SpringSecurityOAuth2(4)根据请求URI动态权限判断(补)

Easter79
• 阅读 768

GitHub地址

码云地址

上文地址

补充上文的根据URI获取权限判断的优化,上文的方法只能根据uri来获取单个权限,无法满足uri可以根据多个或并且的方式来访问的请求。

优化内容:先增加一级获取uri然后判断uri需要什么权限,可以多个并且的权限 等等然后 在经过权限判断器进行拦截判断

新建自定义的url权限判断MyFilterInvocationSecurityMetadataSource 实现FilterInvocationSecurityMetadataSource

/**
 * @Description 根据url获取 url需要访问的权限
 * @Author wwz
 * @Date 2019/08/01
 * @Param
 * @Return
 */
@Component
public class MyFilterInvocationSecurityMetadataSource implements FilterInvocationSecurityMetadataSource {

    private AntPathMatcher antPathMatcher = new AntPathMatcher(); // 模糊匹配 如何 auth/**   auth/auth

    @Override
    public Collection<ConfigAttribute> getAttributes(Object object) throws IllegalArgumentException {
        Set<ConfigAttribute> set = new HashSet<>();

        String requestUrl = ((FilterInvocation) object).getRequest().getMethod() + ((FilterInvocation) object).getRequest().getRequestURI();
        System.out.println("requestUrl >> " + requestUrl);

        // 这里获取对比数据可以从数据库或者内存 redis等等地方获取 目前先写死后面优化
        String url = "GET/auth/**";
        if (antPathMatcher.match(url, requestUrl)) {
            SecurityConfig securityConfig = new SecurityConfig("ROLE_ADMIN");
            set.add(securityConfig);
        }
        if (ObjectUtils.isEmpty(set)) {
            return SecurityConfig.createList("ROLE_LOGIN");
        }
        return set;
    }

    @Override
    public Collection<ConfigAttribute> getAllConfigAttributes() {
        return null;
    }

    @Override
    public boolean supports(Class<?> clazz) {
        return FilterInvocation.class.isAssignableFrom(clazz);
    }
}

修改原来MySecurityAccessDecisionManager 的decide,从获取到url 改成获取到需要什么权限。其他判断不变

    @Override
    public void decide(Authentication authentication, Object object, Collection<ConfigAttribute> configAttributes) throws AccessDeniedException, InsufficientAuthenticationException {

        System.out.println("collection>>" + configAttributes);

        for (ConfigAttribute configAttribute : configAttributes) {
            // 当前请求需要的权限
            String needRole = configAttribute.getAttribute();
            // 当前用户所具有的权限
            Collection<? extends GrantedAuthority> authorities = authentication.getAuthorities();
            System.out.println("authorities=" + authorities);
            for (GrantedAuthority grantedAuthority : authorities) {
                if (grantedAuthority.getAuthority().equals(needRole)) {
                    return;
                }
                if (grantedAuthority.getAuthority().equals("ROLE_ADMIN")) {
                    return;
                }

            }
        }
        throw new AccessDeniedException("无访问权限");
    }

把MyFilterInvocationSecurityMetadataSource 注册到MySecurityResourceServerConfig的重写方法

 public void configure(HttpSecurity http) throws Exception {
        http
                .csrf().disable()
                .exceptionHandling().authenticationEntryPoint((request, response, authException) -> response.sendError(HttpServletResponse.SC_UNAUTHORIZED))
                .and()
                .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.IF_REQUIRED) // 另外,如果不设置,那么在通过浏览器访问被保护的任何资源时,每次是不同的SessionID,并且将每次请求的历史都记录在OAuth2Authentication的details的中
                .and()
                .authorizeRequests().antMatchers("/actuator/health").permitAll().anyRequest().authenticated()  // httpSecurity 放过健康检查,其他都需要验证  设置了.anyRequest().authenticated()才回进入自定义的权限判断
                .and()
                .requestMatchers().antMatchers("/auth/**") // .requestMatchers().antMatchers(...) OAuth2设置对资源的保护如果是用 /**的话 会把上面的也拦截掉
                .and()
                .authorizeRequests()
                .withObjectPostProcessor(new ObjectPostProcessor<FilterSecurityInterceptor>() {       // 重写做权限判断
                    @Override
                    public <O extends FilterSecurityInterceptor> O postProcess(O o) {
                        o.setSecurityMetadataSource(filterInvocationSecurityMetadataSource); // 请求需要权限
                        o.setAccessDecisionManager(accessDecisionManager);      // 权限判断
                        return o;
                    }
                })
                .and()
                .httpBasic();

        http.exceptionHandling().accessDeniedHandler(accessDeniedHandler);
    }

尝试并请求打印信息:

