spring security 基于角色的控制，可运行。

基于角色的访问控制

建表语句，见 上一篇 的博文，  https://www.cnblogs.com/sdgtxuyong/p/16157870.html

在配置类中，@EnableGlobalMethodSecurity(securedEnabled=true),启用那个级别的认证，就要在控制器中，用哪个注解，否则不起作用。这里是用@Secured，注解。

用户 user 继承自 UserDetails

@Data
@AllArgsConstructor
@NoArgsConstructor
@TableName("sys_user")
public class User  implements UserDetails {

@TableField(exist = false)
private List<Role> roles;

private static final long serialVersionUID = 1L;

@Override
public Collection<? extends GrantedAuthority> getAuthorities() {
    return roles;
}

角色继承自 GrantedAuthority ，这个词，在springsecurity中，代表角色

@Data
@AllArgsConstructor
@NoArgsConstructor
@TableName("sys_role")
public class Role implements GrantedAuthority {

@Override
public String getAuthority() {
    return roleName;
}

@TableField(exist = false)
private List<Permission> permissionList;

dao

userdao中，返回值 封装 roles 类型

@Repository
@Transactional
public interface UserDao extends BaseMapper<User> {

    @Select("select * from sys_user where username = #{username}")
    @Results({
            @Result(id = true, property = "id", column = "id"),
            @Result(property = "roles", column = "id", javaType = List.class,
                    many = @Many(select = "cn.taotao.dao.RoleDao.findByUid"))
    })
    public User findByName(String username);

    @Select("select * from sys_user where id=#{id}")
    @Results({
            @Result(id=true, column = "id",property = "id"),
            @Result(column = "username",property = "username"),
            @Result(column = "password",property = "password"),
            @Result(javaType = List.class,property = "roles",column = "id",
                    many=@Many(select="cn.taotao.dao.RoleDao.findRoleById"))
    })
    User findUserAndRoleById(int id);

}

roleDao

@Repository
@Transactional
public interface RoleDao extends BaseMapper<Role> {

    @Select("SELECT r.id, r.role_name roleName, r.role_desc roleDesc " +
            "FROM sys_role r, sys_user_role ur " +
            "WHERE r.id=ur.rid AND ur.uid=#{uid}")
    public List<Role> findByUid(Integer uid);

    @Select("SELECT * FROM sys_role r ,sys_user_role ur WHERE r.`ID`=ur.`RID`AND ur.`UID`=#{id}" )
    @Results({
            @Result(id = true, property = "id",column = "id"),
            @Result(property = "roleName",column = "role_name"),
            @Result(property = "roleDesc",column = "role_desc"),
            @Result(property = "permissionList",column = "rid",many = @Many(select="cn.taotao.dao.PermissionDao.findPermissionAndRoleById"))
    })
    List<Role> findRoleById(int id);
}

permissionDao

@Repository
@Transactional
public interface PermissionDao extends BaseMapper<Permission> {

    @Select("SELECT * FROM sys_permission p ,sys_role_permission rp WHERE p.`ID`=rp.`PID` AND rp.`RID`=#{id}")
    public List<Permission> findPermissionAndRoleById(int id);
}

服务层

public interface UserService extends IService<User> , UserDetailsService {
}

@Service
public class UserServiceImpl extends ServiceImpl<UserDao, cn.taotao.domain.User> implements UserService {

    @Autowired
    private UserDao userDao;

