SpringSecurity基于数据库RBAC数据模型控制权限

⒈通用RBAC(Role - Based Access Control）数据模型

 

⒉如何使用

　　1.

　　

package cn.coreqi.ssoserver.rbac;

import org.springframework.security.core.Authentication;

import javax.servlet.http.HttpServletRequest;

public interface RbacService {

    /**
     *
     * @param request   当前请求的信息
     * @param authentication    当前用户的信息
     * @return  是否拥有访问权限
     */
    boolean hasPermission(HttpServletRequest request, Authentication authentication);
}

　　2.

package cn.coreqi.ssoserver.rbac.impl;

import cn.coreqi.ssoserver.rbac.RbacService;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.stereotype.Component;
import org.springframework.util.AntPathMatcher;

import javax.servlet.http.HttpServletRequest;
import java.util.HashSet;
import java.util.Set;

@Component("rbacService")
public class RbacServiceImpl implements RbacService {

    private AntPathMatcher antPathMatcher = new AntPathMatcher();

    /**
     *
     * @param request   当前请求的信息
     * @param authentication    当前用户的信息
     * @return  是否拥有访问权限
     */
    @Override
    public boolean hasPermission(HttpServletRequest request, Authentication authentication) {
        Object principal = authentication.getPrincipal();
        boolean hasPermission = false;
        if(principal instanceof UserDetails){
            String username = ((UserDetails)principal).getUsername();
            //在数据库中读取用户所拥有权限的所有URL
            //在这里使用Set模拟
            Set<String> urls = new HashSet<>();
            for (String url : urls){
                if(antPathMatcher.match(url,request.getRequestURI())){
                    hasPermission = true;
                    break;
                }
            }
        }
        return hasPermission;
    }
}

　　3.写一个权限表达式，让SpringSecurity调用我们的方法

@EnableWebSecurity
public class SsoWebSecurityConfig extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.formLogin()
                .and()
                .authorizeRequests()
                    .anyRequest().access("@rbacService.hasPermission(request, authentication)") //为了避免该配置被覆盖，必要时需要使用@Order注解设置优先级。
                .and()
                    .csrf().disable();    //禁用CSRF
    }

}