spring secuity快速入门

我们使用springmvc web项目基于xml配置文件和注解配置类二种方式来写一个快速入门。

基于配置文件的spring security的快速入门

• 加入依赖

加入springmvc,spring secuity，servlet的一些依赖,配置jetty的插件，配置端口是8001，contextPath是"/"

        
            org.springframework
            spring-webmvc
            4.3.13.RELEASE
        
        
            org.springframework.security
            spring-security-web
            4.2.3.RELEASE
        
        
            org.springframework.security
            spring-security-config
            4.2.3.RELEASE
        
        
            javax.servlet
            javax.servlet-api
            3.1.0
            provided
        
        
            javax.servlet.jsp
            jsp-api
            2.2
            provided
        
    

    
        secuity-quickstart-xml
        
            
                org.apache.maven.plugins
                maven-war-plugin
                3.0.0
                
                    false
                
            
            
                org.eclipse.jetty
                jetty-maven-plugin
                9.4.3.v20170317
                
                    
                        8001
                    
                    
                        /
                    
                
            
        
    

• 配置系统初始化类

public class WebAppInitializer extends AbstractDispatcherServletInitializer{

    //配置配置文件，创建context上下文
    @Override
    protected WebApplicationContext createServletApplicationContext() {
        XmlWebApplicationContext context = new XmlWebApplicationContext();
        context.setConfigLocation("classpath:applicationContext.xml");
        return context;
    }

    //配置urlmapping
    @Override
    protected String[] getServletMappings() {
        return new String[]{"/*"};
    }

    @Override
    protected WebApplicationContext createRootApplicationContext() {
        return null;
    }
}

• 配置初始化spring secuity

public class WebAppSecuityInitializer extends AbstractSecurityWebApplicationInitializer{


    @Override
    protected String getDispatcherWebApplicationContextSuffix() {
        return AbstractDispatcherServletInitializer.DEFAULT_SERVLET_NAME;
    }
}

• 配置文件
  配置容器扫描的包路径，配置spring security的用户名密码，url权限配置

• 进行相关的验证

http://localhost:8001/hello
http://localhost:8001/home
http://localhost:8001/admin

分别使用不同的用户名和密码进行验证

基于配置方式的spring security快速入门

• 加入maven依赖

加入springmvc,spring secuity，servlet的一些依赖,配置jetty的插件，配置端口是8001，contextPath是"/"

        
            org.springframework
            spring-webmvc
            4.3.13.RELEASE
        
        
            org.springframework.security
            spring-security-web
            4.2.3.RELEASE
        
        
            org.springframework.security
            spring-security-config
            4.2.3.RELEASE
        
        
            javax.servlet
            javax.servlet-api
            3.1.0
            provided
        
        
            javax.servlet.jsp
            jsp-api
            2.2
            provided
        
    


    
        secuity-quickstart-config
        
            
                org.apache.maven.plugins
                maven-war-plugin
                3.0.0
                
                    false
                
            
            
                org.eclipse.jetty
                jetty-maven-plugin
                9.4.3.v20170317
                
                    
                        8001
                    
                    
                        /
                    
                
            
        
    

• 定义系统启动类

public class WebAppInitializer extends AbstractAnnotationConfigDispatcherServletInitializer {

    //系统启动的时候的根类
    @Override
    protected Class[] getRootConfigClasses() {
        return new Class[]{WebAppConfig.class};
    }

    @Override
    protected Class[] getServletConfigClasses() {
        return null;
    }

    //设置成/*表示拦截静态的文件
    @Override
    protected String[] getServletMappings() {
        return new String[]{"/"};
    }

}

• web入口类

/**
 *
 * 入口类，启动spring mvc，启动spring secuity
 */
@EnableWebMvc
@EnableWebSecurity
@ComponentScan("com.zhihao.miao.secuity")
public class WebAppConfig extends WebMvcConfigurerAdapter {
    public void configureDefaultServletHandling(DefaultServletHandlerConfigurer configurer) {
        configurer.enable();
    }
}

• spring security配置类

/**
 *
 * 初始化spring security
 */
public class WebAppSecurityInitializer extends AbstractSecurityWebApplicationInitializer {

    protected String getDispatcherWebApplicationContextSuffix() {
        return AbstractDispatcherServletInitializer.DEFAULT_SERVLET_NAME;
    }
}

• 具体的controller

@RestController
public class HelloController {

    @GetMapping("/hello")
    public String hello(){
        return "hello spring secuity";
    }

    @GetMapping("/home")
    public String home(){
        return "home spring security";
    }

    @GetMapping("/admin")
    public String admin(){
        return "admin spring secuity";
    }
}

• 在webapp目录下定义一些静态资源

• 权限用户名密码的具体配置

@Configuration
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.inMemoryAuthentication().withUser("zhangsan").password("123456").roles("GUEST");
        auth.inMemoryAuthentication().withUser("zhihao.miao").password("123456").roles("USER");
        auth.inMemoryAuthentication().withUser("lisi").password("12345678").roles("USER", "ADMIN");
    }

    protected void configure(HttpSecurity http) throws Exception {

        http.authorizeRequests().antMatchers("/hello").hasRole("GUEST");
        http.authorizeRequests().antMatchers("/home").hasRole("USER");
        http.authorizeRequests().antMatchers("/admin").hasRole("ADMIN");


        http.authorizeRequests().antMatchers("/**/*.html").permitAll();
        http.authorizeRequests().antMatchers("/**/*.css").permitAll();
        http.authorizeRequests().antMatchers("/**/*.js").permitAll();
        http.authorizeRequests().antMatchers("/**/*.png").access("permitAll");

        http.authorizeRequests().anyRequest().authenticated();
        //http.authorizeRequests().anyRequest().access("authenticated");

        http.formLogin();
    }
}

使用mvn clean jetty:run启动程序进行验证，不同的用户名密码访问不同的资源。

参考资料

官方文档
Spring Security 从入门到进阶系列教程