Spring Security

@Entity
public class Reader implements UserDetails {
	private static final long serialVersionUID = 1L;
	@Id
	private String username;
	private String fullname;
	private String password;
	//...
	//UserDetails相关方法：未获取用户关于安全的一些信息的接口。
	@Override
	public Collection<? extends GrantedAuthority> getAuthorities() {
		return Arrays.asList(new SimpleGrantedAuthority("ROLE_READER"));
	}
	@Override	public String getPassword() { return password; }
	@Override	public String getUsername() {	return username; }
	@Override	public boolean isAccountNonExpired() { return true; }
	@Override public boolean isAccountNonLocked() {	return true; }
	@Override public boolean isCredentialsNonExpired() {return true;}
	@Override	public boolean isEnabled() {return true;}
}


@Entity
public class Book {
	@Id
	@GeneratedValue(strategy=GenerationType.AUTO)
	private Long id;
	@ManyToOne
	private Reader reader;
	private String isbn;
	private String title;
	private String author;
	private String description;
}

public interface ReaderRepository
			extends JpaRepository<Reader, String> {

}
public interface ReadingListRepository extends JpaRepository<Book, Long> {
	List<Book> findByReader(Reader reader);
}

@Controller
@RequestMapping("/")
public class ReadingListController {

	private ReadingListRepository readingListRepository;

	@Autowired
	public ReadingListController(
			ReadingListRepository readingListRepository) {
		this.readingListRepository=readingListRepository;
	}

	@RequestMapping(method=RequestMethod.GET)
	public String readersBooks(Reader reader, Model model) {
		List<Book>	readingList = readingListRepository.findByReader(reader);
		if (readingList != null) {
			model.addAttribute("books", readingList);
			model.addAttribute("reader", reader);
		}
		return "readingList";
	}

	@RequestMapping(method=RequestMethod.POST)
	public String addToReadingList(Reader reader, Book book) {
		book.setReader(reader);
		readingListRepository.save(book);
		return "redirect:/";
	}
}

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

	@Autowired
	private ReaderRepository readerRepository;

	@Override
	protected void configure(HttpSecurity http) throws Exception {
		http
			.authorizeRequests() //
				.antMatchers("/").hasRole("READER")
				.antMatchers("/**").permitAll() //放行其他所有
			.and()
				.formLogin() //登录表单设置
				.loginPage("/login") //url = /login
				.failureUrl("/login?error=true"); //失败页面
	}

	@Override
	protected void configure(AuthenticationManagerBuilder auth) throws Exception {
		//配置如何获取用于验证的UserDetails的Service（需要实现UserDetailsService接口）
		//在此简单的直接实现如下
		auth
			.userDetailsService(userDetailsService())
			.passwordEncoder(NoOpPasswordEncoder.getInstance());
	}

	//同时放入bean容器，测试时会用到
	@Bean
	public UserDetailsService userDetailsService() {
		return username->{
			if(username.equals("root")) {
				return new Reader("root", "root", "root");
			}
			Optional<Reader> optional = readerRepository.findById(username);
			if(optional.isPresent()) {
				return optional.get();
			}
			throw new UsernameNotFoundException("User '" + username + "' not found.");
		};
	}

}

//自定义参数处理器：用户登录成功后，将用户信息注入到参数中
public class ReaderHandlerMethodArgumentResolver implements HandlerMethodArgumentResolver {

	public ReaderHandlerMethodArgumentResolver() {
		System.out.println("=============ReaderHandlerMethodArgumentResolver===============");
	}

	//当参数要被解析成Reader的时候（Controller内部方法的类型），使用本处理器处理
	@Override
	public boolean supportsParameter(MethodParameter parameter) {
		return Reader.class.isAssignableFrom(parameter.getParameterType());
	}

	//处理方法：验证用户登录信息
	@Override
	public Object resolveArgument(
			MethodParameter parameter, //方法参数的封装
			ModelAndViewContainer mavContainer, //
			NativeWebRequest webRequest,  //原生的Request
			WebDataBinderFactory binderFactory) throws Exception {

		Authentication auth = (Authentication) webRequest.getUserPrincipal();
		//验证通过返回
		//验证不通过返回null
		return auth != null && auth.getPrincipal() instanceof Reader ? auth.getPrincipal() : null;

	}

}

	@RequestMapping(value="/", method=RequestMethod.GET)
	public String readersBooks(@AuthenticationPrincipal Reader reader, Model model) {
		List<Book>	readingList = readingListRepository.findByReader(reader);
		if (readingList != null) {
			model.addAttribute("books", readingList);
			model.addAttribute("reader", reader);
			model.addAttribute("amazonID", amazonConfig.getAssociateId());
		}
		return "readingList";
	}

package cn.rectcircle.borrowinglist;

import java.util.List;

import org.springframework.context.annotation.Configuration;
import org.springframework.web.method.support.HandlerMethodArgumentResolver;
import org.springframework.web.servlet.config.annotation.ViewControllerRegistry;
import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;

//SpringMVC相关配置
@Configuration
public class WebMvcConfg implements WebMvcConfigurer {

