <filter-name>springSecurityFilterChainfilter-name>
        <filter-class>org.springframework.web.filter.DelegatingFilterProxyfilter-class>
    filter>
    <filter-mapping>
        <filter-name>springSecurityFilterChainfilter-name>
        <url-pattern>/*url-pattern>
    filter-mapping>

    <welcome-file-list>
        <welcome-file>index.htmlwelcome-file>
        <welcome-file>index.htmwelcome-file>
        <welcome-file>index.jspwelcome-file>
        <welcome-file>default.htmlwelcome-file>
        <welcome-file>default.htmwelcome-file>
        <welcome-file>default.jspwelcome-file>
    welcome-file-list>
web-app>

 

 配置在web项目的resources目录下的

 spring-security.xml

 

xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
    xmlns:security="http://www.springframework.org/schema/security"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://www.springframework.org/schema/beans          
    http://www.springframework.org/schema/beans/spring-beans.xsd          
    http://www.springframework.org/schema/security          
    http://www.springframework.org/schema/security/spring-security.xsd">


    
    <security:http pattern="/login.jsp" security="none"/>
    <security:http pattern="/failer.jsp" security="none"/>
    <security:http pattern="/css/**" security="none"/>
    <security:http pattern="/img/**" security="none"/>
    <security:http pattern="/images/**" security="none"/>
    <security:http pattern="/plugins/**" security="none"/>
    
    
    <security:http auto-config="false" use-expressions="true" >
        
        <security:intercept-url pattern="/**" access="hasAnyRole('ROLE_USER','ROLE_ADMIN')"/>
        

        
        
        <security:form-login  
            login-page="/login.jsp"
            login-processing-url="/login"
            username-parameter="username" password-parameter="password"
            default-target-url="/index.jsp"
            authentication-failure-url="/failer.jsp"
            authentication-success-forward-url="/index.jsp"
        />
        
        
        <security:csrf disabled="true"/>
        
        <security:logout invalidate-session="true" logout-url="/logout.do" logout-success-url="/login.jsp" />
        
    security:http>
    
    
    <security:authentication-manager>
        <security:authentication-provider user-service-ref="userService">
            
            
        security:authentication-provider>
    security:authentication-manager>
    
    
    
    
    

    
 beans>

 自己编写用到的

 userServiceImpl实现类

 

 

  

package cn.bjut.ssm.service.impl;

import cn.bjut.ssm.dao.IUserDao;
import cn.bjut.ssm.domain.UserInfo;
import cn.bjut.ssm.service.IUserService;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.core.authority.SimpleGrantedAuthority;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UsernameNotFoundException;
import org.springframework.stereotype.Service;
import org.springframework.transaction.annotation.Transactional;

import java.util.ArrayList;
import java.util.List;

@Service(value = "userService")
@Transactional  //注解的方式使用spring事务管理
public class UserServiceImpl implements IUserService {
    @Autowired
    IUserDao userDao;

    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        //UserInfo是domain包下的实体类
        UserInfo userInfo = null;

        try{
            userInfo = userDao.findByUsername(username);
        } catch(Exception e){
            e.printStackTrace();
        }

        //把自己查询到的实体类中的认证信息封装成UserDetails
        //"{noop}"使用密码明文的必要前缀

        User user = new User(userInfo.getUsername(),"{noop}"+userInfo.getPassword(),getAuthority());
        return user;

    }

    //这个成员方法作用就是返回一个List集合，集合中装入的是角色描述。
    //实际项目中应该是从数据库中获取role描述后封装到这个方法体里面。
    public List getAuthority(){

        List list = new ArrayList<>();
        // new 匿名对象
        list.add(new SimpleGrantedAuthority("ROLE_USER"));
        return list;
    }

}

 

 在DAO层写一个Java的 Interface ,用来查询用户信息,获取username和password查询结果集封装在实体类中。

 

package cn.bjut.ssm.dao;

import cn.bjut.ssm.domain.UserInfo;
import org.apache.ibatis.annotations.Select;

public interface IUserDao {

    @Select("select * from USERS where username = #{username}")
    public UserInfo findByUsername(String username) throws Exception;
}

 

 

 使用PL/SQL Developer插入一条完整用户数据到USERS表如下：

-- 查询user表
select * from users t;

-- 插入一条users表数据
insert into users values('1101112019','[email protected]','ssm08','itheima','15612345678',1);

  

运行版本报错信息为：WARN  o.bcrypt.BCryptPasswordEncoder  - Encoded password does not look like BCrypt；

因为spring-security在最新版本升级后,默认把之前的明文密码方式给去掉了官方文档说明。

参考资料： 

使用Spring Security下的BCryptPasswordEncoder进行密码加密

SpringBoot Security：Encoded password does not look like BCrypt 解决

spring-cloud-oauth2升级版本遇到的认证报bad credentials，Encoded password does not look likebcrypt的问题

https://blog.csdn.net/SWPU_Lipan/article/details/80586054 

 

  index.jsp

<%@ page language="java" contentType="text/html; charset=UTF-8"
         pageEncoding="UTF-8"%>
<html>
<head>

