Spring Security 源码解读（三）Authorization授权
Authorization
博客中涉及到的所有源码均可前往Github下载：https://github.com/NingNing0111/spring-security-study
在我们解决完Authentication认证之后,就需要进行授权。Authorization就是授权的意思，在SpringSecurity中，无论你是采用何种方式进行认证的，其授权服务都可以在我们的Spring应用中使用。
在之前的Authentication部分，我们已经能够通过账户密码进行信息认证了，而我们认证的对象User实现了UserDetails接口，该接口定义了getAuthorities()方法，这个方法能够返回认证对象的一组权限。
在Spring Security中，角色与权限并无本质上的区别。
在Spring Security中，GrantedAuthority接口表示授予Authentication对象的权限，该接口只提供了一个方法getAuthority()。这个方法会被AuthorizationManager用来获取权限的字符串表示（AuthorizationManager也是一个接口，也就是说，该接口的实现类会使用getAuthority()方法获取权限），如果无法获取权限字符串，则必须返回null。
在这些AuthorizationManager的实现类中，最常见的就是AuthorityAuthorizationManager。该类配置了一组权限，并且可以判断当前Authentication对象中是否存在配置的权限，若存在，则会对应的进行授权。
public AuthorizationDecision check(Supplier<Authentication> authentication, T object) {
return this.delegate.check(authentication, this.authorities);
}
在SpringSecurity中提供了一个GrantedAuthority的实现类SimpleGrantedAuthority,该类可以通过字符串来表示一个权限，而UserDetails接口定义的getAuthorities()方法返回的就是GrantedAuthority列表。因此，当我们自定义实现UserDetails时，就可以通过角色字符串名称创建多个SimpleGrantedAuthority来组成一个权限列表即可,例如：
@Override
public Collection<? extends GrantedAuthority> getAuthorities() {
Set<Role> roles = user.getRoles();
List<SimpleGrantedAuthority> authorities = new ArrayList<>();
for (Role role : roles) {
authorities.add(new SimpleGrantedAuthority(role.getName()));
}
return authorities;
}
针对请求路径进行授权
针对请求路径进行授权就是针对某一路径，只允许特定权限才能访问。例如有一个请求路径：/api/v1/admin/**,这个路径只允许具有Admin:All权限才能访问,那么就可以通过下述配置实现：
@Bean
SecurityFilterChain web(HttpSecurity http) throws Exception {
http
.authorizeHttpRequests((authorize) -> authorize
.requestMatchers("/api/v1/admin/**").hasAuthority('Admin:All')
)
// ...
return http.build();
}
这种配置是最常用的。当我们想要请求路径/api/v1/index/**允许任何人访问，/api/v1/myhome/**需要USER角色访问，其它路径需要进行认证时，可以通过下述配置：
@Bean
SecurityFilterChain web(HttpSecurity http) throws Exception {
http
// ...
.authorizeHttpRequests(authorize -> authorize
.requestMatchers("/api/v1/index").permitAll()
.requestMatchers("/api/v1/myhome/**").hasRole("ADMIN")
.anyRequest().authenticated()
);
return http.build();
}
除了上述看到的permitAll、hasRole权限规则以外，常用的权限规则如下：
permitAll: 该规则对应的请求路径不做任何权限授权，而是以公共路径存在。也就是说，该规则对应的路径允许任何请求访问。denyAll: 该规则对应的请求路径无论在什么情况下，都不会发起请求。也就是说，该规则对应的路径不允许任何请求访问。hasAuthority: 该规则对应的请求路径要求具备相应的GrantedAuthority才可以访问。也就是说，该规则对应的路径只允许具备相关权限才能访问。hasAnyAuthority: 该规则对应的请求路径要求匹配任意一个GrantedAuthority才可以访问。hasRole: 该规则对应的请求路径要求只有相关的角色才可以访问。hasAnyRole: 该规则对应的请求路径要求匹配任意一个角色才可以访问。
实操案例
创建三个API接口：
/api/v1/admin/[resource,...]：只允许Admin:ALL权限访问。/api/v1/user/[comment, my_home, ...]：允许Admin:ALL和User:ALL访问。/api/v1/home/[images, ...]：允许Admin:ALL、User:ALL和Visitor:ALL访问
然后其它的所有路径都需要进行认证，登录接口和退出接口放开。
1. User类
package com.ningning0111.springsecuritystudydemo4.entity;
import lombok.AllArgsConstructor;
import lombok.Builder;
import lombok.Data;
import lombok.NoArgsConstructor;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.authority.SimpleGrantedAuthority;
import org.springframework.security.core.userdetails.UserDetails;
import java.util.ArrayList;
import java.util.Collection;
import java.util.List;
@Data
@NoArgsConstructor
@AllArgsConstructor
@Builder
public class User implements UserDetails {
private String username;
private String password;
private List<String> authorities;
@Override
public Collection<? extends GrantedAuthority> getAuthorities() {
List<SimpleGrantedAuthority> authoritiesList = new ArrayList<>();
for(String authority: authorities){
authoritiesList.add(new SimpleGrantedAuthority(authority));
}
return authoritiesList;
}
@Override
public boolean isAccountNonExpired() {
return true;
}
@Override
public boolean isAccountNonLocked() {
return true;
}
@Override
public boolean isCredentialsNonExpired() {
return true;
}
@Override
public boolean isEnabled() {
return true;
}
}
2. UserRepository类
为了简单起见，就不连接数据库了，使用内存对用户数据信息进行存储。
package com.ningning0111.springsecuritystudydemo4.repository;
import com.ningning0111.springsecuritystudydemo4.entity.User;
import lombok.RequiredArgsConstructor;