	@Override
	public void addArgumentResolvers(List<HandlerMethodArgumentResolver> argumentResolvers) {
		argumentResolvers.add(new ReaderHandlerMethodArgumentResolver());
	}

	//直接将/login转发到login.html模板去渲染
	@Override
	public void addViewControllers(ViewControllerRegistry registry) {
		registry.addViewController("/login").setViewName("login");
	}
}

	@Override
	public Collection<? extends GrantedAuthority> getAuthorities() {
		return Arrays.asList(new SimpleGrantedAuthority("ROLE_READER"));
	}

	@Override
	protected void configure(HttpSecurity http) throws Exception {
		http
			.authorizeRequests() //
				.antMatchers("/").hasRole("READER")
				//...
	}

@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

	//配置主要URL（那些URL需要认证？需要什么权限？通过什么方式认证-form表单其他？）
	@Override
	protected void configure(HttpSecurity http) throws Exception {
		super.configure(http);
	}


	//配置AuthenticationManager（如何进行认证？如何获取用户信息？）
	@Override
	protected void configure(AuthenticationManagerBuilder auth) throws Exception {
		auth
			.inMemoryAuthentication()
				.passwordEncoder(NoOpPasswordEncoder.getInstance())
					.withUser("user")
					.password("password")
					.roles("USER");
	}


	//覆盖默认的Bean userDetailsService 时使用
	//同时放入bean容器，测试时会用到
	@Bean
	public UserDetailsService userDetailsService() {
		// ensure the passwords are encoded properly
		UserBuilder users = User.withDefaultPasswordEncoder();
		InMemoryUserDetailsManager manager = new InMemoryUserDetailsManager();
		manager.createUser(users.username("user").password("password").roles("USER").build());
		manager.createUser(users.username("admin").password("password").roles("USER","ADMIN").build());
		return manager;
	}

}

@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
//=======HelloWorld级别的java配置======
	@Bean
	public UserDetailsService userDetailsService() {
		InMemoryUserDetailsManager manager = new InMemoryUserDetailsManager();
		manager.createUser(
				User.withDefaultPasswordEncoder() //仅供演示使用，生产环境不安全
						.username("user")
						.password("password")
						.roles("USER").build());
		return manager;
	}
}

	@Override
	protected void configure(HttpSecurity http) throws Exception {
		http
			.authorizeRequests() //配置需要验证的Url
				.anyRequest().authenticated() //所有Url，通过认证即可访问（不需权限检测）
				.and() //相当于xml标签的关闭
			.formLogin() //基于表单验证（没有其他配置表示默认实现）
				.and()
			.httpBasic(); //允许用户使用http协议
	}

	//自定义登录表单
	protected void configure(HttpSecurity http) throws Exception {
		http
			.authorizeRequests()
				.anyRequest().authenticated()
				.and()
			.formLogin()
				.loginPage("/login")
				.permitAll();
	}

	//自定义拦截请求
	protected void configure(HttpSecurity http) throws Exception {
		http
			.authorizeRequests()
				.antMatchers("/resources/**", "/signup", "/about").permitAll() //这几个页面不需要验证
				.antMatchers("/admin/**").hasRole("ADMIN")  //ADMIN角色才能访问
				.antMatchers("/db/**").access("hasRole('ADMIN') and hasRole('DBA')") //必须同时具有ADMIN和DBA角色才能访问
				.anyRequest().authenticated() //其他页面验证通过才能访问
				.and()
			// ...
			.formLogin();
	}

@Bean
public UserDetailsService userDetailsService() throws Exception {
	// ensure the passwords are encoded properly
	UserBuilder users = User.withDefaultPasswordEncoder();
	InMemoryUserDetailsManager manager = new InMemoryUserDetailsManager();
	manager.createUser(users.username("user").password("password").roles("USER").build());
	manager.createUser(users.username("admin").password("password").roles("USER","ADMIN").build());
	return manager;
}

	//JDBC验证
	@Autowired
	private DataSource dataSource;

	@Autowired
	public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
		// ensure the passwords are encoded properly
		UserBuilder users = User.withDefaultPasswordEncoder();
		auth
			.jdbcAuthentication()
				.dataSource(dataSource)
				.withDefaultSchema()
				.withUser(users.username("user").password("password").roles("USER"))
				.withUser(users.username("admin").password("password").roles("USER","ADMIN"));
	}

