1.因產品需求方的要求，我經過考察，使用現今流行的springboot框架，security許可權配置，剛開始碰到不少坑，後來慢慢琢磨，其實發現也就那麼一回事。

2.看本文章前，需要有點springboot對於註解基礎，否則可能不太理解。

這個是我的基本配置，有部分大家可能用不到，我就說一下基本使用的哪些。

WebConfig這個類繼承WebMvcConfigurerAdapter，其實主要是配置攔截器使用的

@Configuration
public class WebConfig extends WebMvcConfigurerAdapter {

    @Autowired
    private WebDavConfig webDavConfig;
    
    @Autowired
    private UserSecurityInterceptor securityInterceptor;

 

    @Override
    public void addInterceptors(InterceptorRegistry registry) {
        registry.addInterceptor(new BreadCrumbInterceptor()).addPathPatterns("/**");
        registry.addInterceptor(new WorkWXInterceptor()).addPathPatterns("/**");

        .excludePathPatterns("/login","/logout");//配置登入攔截器攔截路徑
        
     //   registry.addInterceptor(authInterceptor);  //用於跨域時候攔截判斷
    }
    
    @Override  
    public void addCorsMappings(CorsRegistry registry) {  
        registry.addMapping("/**")  
                .allowedOrigins("*")  
                .allowCredentials(true)  
                .allowedMethods("GET", "POST", "DELETE", "PUT")  
                .maxAge(3600);  
    }  

 

    

    @Bean
    public FilterRegistrationBean webDavFilterRegistration() {

        WebDavEngine engine = new WebDavEngine(webDavConfig.getFsPath());

        FilterRegistrationBean registration = new FilterRegistrationBean();
        registration.setFilter(engine.getFilter());
        registration.addUrlPatterns(engine.getResourceRoot());
        registration.setName("webdav");
        registration.setEnabled(webDavConfig.isEnable());
        return registration;

    }

}
主要其實也就一些攔截器配置使用，其它功能其實很少使用到。具體就那樣。

主要的許可權配置還是如下：

public class WebSecurityConfig extends WebSecurityConfigurerAdapter{

}

這個WebSecurityConfig繼承WebSecurityConfigurerAdapter，並重寫它的方法來設定安全許可權

import mobi.shoumeng.oa.entities.base.config.CasProperties;

/**
 * Created by wuyanzhou
 * Copyright @2017
 */

import mobi.shoumeng.oa.services.auth.UserAuthService;
import mobi.shoumeng.oa.services.workwx.auth.WorkWXAuthFilter;
import mobi.shoumeng.oa.services.workwx.auth.WorkWXAuthProvider;

@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired
    private UserAuthService userAuthService;

    @Autowired
    private WorkWXAuthProvider workWXAuthProvider;
    
    @Autowired
    private MyFilterSecurityInterceptor myFilterSecurityInterceptor;
    
    @Autowired  
    private CasProperties casProperties;   //Cas認證
    
    @Autowired
    private UserSecurityInterceptor securityInterceptor;
    
   
    
    @Override
    protected void configure(HttpSecurity http) throws Exception {

        http
                .authorizeRequests()
                .antMatchers("/weixin","/favicon.ico", "/js/*","/css/*","/jquery-ui-timepicker-addon/*","/images/*", "/fonts/*", "/caldav", "/carddav", "/files/").permitAll()//這些靜態可以全部許可權訪問
                .anyRequest().authenticated()
                .and()
                //增加企業微信登入處理
                .addFilterAfter(getWorkWXAuthenticationFilter(), UsernamePasswordAuthenticationFilter.class)
                .csrf().disable()
                .formLogin().loginPage("/login")//登入頁面
                .defaultSuccessUrl("/#/notice/index",true)//預設跳轉
                .permitAll()
                .and()
//                .rememberMe()
//                .tokenValiditySeconds(360000)
//                .userDetailsService(userAuthService)
//                .useSecureCookie(true)
//                .and()
                .headers()
                .defaultsDisabled()
                .contentTypeOptions();
          
        http.sessionManagement()   //配置session的功能
        .maximumSessions(1)
        .maxSessionsPreventsLogin(false)  //這個功能很強悍，我這樣配置，你的登入會把賬號擠出去
        .expiredUrl("/login")
        .sessionRegistry(sessionRegistry());//session的其他註冊配置
        
        
        
       http.logout()
       .logoutUrl("/logout")
       .logoutSuccessUrl(casProperties.getCasServerLogoutUrl())  //這個是登出時候跳到單點伺服器上面，把單點登出了賬號
       .invalidateHttpSession(true)   //初始化
       .clearAuthentication(true)//清除許可權
       .invalidateHttpSession(true)
       .permitAll();
        
      http.addFilterBefore(myFilterSecurityInterceptor, FilterSecurityInterceptor.class);

