基于 Spring Security 角色的访问限制

Question

我是 Spring Security 的新手。根据我对教程的理解，我们将在 antMatcher 中配置用户角色。

我的问题是，如果admin 已登录，它是否会从/admin 之类的上下文中识别URL 并允许权限？如果是这样，我必须为/admin/operation 和/user/operation 编写基于个人角色的方法。但是，除了上下文级别的实现，我如何限制用户。

换句话说，我应该在操作中只有一个带有/operation的方法，我应该识别用户角色并且必须执行基于角色的操作。

如何做到这一点？

请帮忙...

Answer 1

您只需要使用需要认证的 antMatchers() 方法定义资源 URL 列表。具有特定角色的用户将能够访问资源，而无需为其他角色做任何事情。下面我为 HTTP Basic 和 Form Based Authentication 定义了两种配置。

@EnableWebSecurity
    @Configuration
    @EnableGlobalMethodSecurity(prePostEnabled = true)
    public class AppSecurityConfig extends WebSecurityConfigurerAdapter {
        public static final String REALM_NAME = "startwithjava.com";
        @Configuration
        @Order(1)
        public static class WebSecurityConfig extends WebSecurityConfigurerAdapter {
            @Autowired
            LoggingAccessDeniedHandler accessDeniedHandler;

            @Autowired
            AuthSuccessHandler authSuccessHandler;

            @Autowired
            AppUserDetailsService appUserDetailsService;

            @Autowired
            PasswordEncoder passwordEncoder;

            @Override
            protected void configure(HttpSecurity http) throws Exception {
                http
                        .authorizeRequests()
                        .antMatchers(
                                "/",
                                "/js/**",
                                "/css/**",
                                "/img/**",
                                "/webjars/**").permitAll()
                        .antMatchers("/user/**").hasRole("USER")
                        .antMatchers("/admin/**").hasRole("ADMIN")
                        .anyRequest().authenticated()
                        .and()
                        .formLogin()
                        .loginPage("/login")
                        .successHandler(authSuccessHandler)
                        .permitAll()
                        .and()
                        .logout()
                        .invalidateHttpSession(true)
                        .clearAuthentication(true)
                        .logoutRequestMatcher(new AntPathRequestMatcher("/logout"))
                        .logoutSuccessUrl("/login?logout")
                        .permitAll()
                        .and()
                        .exceptionHandling()
                        .accessDeniedHandler(accessDeniedHandler);
            }

            @Override
            protected void configure(AuthenticationManagerBuilder auth) throws Exception {
                DaoAuthenticationProvider daoAuthenticationProvider = new DaoAuthenticationProvider();
                daoAuthenticationProvider.setUserDetailsService(appUserDetailsService);
                daoAuthenticationProvider.setPasswordEncoder(passwordEncoder);
                auth.authenticationProvider(daoAuthenticationProvider);
            }
        }
        @Configuration
        @Order(2)
        public static class ApiTokenSecurityConfig extends WebSecurityConfigurerAdapter{
            @Autowired
            AppUserDetailsService appUserDetailsService;
            @Override
            protected void configure(HttpSecurity http) throws Exception {
                http
                        .csrf()
                           .disable()
                        .authorizeRequests()
                        .antMatchers("/api/**")
                        .hasRole("ADMIN")
                        .and()
                        .httpBasic()
                            .realmName(REALM_NAME)
                            .authenticationEntryPoint(new ApiAuthenticationEntryPoint())
                            .and().sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);
            }
            @Override
            protected void configure(AuthenticationManagerBuilder auth) throws Exception {
                DaoAuthenticationProvider daoAuthenticationProvider = new DaoAuthenticationProvider();
                daoAuthenticationProvider.setUserDetailsService(appUserDetailsService);
                auth.authenticationProvider(daoAuthenticationProvider);
            }

        }

    }