	@Bean
	public AuthenticationProvider springAuthenticationProvider() {
		return new AuthenticationProvider() {
			@Override
		    public Authentication authenticate(Authentication authentication) throws AuthenticationException {
		        UsernamePasswordAuthenticationToken token = (UsernamePasswordAuthenticationToken) authentication;
		        String username = token.getName();
		        //从数据库找到的用户
		        UserDetails userDetails = null;
		        if(username != null) {
		            userDetails = userDetailsService.loadUserByUsername(username);
		        }
		        //一下认证不通过
		        if(userDetails == null) {
		            throw new UsernameNotFoundException("用户名/密码无效");
		        }else if (!userDetails.isEnabled()){
		            throw new DisabledException("用户已被禁用");
		        }else if (!userDetails.isAccountNonExpired()) {
		            throw new AccountExpiredException("账号已过期");
		        }else if (!userDetails.isAccountNonLocked()) {
		            throw new LockedException("账号已被锁定");
		        }else if (!userDetails.isCredentialsNonExpired()) {
		            throw new LockedException("凭证已过期");
		        }
		        //数据库用户的密码
		        String password = userDetails.getPassword();
		        //与authentication里面的credentials相比较
		        if(!password.equals(token.getCredentials())) {
		            throw new BadCredentialsException("Invalid username/password");
		        }
		        //授权
		        return new UsernamePasswordAuthenticationToken(userDetails, password,userDetails.getAuthorities());
		    }
			@Override
		    public boolean supports(Class<?> authentication) {
		        //返回true后才会执行上面的authenticate方法,这步能确保authentication能正确转换类型
		        return UsernamePasswordAuthenticationToken.class.equals(authentication);
		    }

		};
	}

	@Override
	protected void configure(HttpSecurity http) throws Exception {
		http.rememberMe();
		super.configure(http);
	}

Authentication authenticate(Authentication authentication) throws AuthenticationException;

Authentication authenticate(Authentication authentication) throws AuthenticationException;
boolean supports(Class<?> authentication);

UserDetails loadUserByUsername(String username) throws UsernameNotFoundException;

	Collection<? extends GrantedAuthority> getAuthorities();
	String getPassword();
	String getUsername();
	boolean isAccountNonExpired();
	boolean isAccountNonLocked();
	boolean isCredentialsNonExpired();
	boolean isEnabled();

	String encode(CharSequence rawPassword);
	boolean matches(CharSequence rawPassword, String encodedPassword);

	String getAuthority();

select username, password, enabled from users where username=? --根据username查询用户信息
select username, authority from authorities where username=? --根据username查询用户权限信息
select g.id, g.group_name, ga.authority from groups g, groups_members gm, groups_authorities ga where gm.username=? and g.id=ga.group_id and g.id=gm.group_id --根据username查询用户组权限

create table users(
      username varchar_ignorecase(50) not null primary key,
      password varchar_ignorecase(50) not null,
      enabled boolean not null);

create table authorities (
      username varchar_ignorecase(50) not null,
      authority varchar_ignorecase(50) not null,
      constraint fk_authorities_users foreign key(username) references users(username));

create unique index ix_auth_username on authorities (username,authority);

create table groups (
  id bigint generated by default as identity(start with 0) primary key,
  group_name varchar_ignorecase(50) notnull);

create table group_authorities (
  group_id bigint notnull,
  authority varchar(50) notnull,
  constraint fk_group_authorities_group foreign key(group_id) references groups(id));

create table group_members (
  id bigint generated by default as identity(start with 0) primary key,
  username varchar(50) notnull,
  group_id bigint notnull,
  constraint fk_group_members_group foreign key(group_id) references groups(id));

//实现UserDetails的getAuthorities方法时使用
	@Override
	public Collection<? extends GrantedAuthority> getAuthorities() {
		return Arrays.asList(new SimpleGrantedAuthority("ROLE_READER"));
	}

		<dependency>
			<groupId>org.springframework.security</groupId>
			<artifactId>spring-security-test</artifactId>
			<scope>test</scope>
		</dependency>

//方法上
@Test
@WithMockUser(username = "root", password = "root", roles = "READER")
public void homePage_authenticatedUser() throws Exception {
	mockMvc.perform(get("/")).andExpect(status().isOk());
}


//类上
@RunWith(SpringRunner.class)
@SpringBootTest
@AutoConfigureMockMvc
@WithMockUser(username="admin",roles={"USER","ADMIN"})
public class WithMockUserTests {
}

	@Test
	@WithUserDetails("root")
	public void homePage_authenticatedUser1() throws Exception {
		mockMvc.perform(get("/")
				).andExpect(status().isOk());
	}

@Retention(RetentionPolicy.RUNTIME)
@WithMockUser(value="rob",roles="ADMIN")
public @interface WithMockAdmin { }

import xxx.xxx.xx.xxx.controller;

import javax.servlet.RequestDispatcher;
import javax.servlet.http.HttpServletRequest;

import org.springframework.boot.web.servlet.error.ErrorController;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RestController;

import xxx.xxx.xx.xxx.dto.ResponseDTO;

@RestController
public class BasicStatusCodeErrorController implements ErrorController {

    @RequestMapping("/error")
    public ResponseDTO<?> handleError(HttpServletRequest request) {
        Object status = request.getAttribute(RequestDispatcher.ERROR_STATUS_CODE);
        Object message = request.getAttribute(RequestDispatcher.ERROR_MESSAGE);
        if (message == null){
            message = "Unknown Basic Error";
        }

        if (status != null) {
            Integer statusCode = Integer.valueOf(status.toString());

            return ResponseDTO.failure(statusCode, message.toString());
        }
        return ResponseDTO.failure(500, "Internal Server Error");
    }

    @Override
    public String getErrorPath() {
        return "/error";
    }
}