   //   http.exceptionHandling().accessDeniedPage("/Jurisdiction/insufficientAuthority"); //嘗試測試
      //session等待時間
     // http.sessionManagement().wait(1800);
      
      http.exceptionHandling()
      .accessDeniedPage("/Jurisdiction/insufficientAuthority")  //當頁面沒有許可權的時候，跳轉地方
      .authenticationEntryPoint(casAuthenticationEntryPoint())  //單點登入的認證入口
      .and()  
      .addFilter(casAuthenticationFilter())  //記得新增攔截器
      .addFilterBefore(casLogoutFilter(), LogoutFilter.class)  //新增登出攔截器
      .addFilterBefore(singleSignOutFilter(), CasAuthenticationFilter.class);   
     
      
      
    }

    private WorkWXAuthFilter getWorkWXAuthenticationFilter() throws Exception {

        WorkWXAuthFilter filter = new WorkWXAuthFilter();//微信登入設定驗證
        filter.setAuthenticationManager(authenticationManager());
        return filter;

    }
    
    
    @Autowired
    public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {

        auth
                .userDetailsService(userAuthService)//使用者驗證
                .passwordEncoder(new ShaPasswordEncoder())//加密演算法，使用sh1
                .and()
                .authenticationProvider(workWXAuthProvider);//微信登入的驗證入口
      
       
                auth.authenticationProvider(casAuthenticationProvider());  //單點登入驗證
    }
    
    // Work around https://jira.spring.io/browse/SEC-2855
    @Bean
    public SessionRegistry sessionRegistry() {
        SessionRegistry sessionRegistry = new SessionRegistryImpl();
        return sessionRegistry;
    }
    @Bean
    public static ServletListenerRegistrationBean httpSessionEventPublisher() {
        return new ServletListenerRegistrationBean(new HttpSessionEventPublisher());
    }
    
    
    
    
    
    /**認證的入口*/  
    @Bean  
    public CasAuthenticationEntryPoint casAuthenticationEntryPoint() {  
        CasAuthenticationEntryPoint casAuthenticationEntryPoint = new CasAuthenticationEntryPoint();  
        casAuthenticationEntryPoint.setLoginUrl(casProperties.getCasServerLoginUrl());  
        casAuthenticationEntryPoint.setServiceProperties(serviceProperties());  
        return casAuthenticationEntryPoint;  
    }  
      
    /**指定service相關資訊*/  
    @Bean  
    public ServiceProperties serviceProperties() {  
        ServiceProperties serviceProperties = new ServiceProperties();  
        serviceProperties.setService(casProperties.getAppServerUrl() + casProperties.getAppLoginUrl());  
        serviceProperties.setAuthenticateAllArtifacts(true);  
        return serviceProperties;  
    }  
      
    /**CAS認證過濾器*/  
    @Bean  
    public CasAuthenticationFilter casAuthenticationFilter() throws Exception {  
        CasAuthenticationFilter casAuthenticationFilter = new CasAuthenticationFilter();  
        casAuthenticationFilter.setAuthenticationManager(authenticationManager());  
        casAuthenticationFilter.setFilterProcessesUrl(casProperties.getAppLoginUrl());  
        return casAuthenticationFilter;  
    }  
      
    /**cas 認證 Provider*/  
    @Bean  
    public CasAuthenticationProvider casAuthenticationProvider() {  
        CasAuthenticationProvider casAuthenticationProvider = new CasAuthenticationProvider();  
      //  casAuthenticationProvider.setAuthenticationUserDetailsService(customUserDetailsService());  
         casAuthenticationProvider.setUserDetailsService(userAuthService);//這個是我自己配置，根據自己需要配置
        //casAuthenticationProvider.setUserDetailsService(customUserDetailsService()); //這裡只是介面型別，實現的介面不一樣，都可以的。  
        casAuthenticationProvider.setServiceProperties(serviceProperties());  
        casAuthenticationProvider.setTicketValidator(cas20ServiceTicketValidator());  
        casAuthenticationProvider.setKey("casAuthenticationProviderKey");  
        return casAuthenticationProvider;  
    }  
      
//   @Bean
//    public UserDetailsService UserDetailsService(){
//        return new UserAuthService();
//    }
      
//    /**使用者自定義的AuthenticationUserDetailsService*/  
//    @Bean  
//    public AuthenticationUserDetailsService<CasAssertionAuthenticationToken> customUserDetailsService(){  
//        return new UserAuthService();  
//    }  
      
