SpringSecurity初步理解

Authenticating a User with LDAP

首先创建一个简单的web控制器

 package hello;

 import org.springframework.web.bind.annotation.GetMapping;
 import org.springframework.web.bind.annotation.RestController;

 @RestController
 public class HomeController {

     @GetMapping("/")
     public String index() {
         return "Welcome to the home page!";
     }
 }

老生常谈，用到springboot，肯定少不了它的启动类

package hello;

import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;

@SpringBootApplication
public class Application {

    public static void main(String[] args) {
        SpringApplication.run(Application.class, args);
    }

}

SpringSecurity需要用到的maven依赖如下图

<dependencies>
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-web</artifactId>
    </dependency>
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-security</artifactId>
    </dependency>
    <dependency>
        <groupId>org.springframework.ldap</groupId>
        <artifactId>spring-ldap-core</artifactId>
    </dependency>
    <dependency>
        <groupId>org.springframework.security</groupId>
        <artifactId>spring-security-ldap</artifactId>
    </dependency>
    <dependency>
        <groupId>com.unboundid</groupId>
        <artifactId>unboundid-ldapsdk</artifactId>
    </dependency>
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-test</artifactId>
        <scope>test</scope>
    </dependency>
    <dependency>
        <groupId>org.springframework.security</groupId>
        <artifactId>spring-security-test</artifactId>
        <scope>test</scope>
    </dependency>
</dependencies>

开始做详细的安全认证，安全认证的思路是这样的“

创建一个类并继承WebSecurityConfigurerAdapter这个方法，并在之类中重写configure的3个方法，
其中3个方法中参数包括为
HttpSecurity（HTTP请求安全处理），AuthenticationManagerBuilder（身份验证管理生成器）和WebSecurity（WEB安全）。

如下代码

 package com.ssm.demo.com.ssm.Hello;

 import org.springframework.context.annotation.ComponentScan;
 import org.springframework.context.annotation.Configuration;
 import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
 import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
 import org.springframework.security.crypto.password.LdapShaPasswordEncoder;
 /**
  *
  创建一个类并继承WebSecurityConfigurerAdapter这个方法，并在之类中重写configure的3个方法，
  其中3个方法中参数包括为
  HttpSecurity（HTTP请求安全处理），AuthenticationManagerBuilder（身份验证管理生成器）和WebSecurity（WEB安全）。
  */
 @Configuration
 @ComponentScan
 public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
     /**
      * http请求安全处理
      * @param http
      * @throws Exception
      */
     @Override
     protected void configure(HttpSecurity http) throws Exception {
         //http.authorizeRequests()这里的意思是通过方法来开始请求权限配置，
         //fullyAuthenticated()意为用户完全认证可以访问
         //and()是返回一个securityBuilder对象，formLogin()和httpBasic()是授权的两种方式
         http.authorizeRequests().anyRequest().fullyAuthenticated().and().formLogin();
     }

     /**
      * 身份验证管理生成器
      * @param auth
      * @throws Exception
      */
     @Override
     protected void configure(AuthenticationManagerBuilder auth) throws Exception {
         auth.ldapAuthentication().userDnPatterns("uid={0},ou=people").groupSearchBase("ou=groups").contextSource().
                 url("ldap://localhost:8389/dc=springframework,dc=org").and().passwordCompare().passwordEncoder(new LdapShaPasswordEncoder())
                 .passwordAttribute("userPassword");
     }
 }

设置用户数据，使用到LDAP服务器（ldif文件），

在yml中添加LDAP服务的代理

server:
  servlet:
    context-path: /llh
  port: 8082
spring:
  datasource:
    url: jdbc:mysql://127.0.0.1:3306/depot?useUnicode=true&characterEncoding=utf8
    username: root
    password: 123456
  servlet:
    multipart:
      max-file-size: 128KB
      max-request-size: 128KB
  ldap:
    embedded:
      ldif: classpath:test-server.ldif
      base-dn: dc=springframework,dc=org
      port: 8389

resource文件夹下面创建一个test-server.ldif文件

 dn: dc=springframework,dc=org
 objectclass: top
 objectclass: domain
 objectclass: extensibleObject
 dc: springframework

