　　SpringSecurity给我们提供了一套最基本的认证方式，可是这种方式远远不能满足大多数系统的需求。不过好在SpringSecurity给我们预留了许多可扩展的接口给我们，我们可以基于这些接口实现自己的认证方式。

一、前期准备工作

1.1、创建示例数据库

Student表：

create table student

(

    id int auto_increment

        primary key,

    stuName varchar(8) null,

    password varchar(16) null,

    joinTime datetime null,

    clz_id int null

)

;

Classes(班级)表：

create table classes

(

    id int auto_increment

        primary key,

    clz_name varchar(16) not null

)

;

1.2、添加相关依赖

compile group: 'mysql', name: 'mysql-connector-java'

compile group: 'org.springframework.security', name: 'spring-security-taglibs'

compile('org.springframework.boot:spring-boot-starter-jdbc')

二、实现步骤

2.1 定义Student类

package com.bdqn.lyrk.security.study.app.pojo;

import org.springframework.security.core.GrantedAuthority;

import org.springframework.security.core.userdetails.User;

import java.sql.Timestamp;

import java.util.Collection;

public class Student extends User {

    private Timestamp joinTime;

    public Timestamp getJoinTime() {

        return joinTime;

    }

    public void setJoinTime(Timestamp joinTime) {

        this.joinTime = joinTime;

    }

    public Student(String username, String password, Collection<? extends GrantedAuthority> authorities) {

        super(username, password, authorities);

    }

}

　　在这里定义的类继承User,User是SpringSecurity里的一个类，用以描述一个用户和其最基本的属性，当然我们要扩展它的用户我们也可以实现UserDetails接口

2.2 实现UserDetailsService

package com.bdqn.lyrk.security.study.app.service;

import com.bdqn.lyrk.security.study.app.pojo.Student;

import org.springframework.beans.factory.annotation.Autowired;

import org.springframework.jdbc.core.JdbcTemplate;

import org.springframework.security.core.GrantedAuthority;

import org.springframework.security.core.authority.SimpleGrantedAuthority;

import org.springframework.security.core.userdetails.User;

import org.springframework.security.core.userdetails.UserDetails;

import org.springframework.security.core.userdetails.UserDetailsService;

import org.springframework.security.core.userdetails.UsernameNotFoundException;

import org.springframework.stereotype.Service;

import java.sql.Timestamp;

import java.util.ArrayList;

import java.util.List;

import java.util.Map;

@Service

public class UserService implements UserDetailsService {

    @Autowired

    private JdbcTemplate jdbcTemplate;

    @Override

    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {

        User.UserBuilder users = User.withDefaultPasswordEncoder();

        Map<String, Object> map = jdbcTemplate.queryForMap("select t.clz_name,t1.stuName,t1.password,t1.joinTime from student t1 inner  join classes t on t.id = t1.clz_id where stuName = ?", username);

        Timestamp joinTime = null;

        if (map != null && map.size() > 0) {

            String stuName = (String) map.get("stuName");

            String password = (String) map.get("password");

            joinTime = (Timestamp) map.get("joinTime");

            String clzName = (String) map.get("clz_name");

            users.password(password);

            users.username(stuName);

            SimpleGrantedAuthority authority = new SimpleGrantedAuthority(clzName);

            List<GrantedAuthority> list = new ArrayList<>();

            list.add(authority);

            users.authorities(list);

        }

        UserDetails userDetails = users.build();

        Student student = new Student(userDetails.getUsername(), userDetails.getPassword(), userDetails.getAuthorities());

//        UserDetails userDetails = User.withDefaultPasswordEncoder().

        student.setJoinTime(joinTime);

        return student;

    }

}

　　在这个接口里我们要实现根据用户名查找用户的方法，那么一般情况下我们都会根据自己系统的用户表来获取用户信息，这里面注意几个方面：

　　1）需要设置PasswordEncoder

　　2) 需要设置其角色信息，那么在这里我用班级来表示用户的角色

　　3）用户的三个重要属性就是用户名，密码与权限

　　4) 这里的返回值(UserDetails)不能返回null,如果根据用户名找不到对应的用户可以抛出UsernameNotFoundException异常

2.3 改造WebSecurityConfig

package com.bdqn.lyrk.security.study.app.config;

import com.bdqn.lyrk.security.study.app.service.UserService;

import org.springframework.beans.factory.annotation.Autowired;

import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;

import org.springframework.security.config.annotation.web.builders.HttpSecurity;

import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;

import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;

/**

 * spring-security的相关配置

 *

 * @author chen.nie

 * @date 2018/6/7

 **/

@EnableWebSecurity

public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired

    private UserService userService;

    @Override

    protected void configure(HttpSecurity http) throws Exception {

        /*

            1.配置静态资源不进行授权验证

            2.登录地址及跳转过后的成功页不需要验证

            3.其余均进行授权验证

         */

        http.

                authorizeRequests().antMatchers("/static/**").permitAll().

                and().authorizeRequests().antMatchers("/user/**").hasRole("7022").

                and().authorizeRequests().anyRequest().authenticated().

                and().formLogin().loginPage("/login").successForwardUrl("/toIndex").permitAll()

                .and().logout().logoutUrl("/logout").invalidateHttpSession(true).deleteCookies().permitAll()

        ;

    }

    @Override

    protected void configure(AuthenticationManagerBuilder auth) throws Exception {

        //设置自定义userService

        auth.userDetailsService(userService);

    }

}

在这里主要做以下处理：

　1）针对于/user/**路径的请求需要设置对应的权限

　2）做用户注销的处理，用户注销时需要销毁session与cookie

　3）配置自定义UserDetailService

2.4、改造index.jsp

<%--

  Created by IntelliJ IDEA.

  User: chen.nie

  Date: 2018/6/8

  Time: 上午9:56

  To change this template use File | Settings | File Templates.

--%>

<%@ page contentType="text/html;charset=UTF-8" language="java" %>

<%@ taglib prefix="sec" uri="http://www.springframework.org/security/tags" %>

<html>

<head>

    <title>Title</title>

</head>

<body>

欢迎:${user.username}

<sec:authorize access="hasRole('7022')">

    加入时间:${user.joinTime}

</sec:authorize>

<form action="/logout" method="post">

    <input type="submit" value="退出" />

    <sec:csrfInput/>

</form>

</body>

</html>

　　在这里面我们使用spring对security标签的支持判断当前用户是否有对应的角色，另外我们在处理登出操作时必须为post提交且有对应的token防止csrf

巴特西

SpringSecurity学习之基于数据库的用户认证