    <title>默认主页title>
head>
<body>
<p>你正在浏览webapp目录下的index.jspp><br>
超链接标签请求的href后面访问不到WEB-INF目录里的jsp文件<br>
<a href="${pageContext.request.contextPath}/pages/main.jsp">点击跳转到：/webapp/pages/main.jspa><br>
<%--="/pages/main.jsp">jsp:forward>--%>

<jsp:forward page="./WEB-INF/pages2/main2.jsp">jsp:forward>
body>
html>

截止目前我发现如果浏览器想访问WEB-INF目录里的.jsp页面，首先可以通过springMVC的视图解析器配置通过返回ModelAndView访问到，再有就是通过 跳转访问。

---

 

-- 插入一条记录到角色表记录
insert into ROLE values ('12345','ADMIN','vip');
-- 插入一条用户-角色中间表记录
insert into USERS_ROLE values('1101112019','12345');

 

package cn.bjut.ssm.dao;

import cn.bjut.ssm.domain.Role;
import org.apache.ibatis.annotations.Select;

import java.util.List;

public interface IRoleDao {
    //根据用户ID查询出所有对应的角色
    @Select("select * from ROLE where id in( select ROLEID from USERS_ROLE where USERID  = #{userId})")
    public List findRoleByUserId(String userId) throws Exception;
}

 

public interface IUserDao {

    @Select("select * from USERS where username = #{username}")
    @Results({
            @Result(property = "id",column = "id",id = true),
            @Result(property = "username",column = "username"),
            @Result(property = "email",column = "email"),
            @Result(property = "password",column = "password"),
            @Result(property = "phoneNum",column = "phoneNum"),
            @Result(property = "status",column = "status"),
            //通过中间表查询多对多关系，返回一个其它实体类的List集合
            @Result(property = "roles",column = "id",javaType =java.util.List.class,many = @Many(select = "cn.bjut.ssm.dao.IRoleDao.findRoleByUserId"))
    })
    public UserInfo findByUsername(String username) throws Exception;


}

 

 这是不考虑Role的可用/不可用状态时的认证实现类

@Service(value = "userService")
@Transactional  //注解的方式使用spring事务管理
public class UserServiceImpl implements IUserService {
    @Autowired
    IUserDao userDao;

    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        //UserInfo是domain包下的实体类
        UserInfo userInfo = null;

        try{
            userInfo = userDao.findByUsername(username);
        } catch(Exception e){
            e.printStackTrace();
        }

        //把自己查询到的实体类中的认证信息封装成UserDetails
        //"{noop}"使用密码明文的必要前缀

        User user = new User(userInfo.getUsername(),"{noop}"+userInfo.getPassword(),getAuthority(userInfo.getRoles()));




        return user;

    }

    //这个成员方法作用就是返回一个List集合，集合中装入的是角色描述。
    //实际项目中应该是从数据库中获取role描述后封装到这个方法体里面。
    public List getAuthority(List roles){

        List list = new ArrayList<>();


        //增强for循环
        for (Role role :roles){
                     // new 匿名对象
            list.add(new SimpleGrantedAuthority("ROLE_"+role.getRoleName()));
        }

        return list;
    }

 

---

 

  考虑用户表中状态值：

//状态0 未开启 1 开启
使用了三元运算符进行判断

@Service(value = "userService")
@Transactional  //注解的方式使用spring事务管理
public class UserServiceImpl implements IUserService {
    @Autowired
    IUserDao userDao;

    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        //UserInfo是domain包下的实体类
        UserInfo userInfo = null;

        try{
            userInfo = userDao.findByUsername(username);
        } catch(Exception e){
            e.printStackTrace();
        }

        //把自己查询到的实体类中的认证信息封装成UserDetails
        //"{noop}"使用密码明文的必要前缀

        // User user = new User(userInfo.getUsername(),"{noop}"+userInfo.getPassword(),getAuthority(userInfo.getRoles()));
        User user = new User(userInfo.getUsername(),"{noop}"+userInfo.getPassword(),userInfo.getStatus() ==0 ?false:true,true,true,true,getAuthority(userInfo.getRoles()));
        
        return user;

    }

    //这个成员方法作用就是返回一个List集合，集合中装入的是角色描述。
    //实际项目中应该是从数据库中获取role描述后封装到这个方法体里面。
    public List getAuthority(List roles){

        List list = new ArrayList<>();


        //增强for循环
        for (Role role :roles){
                     // new 匿名对象
            list.add(new SimpleGrantedAuthority("ROLE_"+role.getRoleName()));
        }

        return list;
    }

 

 

 

====================

end