 dn: ou=groups,dc=springframework,dc=org
 objectclass: top
 objectclass: organizationalUnit
 ou: groups

 dn: ou=subgroups,ou=groups,dc=springframework,dc=org
 objectclass: top
 objectclass: organizationalUnit
 ou: subgroups

 dn: ou=people,dc=springframework,dc=org
 objectclass: top
 objectclass: organizationalUnit
 ou: people

 dn: ou=space cadets,dc=springframework,dc=org
 objectclass: top
 objectclass: organizationalUnit
 ou: space cadets

 dn: ou=\"quoted people\",dc=springframework,dc=org
 objectclass: top
 objectclass: organizationalUnit
 ou: "quoted people"

 dn: ou=otherpeople,dc=springframework,dc=org
 objectclass: top
 objectclass: organizationalUnit
 ou: otherpeople

 dn: uid=ben,ou=people,dc=springframework,dc=org
 objectclass: top
 objectclass: person
 objectclass: organizationalPerson
 objectclass: inetOrgPerson
 cn: Ben Alex
 sn: Alex
 uid: ben
 userPassword: {SHA}nFCebWjxfaLbHHG1Qk5UU4trbvQ=

 dn: uid=bob,ou=people,dc=springframework,dc=org
 objectclass: top
 objectclass: person
 objectclass: organizationalPerson
 objectclass: inetOrgPerson
 cn: Bob Hamilton
 sn: Hamilton
 uid: bob
 userPassword: bobspassword

 dn: uid=joe,ou=otherpeople,dc=springframework,dc=org
 objectclass: top
 objectclass: person
 objectclass: organizationalPerson
 objectclass: inetOrgPerson
 cn: Joe Smeth
 sn: Smeth
 uid: joe
 userPassword: joespassword

 dn: cn=mouse\, jerry,ou=people,dc=springframework,dc=org
 objectclass: top
 objectclass: person
 objectclass: organizationalPerson
 objectclass: inetOrgPerson
 cn: Mouse, Jerry
 sn: Mouse
 uid: jerry
 userPassword: jerryspassword

 dn: cn=slash/guy,ou=people,dc=springframework,dc=org
 objectclass: top
 objectclass: person
 objectclass: organizationalPerson
 objectclass: inetOrgPerson
 cn: slash/guy
 sn: Slash
 uid: slashguy
 userPassword: slashguyspassword

 dn: cn=quote\"guy,ou=\"quoted people\",dc=springframework,dc=org
 objectclass: top
 objectclass: person
 objectclass: organizationalPerson
 objectclass: inetOrgPerson
 cn: quote\"guy
 sn: Quote
 uid: quoteguy
 userPassword: quoteguyspassword

 dn: uid=space cadet,ou=space cadets,dc=springframework,dc=org
 objectclass: top
 objectclass: person
 objectclass: organizationalPerson
 objectclass: inetOrgPerson
 cn: Space Cadet
 sn: Cadet
 uid: space cadet
 userPassword: spacecadetspassword

 dn: cn=developers,ou=groups,dc=springframework,dc=org
 objectclass: top
 objectclass: groupOfUniqueNames
 cn: developers
 ou: developer
 uniqueMember: uid=ben,ou=people,dc=springframework,dc=org
 uniqueMember: uid=bob,ou=people,dc=springframework,dc=org

 dn: cn=managers,ou=groups,dc=springframework,dc=org
 objectclass: top
 objectclass: groupOfUniqueNames
 cn: managers
 ou: manager
 uniqueMember: uid=ben,ou=people,dc=springframework,dc=org
 uniqueMember: cn=mouse\, jerry,ou=people,dc=springframework,dc=org

 dn: cn=submanagers,ou=subgroups,ou=groups,dc=springframework,dc=org
 objectclass: top
 objectclass: groupOfUniqueNames
 cn: submanagers
 ou: submanager
 uniqueMember: uid=ben,ou=people,dc=springframework,dc=org

这时候就可以启动springboot的启动类，键入地址：http://127.0.0.1:8082/llh/，发现已经被拦截下来了，并且重定向到了Spring Security提供的登录页面

，见下图：

输入用户名：ben，密码：benspassword，即可登录。