启用注解
代码语言：javascript复制@EnableGlobalMethodSecurity(prePostEnabled = true)正常启用开启那个注解就行，下面放下我的配置
代码语言：javascript复制package com.fedtech.sys.provider.config.config;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.data.redis.connection.RedisConnectionFactory;
import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
import org.springframework.security.oauth2.config.annotation.web.configuration.EnableResourceServer;
import org.springframework.security.oauth2.config.annotation.web.configuration.ResourceServerConfigurerAdapter;
import org.springframework.security.oauth2.config.annotation.web.configurers.ResourceServerSecurityConfigurer;
import org.springframework.security.oauth2.provider.token.TokenStore;
import org.springframework.security.oauth2.provider.token.store.redis.RedisTokenStore;
import javax.annotation.Resource;
/**
* 资源配置
*
* @author <a href = "mailto:njpkhuan@gmail.com" > huan </a >
* @date 2021/1/13
* @since 1.0.0
*/
@Configuration
@EnableResourceServer
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class ResourceServerConfig extends ResourceServerConfigurerAdapter {
@Resource
RedisConnectionFactory redisConnectionFactory;
@Resource
private TokenStore tokenStore;
@Bean
public TokenStore redisTokenStore() {
return new RedisTokenStore(redisConnectionFactory);
}
@Override
public void configure(ResourceServerSecurityConfigurer resources) {
resources.tokenStore(tokenStore);
}
}角色
代码语言：javascript复制 /**
* 查询单个用户
*
* @param query {@link UserQuery}
*
* @return com.fedtech.common.util.result.R<com.fedtech.sys.provider.view.UserView>
*
* @author <a href = "mailto:njpkhuan@gmail.com" > huan </a >
* @date 2021/2/20
* @since 1.0.0
*/
@GetMapping("select")
@PreAuthorize("hasAuthority('admin')")
public R<UserView> selectUser(UserQuery query) {
UserDto dto = userService.selectUser(query);
return R.successWithData(userMapper.dto2View(dto));
}权限
默认的是DenyAllPermissionEvaluator，所有权限都拒绝，所以要自定义
自定义处理逻辑
我是把权限放到了自定义的userDetails里面
代码语言：javascript复制package com.fedtech.common.model;
import cn.hutool.core.collection.CollUtil;
import lombok.Data;
import lombok.extern.slf4j.Slf4j;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.authority.SimpleGrantedAuthority;
import org.springframework.security.core.userdetails.UserDetails;
import java.util.ArrayList;
import java.util.Collection;
import java.util.List;
import java.util.StringTokenizer;
/**
* 该类返回的是安全的，能够提供给用户看到的信息，即脱敏后的信息
*
* @author <a href = "mailto:njpkhuan@gmail.com" > huan </a >
* @date 2021/1/9
* @since 1.0.0
*/
@Data
@Slf4j
public class SecurityUser implements UserDetails {
private static final long serialVersionUID = 8689435103879098852L;
/**
* 盐
*/
private String salt;
/**
* 用户token
*/
private String token;
/**
* 用户状态
*/
private String status;
/**
* 用户密码
*/
private String password;
/**
* 用户登录账号
*/
private String loginName;
private Long userId;
/**
* 用户角色
*
* @date 2021/1/10
* @since 1.0.0
*/
private List<UserRole> roleList;
/**
* 权限列表
*
* @date 2021/1/11
* @since 1.0.0
*/
private List<UserPermission> permissionList;
/**
* 客户端用户
*
* @param client 客户端
*
* @author <a href = "mailto:njpkhuan@gmail.com" > huan </a >
* @date 2021/1/13
* @since 1.0.0
*/
public SecurityUser(OauthClientDetails client) {
if (client != null) {
password = client.getClientSecret();
loginName = client.getClientId();
String authorities = client.getAuthorities();
StringTokenizer stringTokenizer = new StringTokenizer(authorities, ", ");
roleList = new ArrayList<>();
if (stringTokenizer.hasMoreTokens()) {
UserRole userRole = new UserRole();
userRole.setCode(stringTokenizer.nextToken());
roleList.add(userRole);
}
}
}
/**
* 普通用户
*
* @param user 用户
* @param roleList 角色
* @param permissionList 权限
*
* @author <a href = "mailto:njpkhuan@gmail.com" > huan </a >
* @date 2021/1/13
* @since 1.0.0
*/
public SecurityUser(User user, List<UserRole> roleList, List<UserPermission> permissionList) {
if (user != null) {
salt = user.getSalt();
token = user.getToken();
status = user.getStatus();
password = user.getPassword();
loginName = user.getLoginName();
userId = user.getId();
this.roleList = roleList;
this.permissionList = permissionList;
}
}
@Override
public Collection<? extends GrantedAuthority> getAuthorities() {
Collection<GrantedAuthority> authorities = new ArrayList<>();
if (!CollUtil.isEmpty(roleList)) {
for (UserRole role : roleList) {
SimpleGrantedAuthority authority = new SimpleGrantedAuthority(role.getCode());
authorities.add(authority);
}
}
log.debug("获取到的用户权限：{}", authorities);
return authorities;
}
@Override
public String getPassword() {
return password;
}
@Override
public String getUsername() {
return loginName;
}
@Override
public boolean isAccountNonExpired() {
return true;
}
@Override
public boolean isAccountNonLocked() {
return true;
}
@Override
public boolean isCredentialsNonExpired() {
return true;
}
@Override
public boolean isEnabled() {
return true;
}
}package com.fedtech.common.config;
import cn.hutool.core.collection.CollUtil;
import com.fedtech.common.model.SecurityUser;
import com.fedtech.common.model.UserPermission;
import lombok.extern.slf4j.Slf4j;
import org.apache.commons.lang3.StringUtils;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.access.PermissionEvaluator;
import org.springframework.security.core.Authentication;
import java.io.Serializable;
import java.util.List;
/**
* 自定义权限处理
*
* @author <a href="mailto:njpkhuan@gmail.com">huan</a>
* @version 1.0.0
* @date 2021/2/26
*/
@Slf4j
@Configuration
public class MyPermissionEvaluator implements PermissionEvaluator {
@Override
public boolean hasPermission(Authentication authentication, Object targetDomainObject, Object permission) {
SecurityUser principal = (SecurityUser) authentication.getPrincipal();
List<UserPermission> permissionList = principal.getPermissionList();
if (CollUtil.isNotEmpty(permissionList)) {
return permissionList.stream().anyMatch(x -> StringUtils.equals(x.getUrl(), (CharSequence) targetDomainObject) &&
StringUtils.equals(x.getCode(), (CharSequence) permission));
}
return false;
}
@Override
public boolean hasPermission(Authentication authentication, Serializable targetId, String targetType, Object permission) {
return false;
}
}使用
代码语言：javascript复制 /**
* 查询单个用户
*
* @param query {@link UserQuery}
*
* @return com.fedtech.common.util.result.R<com.fedtech.sys.provider.view.UserView>
*
* @author <a href = "mailto:njpkhuan@gmail.com" > huan </a >
* @date 2021/2/20
* @since 1.0.0
*/
@GetMapping("select")
@PreAuthorize("hasPermission('/sys/user/insert','userInsert')")
public R<UserView> selectUser(UserQuery query) {
UserDto dto = userService.selectUser(query);
return R.successWithData(userMapper.dto2View(dto));
}
