030 SSM综合练习06

1.权限操作涉及的三张表

(1)用户表信息描述users

sql语句：

1CREATE TABLE users (
2    id VARCHAR2 ( 32 ) DEFAULT SYS_GUID () PRIMARY KEY,
3    email VARCHAR2 ( 50 ) UNIQUE NOT NULL,
4    username VARCHAR2 ( 50 ),
5    PASSWORD VARCHAR2 ( 50 ),
6    phoneNum VARCHAR2 ( 20 ),
7STATUS INT 
8)

(2)角色表描述role

sql语句：

1CREATE TABLE role (
2    id VARCHAR2 ( 32 ) DEFAULT SYS_GUID () PRIMARY KEY,
3    roleName VARCHAR2 ( 50 ),
4roleDesc VARCHAR2 ( 50 ) 
5)

(3)权限资源表描述****permission

sql语句：

1CREATE TABLE permission (
2    id VARCHAR2 ( 32 ) DEFAULT SYS_GUID () PRIMARY KEY,
3    permissionName VARCHAR2 ( 50 ),
4url VARCHAR2 ( 50 ) 
5)

(4)权限资源与角色关联关系

权限资源与角色是多对多关系，我们使用role_permission表来描述。

sql语句：

1CREATE TABLE role_permission (
2    permissionId VARCHAR2 ( 32 ),
3    roleId VARCHAR2 ( 32 ),
4    PRIMARY KEY ( permissionId, roleId ),
5    FOREIGN KEY ( permissionId ) REFERENCES permission ( id ),
6FOREIGN KEY ( roleId ) REFERENCES role ( id ) 
7)

(5)用户与角色关联关系

用户与角色之间是多对多关系，我们通过user_role表来描述其关联

sql语句：

1CREATE TABLE users_role (
2    userId VARCHAR2 ( 32 ),
3    roleId VARCHAR2 ( 32 ),
4    PRIMARY KEY ( userId, roleId ),
5    FOREIGN KEY ( userId ) REFERENCES users ( id ),
6FOREIGN KEY ( roleId ) REFERENCES role ( id ) 
7)

(6)三张表关联

2.Spring Security概述

Spring Security是 Spring 项目组中用来提供安全认证服务的框架。 Spring Security 为基于J2EE企业应用软件提供了全面安全服务。
安全包括两个主要操作：
“认证”，是为用户建立一个他所声明的主体。主题一般式指用户，设备或可以在你系统中执行动作的其他系统。典型范例：用户登录
“授权”指的是一个用户能否在你的应用中执行某个操作，在到达授权判断之前，身份的主题已经由身份验证过程建立了。

3.Spring Security简单应用---用户登录

(1)在父pom文件添加Spring Security的依赖

1<dependency>
2            <groupId>org.springframework.security</groupId>
3            <artifactId>spring-security-web</artifactId>
4            <version>${spring.security.version}</version>
5        </dependency>
6        <dependency>
7            <groupId>org.springframework.security</groupId>
8            <artifactId>spring-security-config</artifactId>
9            <version>${spring.security.version}</version>
10        </dependency>

注意：${spring.security.version}为版本控制

1<properties>
2        <spring.version>5.0.2.RELEASE</spring.version>
3        <slf4j.version>1.6.6</slf4j.version>
4        <log4j.version>1.2.12</log4j.version>
5        <oracle.version>10.2.0.4.0</oracle.version>
6        <mybatis.version>3.4.5</mybatis.version>
7        <mysql.version>5.1.6</mysql.version>
8        <spring.security.version>5.0.1.RELEASE</spring.security.version>
9    </properties>

(2)在web.xml文件中配置springsecurity

<1>添加一个过滤器

1<!--04 配置springSecurity(开始)-->
2  <filter>
3    <filter-name>springSecurityFilterChain</filter-name>
4    <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
5  </filter>
6  <filter-mapping>
7    <filter-name>springSecurityFilterChain</filter-name>
8    <url-pattern>/*</url-pattern>
9  </filter-mapping>
10  <!--04 配置springSecurity(结束)-->

<2>添加类加载路径

1<!-- 配置加载类路径的配置文件 -->
2  <context-param>
3    <param-name>contextConfigLocation</param-name>
4    <param-value>classpath:applicationContext.xml,classpath:spring-security.xml</param-value>
5  </context-param>

