Spring4和SpringSecurity4的整合（二）連接mybatis和mysql

NoraXie 發(fā)布于2019-08-14 17:38 / 1596人閱讀

摘要：在上一篇基本配置了一些文件中，基本可以在文件中指定用戶名和密碼來進(jìn)行實(shí)現(xiàn)的驗(yàn)證，這次和一起來配合使用加入的配置文件別名在的中配置數(shù)據(jù)源查找配置事物然后建立層，和層以及對(duì)應(yīng)這里省略實(shí)

在上一篇基本配置了一些文件中，基本可以在文件中指定用戶名和密碼來進(jìn)行實(shí)現(xiàn)SpringSecurity的驗(yàn)證，
這次和mynatis一起來配合使用

加入mybatis的配置文件：

mybatis-config.xml

在spring的ApplicationContext.xml中配置數(shù)據(jù)源
ApplicationContext.xml

然后建立dao層，和server層以及對(duì)應(yīng)mapper（這里省略）
實(shí)現(xiàn)UserDetailService里面的loadUserByUsername方法

public class MyUserDetailService implements UserDetailsService  {
    @Autowired
    UserDao userdao;
    @Override
    public UserDetails loadUserByUsername(String username)
            throws UsernameNotFoundException {
        MyUser user =userdao.getUserByName(username);
        if(user==null)
        {
            throw new  UsernameNotFoundException("找不到該用戶");
        }
//這里最好的做法就是遍歷用戶身份，獲取用戶權(quán)限
//        Collection grantedAuthorities = new ArrayList<>();
//        SimpleGrantedAuthority grantedAuthority = new SimpleGrantedAuthority(role);
//        grantedAuthorities.add(grantedAuthority);
        return new MyUserDetail(user, getAuthorities(user.getUser_role()));
    }

    private Collection getAuthorities(String role) {
        Collection grantedAuthorities = new ArrayList<>();
        SimpleGrantedAuthority grantedAuthority = new SimpleGrantedAuthority(role);
        grantedAuthorities.add(grantedAuthority);
        return grantedAuthorities;
    }

}

UserDetail

public class MyUserDetail implements UserDetails {
    private MyUser myUser;
    private Collection authorities;

    public MyUserDetail(MyUser user,Collection authorities) {
        this.myUser = user;
        this.authorities = authorities;
    }

    @Override
    public Collection getAuthorities() {
        // TODO Auto-generated method stub
        return authorities;
    }

    @Override
    public String getPassword() {
        return myUser.getUser_password();
    }

    @Override
    public String getUsername() {
        return myUser.getUser_name();
    }
//下面的方法可以以后再添加
    @Override
    public boolean isAccountNonExpired() {
        // TODO Auto-generated method stub
        return false;
    }

    @Override
    public boolean isAccountNonLocked() {
        // TODO Auto-generated method stub
        return false;
    }

    @Override
    public boolean isCredentialsNonExpired() {
        // TODO Auto-generated method stub
        return false;
    }

    @Override
    public boolean isEnabled() {
        // TODO Auto-generated method stub
        return false;
    }

AuthenticationProvider類

關(guān)于類中的這個(gè)UsernamePasswordAuthenticationToken，Spring官方文檔中給出的說明如下：

1. The username and password are obtained and combined into an instance of UsernamePasswordAuthenticationToken (an instance of
the Authentication interface, which we saw earlier).
2. The token is passed to an instance of AuthenticationManager for validation.
3. The AuthenticationManager returns a fully populated Authentication instance on successful authentication.
4. The security context is established by calling SecurityContextHolder.getContext().setAuthentication(… ) , passing in the returned
authentication object.

UsernamePasswordAuthenticationToken繼承AbstractAuthenticationToken實(shí)現(xiàn)Authentication 所以當(dāng)在頁面中輸入用戶名和密碼之后首先會(huì)進(jìn)入到UsernamePasswordAuthenticationToken驗(yàn)證(Authentication)，然后生成的Authentication會(huì)被交由AuthenticationManager來進(jìn)行管理而AuthenticationManager管理一系列的AuthenticationProvider，而每一個(gè)Provider都會(huì)通UserDetailsService和UserDetail來返回一個(gè)以UsernamePasswordAuthenticationToken實(shí)現(xiàn)的帶用戶名和密碼以及權(quán)限的Authentication

public class SecurityProvider implements AuthenticationProvider {
    @Autowired
    private MyUserDetailService userDetailsService;
    @Override
    public Authentication authenticate(Authentication authentication)
            throws AuthenticationException {
//
        UsernamePasswordAuthenticationToken token = (UsernamePasswordAuthenticationToken) authentication;
        UserDetails userDetails = userDetailsService.loadUserByUsername(token.getName());
        if (userDetails == null) {
            throw new UsernameNotFoundException("找不到該用戶");
        }
        if(!userDetails.getPassword().equals(token.getCredentials().toString()))
        {
              throw new BadCredentialsException("密碼錯(cuò)誤");
        }
        return new UsernamePasswordAuthenticationToken(userDetails,userDetails.getPassword(),userDetails.getAuthorities());
    }

    @Override
    public boolean supports(Class authentication) {
        // TODO Auto-generated method stub
        return UsernamePasswordAuthenticationToken.class.equals(authentication);
    }

}

項(xiàng)目地址：https://github.com/Somersames...