Spring Security授权_编写查询权限方法

在认证后进行授权需要根据用户id查询到用户的权限，写法如下：

1. 编写用户、角色、权限实体类

   xxxxxxxxxx
   // 不要命名为User，避免和Spring Security提供的User混淆
   @Data
   public class Users {
       private Integer uid;
       private String username;
       private String password;
       private String phone;
   }
   
   // 角色
   @Data
   public class Role {
       private String rid;
       private String roleName;
       private String roleDesc;
   }
   
   // 权限
   @Data
   public class Permission {
       private String pid;
       private String permissionName;
       private String url;
   }
   

2. 编写UserMapper接口

   xxxxxxxxxx
   // 根据用户名查询权限
   List<Permission> findPermissionByUsername(String username);
   

3. 在resources目录中编写UsersMapper的映射文件

   xxxxxxxxxx
   <?xml version="1.0" encoding="UTF-8"?>
   <!DOCTYPE mapper
           PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
           "http://mybatis.org/dtd/mybatis-3-mapper.dtd">
   <mapper namespace="com.itbaizhan.myspringsecurity.mapper.UsersMapper">
       <select id="findPermissionByUsername" parameterType="string" resultType="com.itbaizhan.myspringsecurity.domain.Permission">
           SELECT DISTINCT permission.pid,permission.permissionName,permission.url FROM
           users
           LEFT JOIN users_role on users.uid = users_role.uid
           LEFT JOIN role on users_role.rid = role.rid
           LEFT JOIN role_permission on role.rid = role_permission.rid
           LEFT JOIN permission on role_permission.pid = permission.pid
           where username = #{username}
       </select>
   </mapper>
   

4. 测试方法

   xxxxxxxxxx
   @SpringBootTest
   public class UsersMapperTest {
       @Autowired
       private UsersMapper usersMapper;
   
       @Test
       public void testFindPermissionByUsername(){
           List<Permission> baizhan = usersMapper.findPermissionByUsername("baizhan");
           baizhan.forEach(System.out::println);
       }
   }
   

5. 修改认证逻辑，认证成功后给用户授权

   xxxxxxxxxx
   // 自定义认证逻辑
   @Override
   public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
       // 1.构造查询条件
       QueryWrapper<Users> wrapper = new QueryWrapper<Users>().eq("username", username);
       // 2.查询用户
       Users users = userMapper.selectOne(wrapper);
       if (users == null){
           return null;
       }
       // 3.查询用户权限
       List<Permission> permissions = userMapper.findPermissionByUsername(username);
       // 4.将自定义权限集合转为Security的权限类型集合
       List<GrantedAuthority> grantedAuthorities = new ArrayList<>();
       for (Permission permission : permissions) {
           grantedAuthorities.add(new SimpleGrantedAuthority(permission.getUrl()));
       }
       // 5.封装为UserDetails对象
       UserDetails userDetails = User.withUsername(users.getUsername())
           .password(users.getPassword())
           .authorities(grantedAuthorities)
           .build();
       // 6.返回封装好的UserDetails对象
       return userDetails;
   }
   

实时效果反馈

1. 在Spring Security中，查询到的权限需要封装为对象

A GrantedAuthority

B Authority

C Permission

D Role

2. 在SpringSecurity中，

A 认证通过后才能授权

B 授权通过后才能认证

C 认证和授权的顺序没有特殊要求

D 以上说法都不对

答案

1=>A 2=>A