    @Override
    public UserDetails loadUserByUsername(String s) throws UsernameNotFoundException {
//        cn.taotao.domain.User user = userDao.findByName(s);
//       这些注释掉的，都不需要
//        //根据用户的id查询用户的权限
//       // List<String> permissions = userDao.findPermissionsByUserId(user.getId());
//        cn.taotao.domain.User userAndRoleById = userDao.findUserAndRoleById(user.getId());
//        List<String> permissionLists = new ArrayList<>();
//        userAndRoleById.getRoles().forEach(o->o.getPermissionList().forEach(e->{permissionLists.add(e.getPermissionName());}));
//        //将permissions转成数组
//        String[] permissionArray = new String[permissionLists.size()];
//        permissionLists.toArray(permissionArray);
//        permissionLists.forEach(o-> System.out.println(o));
//        System.err.println("permissionArray = " + permissionArray.toString());
//        UserDetails userDetails = User.withUsername(user.getUsername()).password(user.getPassword()).authorities(permissionArray).build();
//        System.err.println("userDetails = " + userDetails);
        return userDao.findByName(s);

    }

异常处理

@ControllerAdvice
public class HandlerControllerException {

    @ExceptionHandler(RuntimeException.class)
    public String handException(RuntimeException e){
        if(e instanceof AccessDeniedException){
            return "redirect:/403.jsp";
        }
        return "redirect:/500.jsp";
    }
}

配置类

@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(securedEnabled=true)    // 这里有3个类型可选，用来区分安全级别，有spring的，有springmvc的，有jsr250的，如果这里启用哪个，在控制器中，就必须用那个，来控制权限。
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired
    private UserService userService;

    @Bean
    public BCryptPasswordEncoder passwordEncoder(){
        return new BCryptPasswordEncoder();
    }

    //指定认证对象的来源
    public void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.userDetailsService(userService).passwordEncoder(passwordEncoder());
    }
    //SpringSecurity配置信息
    public void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests()
                .antMatchers("/login.jsp", "failer.jsp","403.jsp","500.jsp", "/number.jpg","/static/**","/css/**", "/img/**", "/plugins/**").permitAll()
              //  .antMatchers("/add").hasAnyRole("admin")
                .anyRequest().authenticated()
             //   .anyRequest().permitAll()
                .and()
                .formLogin()
                .loginPage("/login.jsp")
                .loginProcessingUrl("/login")
                .successForwardUrl("/index.jsp")
                .failureForwardUrl("/failer.jsp")
                .and()
                .logout()
                .logoutSuccessUrl("/logout")
                .invalidateHttpSession(true)
                .logoutSuccessUrl("/login.jsp")
                .and()
                .csrf()
                .disable()
                .rememberMe()
                .tokenRepository(getPersistentTokenRepository())
                .tokenValiditySeconds(3600)
                .userDetailsService(userDetailsService);
    }

    @Autowired
    private DataSource dataSource;

    //记住我后的登录页面
    @Autowired
    private UserDetailsService userDetailsService;
    //记住我的功能
    @Bean
    public PersistentTokenRepository getPersistentTokenRepository() {
        JdbcTokenRepositoryImpl jdbcTokenRepositoryImpl=new JdbcTokenRepositoryImpl();
        jdbcTokenRepositoryImpl.setDataSource(dataSource);
        //启动时创建一张表，这个参数到第二次启动时必须注释掉，因为已经创建了一张表
//      jdbcTokenRepositoryImpl.setCreateTableOnStartup(true);
        return jdbcTokenRepositoryImpl;
    }

}

控制器

    @RequestMapping("/updateOrder/{id}")
   // @PreAuthorize("hasAuthority('updateOrder')")
    @Secured("ROLE_ADMIN")
    public  ModelAndView updateOrder(@PathVariable("id") Long id,@RequestParam("comment") String comment){
        ModelAndView mv = new ModelAndView();

        this.ordersService.update(this.ordersService.getById(id), new UpdateWrapper<Orders>().eq("id",id).set("comment",comment));

        mv.setViewName("redirect:/list");
        return mv;

    }

jsp页面

<%@ taglib prefix="sec" uri="http://www.springframework.org/security/tags" %>

<sec:authorize access="hasAnyRole('ROLE_ADMIN')"> <button type="submit" class="btn btn-primary" style="margin-top: 30px">修改备注</button></sec:authorize>