摘要：在上一篇基本配置了一些文件中，基本可以在文件中指定用戶名和密碼來進行實現的驗證，這次和一起來配合使用加入的配置文件別名在的中配置數據源查找配置事物然后建立層，和層以及對應這里省略實
在上一篇基本配置了一些文件中，基本可以在文件中指定用戶名和密碼來進行實現SpringSecurity的驗證，
這次和mynatis一起來配合使用
加入mybatis的配置文件：
mybatis-config.xml
在spring的ApplicationContext.xml中配置數據源
ApplicationContext.xml
然后建立dao層，和server層以及對應mapper（這里省略）
實現UserDetailService里面的loadUserByUsername方法
public class MyUserDetailService implements UserDetailsService {
@Autowired
UserDao userdao;
@Override
public UserDetails loadUserByUsername(String username)
throws UsernameNotFoundException {
MyUser user =userdao.getUserByName(username);
if(user==null)
{
throw new UsernameNotFoundException("找不到該用戶");
}
//這里最好的做法就是遍歷用戶身份，獲取用戶權限
// Collection grantedAuthorities = new ArrayList<>();
// SimpleGrantedAuthority grantedAuthority = new SimpleGrantedAuthority(role);
// grantedAuthorities.add(grantedAuthority);
return new MyUserDetail(user, getAuthorities(user.getUser_role()));
}
private Collection getAuthorities(String role) {
Collection grantedAuthorities = new ArrayList<>();
SimpleGrantedAuthority grantedAuthority = new SimpleGrantedAuthority(role);
grantedAuthorities.add(grantedAuthority);
return grantedAuthorities;
}
}
UserDetail
public class MyUserDetail implements UserDetails {
private MyUser myUser;
private Collection authorities;
public MyUserDetail(MyUser user,Collection authorities) {
this.myUser = user;
this.authorities = authorities;
}
@Override
public Collection getAuthorities() {
// TODO Auto-generated method stub
return authorities;
}
@Override
public String getPassword() {
return myUser.getUser_password();
}
@Override
public String getUsername() {
return myUser.getUser_name();
}
//下面的方法可以以后再添加
@Override
public boolean isAccountNonExpired() {
// TODO Auto-generated method stub
return false;
}
@Override
public boolean isAccountNonLocked() {
// TODO Auto-generated method stub
return false;
}
@Override
public boolean isCredentialsNonExpired() {
// TODO Auto-generated method stub
return false;
}
@Override
public boolean isEnabled() {
// TODO Auto-generated method stub
return false;
}
AuthenticationProvider類
關于類中的這個UsernamePasswordAuthenticationToken，Spring官方文檔中給出的說明如下：
1. The username and password are obtained and combined into an instance of UsernamePasswordAuthenticationToken (an instance of
the Authentication interface, which we saw earlier).
2. The token is passed to an instance of AuthenticationManager for validation.
3. The AuthenticationManager returns a fully populated Authentication instance on successful authentication.
4. The security context is established by calling SecurityContextHolder.getContext().setAuthentication(… ) , passing in the returned
authentication object.
UsernamePasswordAuthenticationToken繼承AbstractAuthenticationToken實現Authentication
所以當在頁面中輸入用戶名和密碼之后首先會進入到UsernamePasswordAuthenticationToken驗證(Authentication)，然后生成的Authentication會被交由AuthenticationManager來進行管理而AuthenticationManager管理一系列的AuthenticationProvider，而每一個Provider都會通UserDetailsService和UserDetail來返回一個以UsernamePasswordAuthenticationToken實現的帶用戶名和密碼以及權限的Authentication
public class SecurityProvider implements AuthenticationProvider {
@Autowired
private MyUserDetailService userDetailsService;
@Override
public Authentication authenticate(Authentication authentication)
throws AuthenticationException {
//
UsernamePasswordAuthenticationToken token = (UsernamePasswordAuthenticationToken) authentication;
UserDetails userDetails = userDetailsService.loadUserByUsername(token.getName());
if (userDetails == null) {
throw new UsernameNotFoundException("找不到該用戶");
}
if(!userDetails.getPassword().equals(token.getCredentials().toString()))
{
throw new BadCredentialsException("密碼錯誤");
}
return new UsernamePasswordAuthenticationToken(userDetails,userDetails.getPassword(),userDetails.getAuthorities());
}
@Override
public boolean supports(Class authentication) {
// TODO Auto-generated method stub
return UsernamePasswordAuthenticationToken.class.equals(authentication);
}
}
項目地址：https://github.com/Somersames...
文章版權歸作者所有，未經允許請勿轉載,若此文章存在違規行為，您可以聯系管理員刪除。
轉載請注明本文地址：http://m.specialneedsforspecialkids.com/yun/66718.html
