因為網上關於這個springboot+security自定義驗證有好多寫的有點雜亂，在仿寫的過程中總是出現莫名其妙的bug，所以專門寫一篇最基礎的出來。

本篇還是使用熟悉的springboot+mybatis+thymeleaf來搭最基礎的架構，當然不用資料庫也是可以的，自己在邏輯實現類新建一個物件測試就好了。

一、新建資料庫

二、開啟IDEA新建專案，勾這三個

三、專案架構

四、各部分的實現

1、pom.xml下新增mybatis和mysql的依賴，以及對xml路徑的支援

<!--mybatis-->
        <dependency
 
>
            <groupId>org.mybatis.spring.boot</groupId>
            <artifactId>mybatis-spring-boot-starter</artifactId>
            <version>1.1.1</version>
        </dependency>
        <!--mysql-->
        <dependency>
            <groupId>
 
mysql</groupId>
            <artifactId>mysql-connector-java</artifactId>
            <version>5.1.21</version>
        </dependency>

<build>
        <plugins>
            <plugin>
                <groupId>org.springframework.boot</groupId
 
>
                <artifactId>spring-boot-maven-plugin</artifactId>
            </plugin>
        </plugins>

        <resources>
            <resource>
                <directory>src/main/java</directory>
                <includes>
                    <include>**/*.xml</include>
                </includes>
            </resource>
        </resources>
    </build>

2、application.properties檔案下新增資料庫的資訊

spring.datasource.url=jdbc:mysql://localhost:3306/mybatis
spring.datasource.username=root
spring.datasource.password=root
spring.datasource.driver-class-name=com.mysql.jdbc.Driver
mybatis.mapperLocation=classpath*:com/**/*Mapper.xml

3、持久層mapper包下

建立UserMapper介面

package com.mapper;

import com.model.User;
import org.apache.ibatis.annotations.Mapper;

/**
 * Created by Administrator on 2016/12/9.
 */
@Mapper
public interface UserMapper {
    User selectById(String id);
    User selectByUsername(String username);
}

同包下建立UserMapper.xml

<?xml version="1.0" encoding="UTF-8" ?>
<!DOCTYPE mapper PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN" "http://mybatis.org/dtd/mybatis-3-mapper.dtd" >
<mapper namespace="com.mapper.UserMapper" >
  <resultMap id="BaseResultMap" type="com.model.User" >
    <id column="id" property="id" jdbcType="VARCHAR" />
    <result column="username" property="username" jdbcType="VARCHAR" />
    <result column="password" property="password" jdbcType="VARCHAR" />
    <result column="role" property="role" jdbcType="VARCHAR" />
  </resultMap>

  <select id="selectById" resultMap="BaseResultMap" >
    select id, username,password,role
    from user
    where id = #{id, jdbcType=VARCHAR}
  </select>
  <select id="selectByUsername" resultMap="BaseResultMap" >
    select id, username,password,role
    from user
    where username = #{username, jdbcType=VARCHAR}
  </select>

</mapper>

4、實體層model建立實體類User，繼承UserDetails

package com.model;

import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.authority.SimpleGrantedAuthority;
import org.springframework.security.core.userdetails.UserDetails;

import java.io.Serializable;
import java.util.Arrays;
import java.util.Collection;

/**
 * Created by Administrator on 2016/12/9.
 */
public class User implements Serializable, UserDetails  {
    private String id;
    private String username;
    private String password;
    private String role;

    public User(){}

    public User(String username, String password, String  role){

        this.setUsername(username);
        this.setPassword(password);
        this.setRole(role);

    }
    public String getId() {
        return id;
    }

    public void setId(String id) {
        this.id = id;
    }

    public String getUsername() {
        return username;
    }

    @Override
    public boolean isAccountNonExpired() {
        return true;
    }

    @Override
    public boolean isAccountNonLocked() {
        return true;
    }

    @Override
    public boolean isCredentialsNonExpired() {
        return true;
    }

    @Override
    public boolean isEnabled() {
        return true;
    }

    public void setUsername(String username) {
        this.username = username;
    }

    @Override
    public Collection<? extends GrantedAuthority> getAuthorities() {
        return Arrays.asList(new SimpleGrantedAuthority(getRole()));
    }

    public String getPassword() {
        return password;
    }

    public void setPassword(String password) {
        this.password = password;
    }

    public String getRole() {
        return role;
    }

    public void setRole(String role) {
        this.role = role;
    }
}

5、安全層security包下建立SecurityConfig類，處理登入許可權等等。

package com.security;

import com.service.UserService;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;