    @Bean  
    public Cas20ServiceTicketValidator cas20ServiceTicketValidator() {  //一種校驗方式
        return new Cas20ServiceTicketValidator(casProperties.getCasServerUrl());  
    }  
      
    /**單點登出過濾器*/  
    @Bean  
    public SingleSignOutFilter singleSignOutFilter() {  
        SingleSignOutFilter singleSignOutFilter = new SingleSignOutFilter();  
        singleSignOutFilter.setCasServerUrlPrefix(casProperties.getCasServerUrl());  
        singleSignOutFilter.setIgnoreInitConfiguration(true);  
        return singleSignOutFilter;  
    }  
      
    /**請求單點退出過濾器*/  
    @Bean  
    public LogoutFilter casLogoutFilter() {  //這個地方要注意，service需要你在單點伺服器上面配置那邊配置跳轉，會跳轉你需要的頁面，否則跳不回來
        LogoutFilter logoutFilter = new LogoutFilter(casProperties.getCasServerLogoutUrl()+"?service=" + casProperties.getAppServerUrl() + casProperties.getAppLoginUrl(), new SecurityContextLogoutHandler());  
        logoutFilter.setFilterProcessesUrl(casProperties.getAppLogoutUrl());  
        return logoutFilter;  
    }  
}  
    
    

@Component
public class UserAuthService implements UserDetailsService{//, AuthenticationUserDetailsService<CasAssertionAuthenticationToken>  {

    @Autowired
    private UserRepository userRepository;
  
    
    @Autowired
    DepartementServiceImpl departementServiceImpl;
    
    @Autowired
    PepopleServiceImpl  pepopleServiceImpl;
    
    @Autowired
    CommentSession commentSession;
    
    @Autowired
    HttpServletRequest request;
    
    @Autowired
    UserRoleServiceImpl userRoleServiceImpl;
    

    

    @Override
    public UserDetails loadUserByUsername(String s) throws UsernameNotFoundException {
        List<GrantedAuthority> grantedAuthorities = new ArrayList <>();
        User user = userRepository.findByLoginAccount(s);
        if(user.getUseif()!=1){
            return null;
        }
        UserRole userRole = user.getUserRole();
        UserRole findByUserRole = userRoleServiceImpl.findByUserRole(userRole.getId());
    //     System.out.println("測試角色"+userRole.getName());
        Set<UserPermission> userPermissions = findByUserRole.getUserPermissions();
        for(UserPermission se:userPermissions){
            // System.out.println("測試列表"+se.getName());
             GrantedAuthority grantedAuthority = new SimpleGrantedAuthority(se.getName());
             //1：此處將許可權資訊新增到 GrantedAuthority 物件中，在後面進行全許可權驗證時會使用GrantedAuthority 物件。
             grantedAuthorities.add(grantedAuthority);
        }
       
        if (Objects.isNull(user)) {
            
            
            throw new UsernameNotFoundException(String.format("使用者名稱[%s]未找到", s));
        }
   
        org.springframework.security.core.userdetails.User sysuser=new org.springframework.security.core.userdetails.User(user.getUsername(),user.getPassword(),grantedAuthorities);
         return sysuser;

    }

上面的許可權必須使用者表必須實現介面User implements UserDetails, Serializable

本人的許可權是直接在UserDetails設定，這樣避免一些實體類上的問題。許可權是根據你的角色裡面資源載入，把你的資源URL匹配。

其它的許可權驗證和網上很多資料差不多，就是配置一下過濾器過濾URL，把每個你配置URL判斷是否該資源有沒有許可權問題等。

 public void decide(Authentication authentication, Object object, Collection<ConfigAttribute> configAttributes) throws AccessDeniedException, InsufficientAuthenticationException {

        if(null== configAttributes || configAttributes.size() <=0) {
            return;
        }
        ConfigAttribute c;
        String needRole;
        for(Iterator<ConfigAttribute> iter = configAttributes.iterator(); iter.hasNext(); ) {
            c = iter.next();
            needRole = c.getAttribute();
            for(GrantedAuthority ga : authentication.getAuthorities()) {//authentication 為在註釋1 中迴圈新增到 GrantedAuthority 物件中的許可權資訊集合
                if(needRole.trim().equals(ga.getAuthority())) {
                    return;
                }
            }
        }
  

總體上講的可能不是很全面，但是基本的配置已經有註解和講說。可能有部分沒有複製上去，不過網上已經很多資料可以查閱，我的方法其實主要配置已經是非常完善。

有什麼技術上的問題，也可以加我的QQ詢問我。可能平時不線上，也可以留言。。一位開發者的分享。