(3)在resources目录下创建spring-security.xml文件，并设置其内容如下。

1<?xml version="1.0" encoding="UTF-8"?>
2<beans xmlns="http://www.springframework.org/schema/beans"
3       xmlns:security="http://www.springframework.org/schema/security"
4       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
5       xsi:schemaLocation="http://www.springframework.org/schema/beans
6    http://www.springframework.org/schema/beans/spring-beans.xsd
7    http://www.springframework.org/schema/security
8    http://www.springframework.org/schema/security/spring-security.xsd">
9
10    <!-- 配置不拦截的资源 -->
11    <security:http pattern="/login.jsp" security="none"/>
12    <security:http pattern="/failer.jsp" security="none"/>
13    <security:http pattern="/css/**" security="none"/>
14    <security:http pattern="/img/**" security="none"/>
15    <security:http pattern="/plugins/**" security="none"/>
16
17    <!--
18        配置具体的规则
19        auto-config="true"    不用自己编写登录的页面，框架提供默认登录页面
20        use-expressions="false"    是否使用SPEL表达式（没学习过）
21    -->
22    <security:http auto-config="true" use-expressions="false">
23        <!-- 配置具体的拦截的规则 pattern="请求路径的规则" access="访问系统的人，必须有ROLE_USER的角色" -->
24        <security:intercept-url pattern="/**" access="ROLE_USER,ROLE_ADMIN"/>
25
26        <!-- 定义跳转的具体的页面,login-page指定登录页面，login-processing-url登录路径,login.jsp文件中会调用 -->
27        <!--authentication-success-forward-url指定成功页面，authentication-failure-url失败页面-->
28        <security:form-login
29                login-page="/login.jsp"
30                login-processing-url="/login"
31                default-target-url="/index.jsp"
32                authentication-failure-url="/failer.jsp"
33                authentication-success-forward-url="/pages/main.jsp"
34        />
35
36        <!-- 关闭跨域请求 -->
37        <security:csrf disabled="true"/>
38
39        <!-- 退出 -->
40        <security:logout invalidate-session="true" logout-url="/logout" logout-success-url="/login.jsp" />
41
42    </security:http>
43
44    <!-- 切换成数据库中的用户名和密码 -->
45    <security:authentication-manager>
46        <security:authentication-provider user-service-ref="userService">
47            <!-- 配置加密的方式 -->
48            <security:password-encoder ref="passwordEncoder"/>
49        </security:authentication-provider>
50    </security:authentication-manager>
51
52    <!-- 配置加密类 -->
53    <bean id="passwordEncoder" class="org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder"/>
54
55    <!-- 提供了入门的方式，在内存中存入用户名和密码
56    <security:authentication-manager>
57        <security:authentication-provider>
58            <security:user-service>
59                <security:user name="admin" password="{noop}admin" authorities="ROLE_USER"/>
60            </security:user-service>
61        </security:authentication-provider>
62    </security:authentication-manager>
63    -->
64
65</beans>

(5)在service模块中创建IUserService和UserServiceImpl

接口

1package lucky.service;
2
3import org.springframework.security.core.userdetails.UserDetailsService;
4
5public interface IUserService extends UserDetailsService {
6}

实现类

1package lucky.service.impl;
2
3import lucky.dao.IUserDao;
4import lucky.domain.Role;
5import lucky.domain.UserInfo;
6import lucky.service.IUserService;
7import org.springframework.beans.factory.annotation.Autowired;
8import org.springframework.security.core.GrantedAuthority;
9import org.springframework.security.core.authority.SimpleGrantedAuthority;
10import org.springframework.security.core.userdetails.User;
11import org.springframework.security.core.userdetails.UserDetails;
12import org.springframework.security.core.userdetails.UsernameNotFoundException;
13import org.springframework.stereotype.Service;
14
15import java.util.ArrayList;
16import java.util.Collection;
17import java.util.List;
18
19/**
20 * 使用springsecurity进行用户登录
21 */
22@Service(value = "userService")
23public class UserServiceImpl implements IUserService {
24    @Autowired
25    private IUserDao iUserDao;
26
27    @Override
28    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
29        UserInfo userInfo=null;
30        try {
31            userInfo=iUserDao.queryByUsername(username);
32        } catch (Exception e) {
33            e.printStackTrace();
34        }
35        //将自己的用户对象封装成UserDetails，参数1为用户名，参数2为密码，参数3是用户权限
36        User user=new User(userInfo.getUsername(),"{noop}"+userInfo.getPassword(),getAuthority(userInfo.getRoles()));
37        return user;
38    }
39
40
41    /**
42     * @return 返回一个list集合，集合中装的是用户权限描述
43     * @param roles
44     */
45    public List<SimpleGrantedAuthority> getAuthority(List<Role> roles) {
46        List<SimpleGrantedAuthority> list=new ArrayList<>();
47        for (Role role : roles) {
48            list.add(new SimpleGrantedAuthority(role.getRoleName()));
49        }
50        return list;
51    }
52}

(6)IUserDao.java

1package lucky.dao;
2
3import lucky.domain.UserInfo;
4import org.apache.ibatis.annotations.Many;
5import org.apache.ibatis.annotations.Result;
6import org.apache.ibatis.annotations.Results;
7import org.apache.ibatis.annotations.Select;
8
9public interface IUserDao {
10    /**
11     * @param username 用户名
12     * @Results 映射查询结果集到实体类属性
13     * column为数据库字段名，porperty为实体类属性名，jdbcType为数据库字段数据类型，id为是否为主键。
14     * 涉及多对多查询，有中间表
15     */
16    @Select("select * from LUCKY.USERS where username=#{username}")
17    @Results({
18            @Result(id=true,property = "id",column = "id"),
19            @Result(property = "username",column = "username"),
20            @Result(property = "email",column = "email"),
21            @Result(property = "password",column = "password"),
22            @Result(property = "phoneNum",column = "phoneNum"),
23            @Result(property = "status",column = "status"),
24            @Result(property = "roles",column = "id",javaType = java.util.List.class,many = @Many(select="lucky.dao.IRoleDao.queryByUserId")),
25    })
26    public UserInfo queryByUsername(String username) throws Exception;
27}

(7)用户退出功能

<1>只需要在springsecurity.xml配置文件中添加

1<!-- 退出 -->
2        <security:logout invalidate-session="true" logout-url="/logout" logout-success-url="/login.jsp" />

<2>再header.jsp页面中调用即可

1　　　　　　　　　　　　　　<li class="user-footer">
2                            <div class="pull-left">
3                                <a href="#" class="btn btn-default btn-flat">修改密码</a>
4                            </div>
5                            <div class="pull-right">
6                                <a href="${pageContext.request.contextPath}/logout"
7                                    class="btn btn-default btn-flat">注销</a>
8                            </div>
9                        </li>

(8)效果图

030 SSM综合练习06

评论区

相关推荐