@Configuration
//@EnableWebSecurity: 禁用Boot的預設Security配置，配合@Configuration啟用自定義配置
// （需要擴充套件WebSecurityConfigurerAdapter）
@EnableWebSecurity
//@EnableGlobalMethodSecurity(prePostEnabled = true): 啟用Security註解，
// 例如最常用的@PreAuthorize
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired
    private UserService userService;

    @Override
    protected void configure(AuthenticationManagerBuilder auth)
            throws Exception {
        // Configure spring security's authenticationManager with custom
        // user details service
        auth.userDetailsService(this.userService);
    }

    @Override
    //configure(HttpSecurity): Request層面的配置，對應XML Configuration中的<http>元素
    //定義URL路徑應該受到保護，哪些不應該
    protected void configure(HttpSecurity http) throws Exception {
        http
                .authorizeRequests()
                // 例如以下程式碼指定了/和/index不需要任何認證就可以訪問，其他的路徑都必須通過身份驗證。
                .antMatchers("/", "/index").permitAll()
                .anyRequest().authenticated()
                .and()
                //通過formLogin()定義當需要使用者登入時候，轉到的登入頁面。
                .formLogin()
                .loginPage("/login")
                .permitAll()
                .and()
                //登出
                .logout()
                .permitAll();
        //關閉csrf 防止迴圈定向
        http.csrf().disable();
    }


}

6、業務邏輯層service建立UserService類

package com.service;

import com.mapper.UserMapper;
import com.model.User;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.core.userdetails.UsernameNotFoundException;
import org.springframework.stereotype.Service;

/**
 * Created by Administrator on 2016/12/13.
 */
@Service
public class UserService implements UserDetailsService {
    @Autowired
    private UserMapper userMapper;
    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        User user = userMapper.selectByUsername(username);

        if( user == null ){
            throw new UsernameNotFoundException(String.format("User with username=%s was not found", username));
        }

        return user;
    }
}

7、網路層（我比較喜歡叫控制層）controller下建立HelloController類
這裡對映到resources目錄下的templates的html頁面。

package com.controller;

import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.RequestMapping;

@Controller
public class HelloController {

    @RequestMapping("/")
    public String index() {
        return "index";
    }

    @RequestMapping("/hello")
    public String hello(){
        return "hello";
    }

    @RequestMapping(value = "/login")
    public String login() {
        return "login";
    }

}

8、在resources目錄下的templates建立3個html（預設頁，登入頁跟登入後才能進入的頁面）

hello.xml

<!DOCTYPE html>
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:th="http://www.thymeleaf.org"
      xmlns:sec="http://www.thymeleaf.org/thymeleaf-extras-springsecurity3">
<head>
    <title>Hello World!</title>
</head>
<body>
<h1 th:inline="text">Hello [[${#httpServletRequest.remoteUser}]]!</h1>
<form th:action="@{/logout}" method="post">
    <input type="submit" value="登出"/>
</form>
</body>
</html>

index.html

<!DOCTYPE html>
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:th="http://www.thymeleaf.org"
      xmlns:sec="http://www.thymeleaf.org/thymeleaf-extras-springsecurity3">
<head>
    <title>Hello World!</title>
</head>
<body>
<h1 th:inline="text">Hello [[${#httpServletRequest.remoteUser}]]!</h1>
<form th:action="@{/logout}" method="post">
    <input type="submit" value="登出"/>
</form>
</body>
</html>

login.html

<!DOCTYPE html>
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:th="http://www.thymeleaf.org"
      xmlns:sec="http://www.thymeleaf.org/thymeleaf-extras-springsecurity3">
<head>
    <title>Hello World!</title>
</head>
<body>
<h1 th:inline="text">Hello [[${#httpServletRequest.remoteUser}]]!</h1>
<form th:action="@{/logout}" method="post">
    <input type="submit" value="登出"/>
</form>
</body>
</html>

五、做完以上，就能實現最基礎的web安全控制了，當然你還可以加url的許可權控制，這些網上可搜到很多資料而且不會亂。我這裡展示一下。

1、資料庫中加入測試資料

這裡要注意的是role必須為ROLE_xx形式，不然security識別不出來。

2、在controller類中加入以下控制方法

@RequestMapping(value = "/helloadmin")
    //對應資料庫中role為“ROLE_admin”
    @PreAuthorize("hasAnyRole('admin')")
    public String helloAdmin(){
        return "helloadmin";
    }

    @RequestMapping(value = "/hellouser")
    //對應資料庫中role為“ROLE_admin”與“ROLE_user”
    @PreAuthorize("hasAnyRole('admin', 'user')")
    public String helloUser(){
        return "hellouser";
    }

3、然後你自己新增倆個測試html（hellouser.html與helloadmin.html），發現以使用者名稱為user登入是進不去helloadmin的。