随记：springboot+spring-security

该文章为备忘个人用packagecom.szq.le.config;importjava.util.ArrayList;importjava.util.Collection;importjava.util.List;importorg.mybatis.spring.annotation.MapperScan;importorg.springframework.boot.autoconfigure.SpringBootApplication;importorg.springframework.boot.web.servlet.ServletComponentScan;importorg.springframework.boot.web.servlet.support.SpringBootServletInitializer;importorg.springframework.context.annotation.Bean;importorg.springframework.security.config.annotation.web.builders.HttpSecurity;importorg.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;importorg.springframework.security.core.GrantedAuthority;importorg.springframework.security.core.userdetails.UserDetails;importorg.springframework.security.core.userdetails.UserDetailsService;importorg.springframework.security.core.userdetails.UsernameNotFoundException;importorg.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;importorg.springframework.web.servlet.config.annotation.CorsRegistry;importorg.springframework.web.servlet.config.annotation.WebMvcConfigurer;SpringBootApplication(scanBasePackages{com.szq.le.controller,com.szq.le.service.impl,com.szq.le.springcomponent})ServletComponentScanMapperScan(com.szq.le.dao)publicclassAppConfigextendsSpringBootServletInitializerimplementsWebMvcConfigurer{BeanprotectedWebSecurityConfigurerAdaptergetWebSecurityConfigurerAdapter(){returnnewWebSecurityConfigurerAdapter(){Overrideprotectedvoidconfigure(HttpSecurity http)throwsException{http.csrf().disable().cors().and().formLogin();http.authorizeRequests().antMatchers(/api/fulladm/**).access(hasAnyRole({admin,user}) and isFullyAuthenticated());http.authorizeRequests().antMatchers(/api/adm/**).access(hasAnyRole({admin,user,abc}) and isFullyAuthenticated());http.authorizeRequests().antMatchers(/api/fullauth/**).fullyAuthenticated();http.authorizeRequests().antMatchers(/api/auth/**).authenticated();http.authorizeRequests().antMatchers(/**).permitAll();//重要这里是CAS认证的配置入口http.exceptionHandling().authenticationEntryPoint(null);}};}BeanprotectedBCryptPasswordEncodergetBCryptPasswordEncoder(){returnnewBCryptPasswordEncoder();}BeanprotectedUserDetailsServicegetUserDetailsService(BCryptPasswordEncoder getBCryptPasswordEncoder){returnnewUserDetailsService(){OverridepublicUserDetailsloadUserByUsername(String username)throwsUsernameNotFoundException{returnnewUserDetails(){privatestaticfinallongserialVersionUID1L;OverridepublicbooleanisEnabled(){returntrue;}OverridepublicbooleanisCredentialsNonExpired(){returntrue;}OverridepublicbooleanisAccountNonLocked(){returntrue;}OverridepublicbooleanisAccountNonExpired(){returntrue;}OverridepublicStringgetUsername(){returnadmin;}OverridepublicStringgetPassword(){String sgetBCryptPasswordEncoder.encode(passw0rd);System.out.println(s);returns;}OverridepublicCollection?extendsGrantedAuthoritygetAuthorities(){ListGrantedAuthoritylistnewArrayList();list.add(newGrantedAuthority(){privatestaticfinallongserialVersionUID1L;OverridepublicStringgetAuthority(){returnROLE_abc;}});returnlist;}};}};}OverridepublicvoidaddCorsMappings(CorsRegistry registry){registry.addMapping(/**).allowedOrigins(*);}}有几个点需要注意.formLogin()后面有各种方法各种handler可以实现各种各样的扩展。自定义返回成功后的功能就在这里扩展。BCryptPasswordEncoder必须得配置一个还有其他几个encoder可以用一般情况下使用这个也就够了。UserDetailsService必须得配置一个这里是最主要的扩展点在这里可以自己实现各种各样的获取用户信息的功能不管是从数据库还是从缓存获取。通过自定义这个bean就不必使用spring-security自带的那个数据库获取用户信息的功能了。如果是使用cas之类的认证则**http.exceptionHandling().authenticationEntryPoint(null);**方法是配置认证入口的方法。原创不易转帖请注明出处 — ShiZhongqi