import org.springframework.security.core.userdetails.UsernameNotFoundException;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.stereotype.Repository;
import java.sql.Array;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.List;
@Repository
@RequiredArgsConstructor
public class UserRepository {
public User queryByUsername(String username){
BCryptPasswordEncoder passwordEncoder = new BCryptPasswordEncoder();
List<User> users = new ArrayList<>();
User admin = User.builder()
.username("admin")
.password(passwordEncoder.encode("123456"))
.authorities(Arrays.asList("Admin:ALL", "User:ALL","Visitor:ALL"))
.build();
User user = User.builder()
.username("user")
.password(passwordEncoder.encode("223344"))
.authorities(Arrays.asList("User:ALL", "Visitor:ALL"))
.build();
User visitor = User.builder()
.username("visitor")
.password(passwordEncoder.encode("224433"))
.authorities(List.of("Visitor:ALL"))
.build();
users.add(admin);
users.add(user);
users.add(visitor);
for (User item: users){
if (item.getUsername().equals(username)){
return item;
}
}
throw new UsernameNotFoundException(username + " does not exist.");
}
}
3. ApplicationConfig类
ApplicationConfig类在这里主要是用来定义PasswordEncoder和UserDetailsService Bean的。
package com.ningning0111.springsecuritystudydemo4.config;
import com.ningning0111.springsecuritystudydemo4.repository.UserRepository;
import lombok.RequiredArgsConstructor;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
@Configuration
@RequiredArgsConstructor
public class ApplicationConfig {
private final UserRepository userRepository;
@Bean
public UserDetailsService userDetailsService(){
return userRepository::queryByUsername;
}
@Bean
public PasswordEncoder passwordEncoder() {
return new BCryptPasswordEncoder();
}
}
4. SecurityConfig类
SecurityConfig类是用来配置Spring Security，这包括授权配置，也是本案例的重点。
package com.ningning0111.springsecuritystudydemo4.config;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configurers.AbstractAuthenticationFilterConfigurer;
import org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer;
import org.springframework.security.config.annotation.web.configurers.LogoutConfigurer;
import org.springframework.security.web.SecurityFilterChain;
@Configuration
@EnableWebSecurity
public class SecurityConfig {
@Bean
public SecurityFilterChain securityFilterChain(HttpSecurity httpSecurity) throws Exception {
httpSecurity.csrf(AbstractHttpConfigurer::disable);
httpSecurity.authorizeHttpRequests(authorization -> {
authorization.requestMatchers("/api/v1/home/**").hasAnyAuthority("Admin:ALL","User:ALL","Visitor:ALL")
.requestMatchers("/api/v1/admin/**").hasAuthority("Admin:ALL")
.requestMatchers("/api/v1/user/**").hasAnyAuthority("User:ALL","Admin:ALL")
.anyRequest()
.authenticated();
});
httpSecurity.formLogin(AbstractAuthenticationFilterConfigurer::permitAll);
httpSecurity.logout(LogoutConfigurer::permitAll);
return httpSecurity.build();
}
}
5. Controller类
package com.ningning0111.springsecuritystudydemo4.controller;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RestController;
@RestController
@RequestMapping("/api/v1/admin")
public class AdminController {
@GetMapping("/resource")
public String resource(){
return "This is admin resource";
}
@GetMapping("/add_user")
public String addUser(){
return "admin add a user.";
}
}
package com.ningning0111.springsecuritystudydemo4.controller;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RestController;
@RestController
@RequestMapping("/api/v1/user")
public class UserController {
@RequestMapping("/comment")
public String comment(){
return "user comment a statement.";
}
@RequestMapping("/my_home")
public String myHome(){
return "user's home";
}
}
package com.ningning0111.springsecuritystudydemo4.controller;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RestController;
@RequestMapping("/api/v1/home")
@RestController
public class VisitorController {
@RequestMapping("/images")
public String images(){
return "load images";
}
}
至此，大功告成。