您好,登錄后才能下訂單哦!
這篇文章主要介紹了Spring Security使用URL地址進行權限控制的方法,具有一定借鑒價值,感興趣的朋友可以參考下,希望大家閱讀完這篇文章之后大有收獲,下面讓小編帶著大家一起了解一下。
目的是:系統(tǒng)內(nèi)存在很多不同的用戶,每個用戶具有不同的資源訪問權限,具體表現(xiàn)就是某個用戶對于某個URL是無權限訪問的。需要Spring Security忙我們過濾。
FilterSecurityInterceptor是Spring Security進行URL權限判斷的,F(xiàn)ilterSecurityInterceptor又繼承于AbstractSecurityInterceptor,由此可推測,我們可以新增一個Interceptor繼承AbstractSecurityInterceptor,實現(xiàn)我們自己的權限校驗邏輯。
查看父類及其代碼邏輯,有幾點必須要注意:
1、主要鑒權方法是調(diào)用父類中accessDecisionManager的decide值,所以我們需要自己實現(xiàn)一個accessDecisionManager
2、父類中存在抽象方法public abstract SecurityMetadataSource obtainSecurityMetadataSource();作用是獲取URL及用戶角色對應的關系。我們需要加入自己的實現(xiàn)。
以下是部分代碼實現(xiàn)
主要攔截器JwtUrlSecurityInterceptor,需要在WebSecurityConfig(Spring Security配置)文件中注冊
//這個攔截器用來實現(xiàn)按照用戶權限,對所請求的url進行攔截 @Bean public JwtUrlSecurityInterceptor jwtUrlSecurityInterceptorBean() throws Exception{ return new JwtUrlSecurityInterceptor(); } @Override protected void configure(HttpSecurity httpSecurity) throws Exception { ... httpSecurity.addFilterBefore(jwtUrlSecurityInterceptorBean(), FilterSecurityInterceptor.class); ... }
實現(xiàn)自定義的accessDecisionManager
package org.zerhusen.security.dsuri; import org.springframework.security.access.AccessDecisionManager; import org.springframework.security.access.AccessDeniedException; import org.springframework.security.access.ConfigAttribute; import org.springframework.security.authentication.InsufficientAuthenticationException; import org.springframework.security.core.Authentication; import java.util.Collection; /** * Created by dingshuo on 2017/6/28. */ public class MyAccessDecisionManager implements AccessDecisionManager { @Override public void decide(Authentication authentication, Object object, Collection<ConfigAttribute> configAttributes) throws AccessDeniedException, InsufficientAuthenticationException { System.out.println("自定義的接口"); throw new AccessDeniedException("no right"); } @Override public Boolean supports(ConfigAttribute attribute) { return true; } @Override public Boolean supports(Class<?> clazz) { return true; } }
實現(xiàn)自定義的資源SecurityMetadataSource
package org.zerhusen.security.dsuri; import org.springframework.beans.factory.annotation.Autowired; import org.springframework.security.access.ConfigAttribute; import org.springframework.security.access.SecurityConfig; import org.springframework.security.web.FilterInvocation; import org.springframework.security.web.access.intercept.FilterInvocationSecurityMetadataSource; import java.util.*; /** * Created by dingshuo on 2017/6/28. */ public class MyInvocationSecurityMetadataSource implements FilterInvocationSecurityMetadataSource { private static Map<String, Collection<ConfigAttribute>> resourceMap = null; @Autowired UrlMatcher urlMatcher; public MyInvocationSecurityMetadataSource() { //這里可以查數(shù)據(jù)庫實現(xiàn) //注入dao即可 resourceMap = new HashMap<String, Collection<ConfigAttribute>>(); Collection<ConfigAttribute> atts = new ArrayList<ConfigAttribute>(); ConfigAttribute ca = new SecurityConfig("ROLE_USER1"); atts.add(ca); resourceMap.put("/index.jsp", atts); Collection<ConfigAttribute> attsno =new ArrayList<ConfigAttribute>(); ConfigAttribute cano = new SecurityConfig("ROLE_NO"); attsno.add(cano); resourceMap.put("/other.jsp", attsno); } @Override public Collection<ConfigAttribute> getAttributes(Object object) throws IllegalArgumentException { String url = ((FilterInvocation)object).getRequestUrl(); Iterator<String> ite = resourceMap.keySet().iterator(); while (ite.hasNext()) { String resURL = ite.next(); if (url.equals("/protected")) { return resourceMap.get(resURL); } } return null; } @Override public Collection<ConfigAttribute> getAllConfigAttributes() { return null; } @Override public Boolean supports(Class<?> clazz) { return true; } }
實現(xiàn)JwtUrlSecurityInterceptor
package org.zerhusen.security.dsuri; import org.springframework.beans.factory.annotation.Autowired; import org.springframework.context.annotation.Bean; import org.springframework.security.access.AccessDecisionManager; import org.springframework.security.access.SecurityMetadataSource; import org.springframework.security.access.intercept.AbstractSecurityInterceptor; import org.springframework.security.access.intercept.InterceptorStatusToken; import org.springframework.security.authentication.AuthenticationManager; import org.springframework.security.web.FilterInvocation; import javax.servlet.*; import java.io.IOException; /** * Created by dingshuo on 2017/6/28. */ public class JwtUrlSecurityInterceptor extends AbstractSecurityInterceptor implements Filter { @Autowired public void setMyAccessDecisionManager(){ super.setAccessDecisionManager(myAccessDecisionManagerBean()); } @Bean public MyAccessDecisionManager myAccessDecisionManagerBean(){ return new MyAccessDecisionManager(); } @Bean public MyInvocationSecurityMetadataSource myInvocationSecurityMetadataSourceBean(){ return new MyInvocationSecurityMetadataSource(); } @Override public void init(FilterConfig filterConfig) throws ServletException { } @Override public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException { FilterInvocation fi = new FilterInvocation(request, response, chain); invoke(fi); } @Override public void destroy() { } @Override public Class<?> getSecureObjectClass() { return FilterInvocation.class; } @Override public SecurityMetadataSource obtainSecurityMetadataSource() { return this.myInvocationSecurityMetadataSourceBean(); } public void invoke(FilterInvocation fi) throws IOException, ServletException { InterceptorStatusToken token = super.beforeInvocation(fi); try { fi.getChain().doFilter(fi.getRequest(), fi.getResponse()); } finally { super.afterInvocation(token, null); } } }
如上是簡單的URL權限控制
感謝你能夠認真閱讀完這篇文章,希望小編分享的“Spring Security使用URL地址進行權限控制的方法”這篇文章對大家有幫助,同時也希望大家多多支持億速云,關注億速云行業(yè)資訊頻道,更多相關知識等著你來學習!
免責聲明:本站發(fā)布的內(nèi)容(圖片、視頻和文字)以原創(chuàng)、轉(zhuǎn)載和分享為主,文章觀點不代表本網(wǎng)站立場,如果涉及侵權請聯(lián)系站長郵箱:is@yisu.com進行舉報,并提供相關證據(jù),一經(jīng)查實,將立刻刪除涉嫌侵權內(nèi)容。