SpringSecurityOAuth2(4)根据请求URI动态权限判断(补)

SpringSecurityOAuth2(4)根据请求URI动态权限判断(补)

点赞
收藏
评论区
推荐文章
blmius blmius
3年前
MySQL:[Err] 1292 - Incorrect datetime value: ‘0000-00-00 00:00:00‘ for column ‘CREATE_TIME‘ at row 1
文章目录问题用navicat导入数据时,报错:原因这是因为当前的MySQL不支持datetime为0的情况。解决修改sql\mode:sql\mode:SQLMode定义了MySQL应支持的SQL语法、数据校验等,这样可以更容易地在不同的环境中使用MySQL。全局s
待兔 待兔
4个月前
手写Java HashMap源码
HashMap的使用教程HashMap的使用教程HashMap的使用教程HashMap的使用教程HashMap的使用教程22
Easter79 Easter79
3年前
SpringSecurityOAuth2(9) feign 微服务间调用 token验证
GitHub地址(https://www.oschina.net/action/GoToLink?urlhttps%3A%2F%2Fgithub.com%2Fweizongwu%2FSpringCloudOAuth2SpringSecurityFrame.git"项目地址")码云地址(https://gitee.com/wujishu/
Easter79 Easter79
3年前
SpringSecurityOAuth2(5)自定义登录登出
GitHub地址(https://www.oschina.net/action/GoToLink?urlhttps%3A%2F%2Fgithub.com%2Fweizongwu%2FSpringCloudOAuth2SpringSecurityFrame.git"项目地址")码云地址(https://gitee.com/wujishu/
Easter79 Easter79
3年前
SpringSecurityOAuth2(8) swagger2 集成OAuth2
GitHub地址(https://www.oschina.net/action/GoToLink?urlhttps%3A%2F%2Fgithub.com%2Fweizongwu%2FSpringCloudOAuth2SpringSecurityFrame.git"项目地址")码云地址(https://gitee.com/wujishu/
Easter79 Easter79
3年前
SpringSecurityOAuth2(3)自定义token信息
GitHub地址(https://www.oschina.net/action/GoToLink?urlhttps%3A%2F%2Fgithub.com%2Fweizongwu%2FSpringCloudOAuth2SpringSecurityFrame.git"项目地址")码云地址(https://gitee.com/wujishu/
Stella981 Stella981
3年前
Golang注册Eureka的工具包goeureka发布
1.简介提供Go微服务客户端注册到Eureka中心。点击:github地址(https://www.oschina.net/action/GoToLink?urlhttps%3A%2F%2Fgithub.com%2FSimonWang00%2Fgoeureka),欢迎各位多多star!(已通过测试验证,用于正式生产部署)2.原理
Easter79 Easter79
3年前
SpringSecurityOAuth2(6) 登录增加验证码功能
GitHub地址(https://www.oschina.net/action/GoToLink?urlhttps%3A%2F%2Fgithub.com%2Fweizongwu%2FSpringCloudOAuth2SpringSecurityFrame.git"项目地址")码云地址(https://gitee.com/wujishu/
Easter79 Easter79
3年前
SpringSecurityOAuth2(4)根据请求URI动态权限判断
GitHub地址(https://www.oschina.net/action/GoToLink?urlhttps%3A%2F%2Fgithub.com%2Fweizongwu%2FSpringCloudOAuth2SpringSecurityFrame.git"项目地址")码云地址(https://gitee.com/wujishu/
Easter79 Easter79
3年前
SpringSecurityOAuth2(7) 账号密码登录、手机验证码登录
GitHub地址(https://www.oschina.net/action/GoToLink?urlhttps%3A%2F%2Fgithub.com%2Fweizongwu%2FSpringCloudOAuth2SpringSecurityFrame.git"项目地址")码云地址(https://gitee.com/wujishu/
Easter79
Easter79
Lv1
今生可爱与温柔,每一样都不能少。
文章
2.8k
粉丝
5
获赞
1.2k