文章/答案/技术大牛

发布

社区首页 >专栏 >SpringBoot权限管理实战：从入门到精通

SpringBoot权限管理实战：从入门到精通

编程小白狼

发布于 2025-04-20 12:00:40

22600

代码可运行

文章被收录于专栏：编程小白狼编程小白狼

运行总次数：0

代码可运行

引言

在现代Web应用开发中，权限管理是不可或缺的核心功能。SpringBoot作为Java领域最流行的框架之一，提供了强大的安全支持。本文将带你全面了解如何在SpringBoot应用中实现完善的权限管理系统。

一、权限管理基础概念

1.1 认证(Authentication) vs 授权(Authorization)

认证：验证用户身份（如用户名密码登录）
授权：验证用户是否有权限访问特定资源

1.2 常见的权限控制模型

RBAC (基于角色的访问控制)

用户 -> 角色 -> 权限

ABAC (基于属性的访问控制)

更细粒度的控制，基于用户/资源属性

ACL (访问控制列表)

直接定义用户对资源的操作权限

二、Spring Security 核心组件

2.1 主要组件

SecurityContextHolder：存储安全上下文
Authentication：包含用户凭证和权限信息
UserDetails：用户核心信息接口
UserDetailsService：加载用户特定数据
PasswordEncoder：密码加密接口

2.2 过滤器链 Spring Security基于过滤器链实现安全控制，主要过滤器包括：

UsernamePasswordAuthenticationFilter：处理表单登录
BasicAuthenticationFilter：处理HTTP Basic认证
FilterSecurityInterceptor：进行权限验证

三、实战：基于RBAC的权限系统实现

3.1 项目初始化

java @SpringBootApplication public class AuthApplication { public static void main(String args) { SpringApplication.run(AuthApplication.class, args); } }

3.2 数据库设计

sql CREATE TABLE sys_user ( id BIGINT PRIMARY KEY AUTO_INCREMENT, username VARCHAR(50) UNIQUE NOT NULL, password VARCHAR(100) NOT NULL, enabled BOOLEAN DEFAULT TRUE );

CREATE TABLE sys_role ( id BIGINT PRIMARY KEY AUTO_INCREMENT, name VARCHAR(50) UNIQUE NOT NULL );

CREATE TABLE sys_user_role ( user_id BIGINT NOT NULL, role_id BIGINT NOT NULL, PRIMARY KEY (user_id, role_id) );

CREATE TABLE sys_permission ( id BIGINT PRIMARY KEY AUTO_INCREMENT, name VARCHAR(50) NOT NULL, url VARCHAR(255) NOT NULL, method VARCHAR(10) NOT NULL );

CREATE TABLE sys_role_permission ( role_id BIGINT NOT NULL, permission_id BIGINT NOT NULL, PRIMARY KEY (role_id, permission_id) );

3.3 核心代码实现

自定义UserDetailsService

java @Service public class CustomUserDetailsService implements UserDetailsService {

@Autowired
private UserRepository userRepository;

@Override
public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
    SysUser user = userRepository.findByUsername(username)
            .orElseThrow(() -> new UsernameNotFoundException("用户不存在"));
    
    return new org.springframework.security.core.userdetails.User(
            user.getUsername(),
            user.getPassword(),
            getAuthorities(user.getId())
    );
}

private Collection<? extends GrantedAuthority> getAuthorities(Long userId) {
    // 查询用户角色和权限
    List<SysRole> roles = roleRepository.findByUserId(userId);
    List<SysPermission> permissions = permissionRepository.findByUserId(userId);
    
    Set<GrantedAuthority> authorities = new HashSet<>();
    
    // 添加角色
    roles.forEach(role -> 
        authorities.add(new SimpleGrantedAuthority("ROLE_" + role.getName())));
    
    // 添加权限
    permissions.forEach(permission -> 
        authorities.add(new SimpleGrantedAuthority(permission.getName())));
    
    return authorities;
}

}

安全配置类

java @Configuration @EnableWebSecurity @EnableGlobalMethodSecurity(prePostEnabled = true) public class SecurityConfig extends WebSecurityConfigurerAdapter {

@Autowired
private CustomUserDetailsService userDetailsService;

@Bean
public PasswordEncoder passwordEncoder() {
    return new BCryptPasswordEncoder();
}

@Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
    auth.userDetailsService(userDetailsService)
        .passwordEncoder(passwordEncoder());
}

@Override
protected void configure(HttpSecurity http) throws Exception {
    http
        .authorizeRequests()
            .antMatchers("/api/public/").permitAll()
            .antMatchers("/api/admin/").hasRole("ADMIN")
            .anyRequest().authenticated()
        .and()
        .formLogin()
            .loginPage("/login")
            .permitAll()
        .and()
        .logout()
            .permitAll()
        .and()
        .csrf().disable();
}

}

权限注解使用

java @RestController @RequestMapping("/api/users") public class UserController {

@PreAuthorize("hasRole('ADMIN') or hasAuthority('USER_MANAGE')")
@GetMapping
public List<User> getAllUsers() {
    // 获取所有用户
}

@PreAuthorize("id == authentication.principal.id or hasRole('ADMIN')")
@GetMapping("/{id}")
public User getUser(@PathVariable Long id) {
    // 获取特定用户
}

}

四、进阶功能实现

4.1 动态权限控制

java @Service public class DynamicPermissionService implements FilterInvocationSecurityMetadataSource {

@Autowired
private PermissionRepository permissionRepository;

@Override
public Collection<ConfigAttribute> getAttributes(Object object) throws IllegalArgumentException {
    String url = ((FilterInvocation) object).getRequestUrl();
    String method = ((FilterInvocation) object).getHttpRequest().getMethod();
    
    // 查询数据库获取该URL+Method需要的权限
    List<SysPermission> permissions = permissionRepository.findByUrlAndMethod(url, method);
    
    if (permissions.isEmpty()) {
        return SecurityConfig.createList("permitAll");
    }
    
    String attributes = permissions.stream()
            .map(SysPermission::getName)
            .toArray(String::new);
    
    return SecurityConfig.createList(attributes);
}

// 其他必要方法实现...

}

4.2 JWT集成

java @Component public class JwtTokenFilter extends OncePerRequestFilter {

@Autowired
private JwtTokenUtil jwtTokenUtil;

@Autowired
private CustomUserDetailsService userDetailsService;

@Override
protected void doFilterInternal(HttpServletRequest request, 
                                HttpServletResponse response, 
                                FilterChain chain) throws ServletException, IOException {
    
    String token = jwtTokenUtil.getTokenFromRequest(request);
    
    if (token != null && jwtTokenUtil.validateToken(token)) {
        String username = jwtTokenUtil.getUsernameFromToken(token);
        
        UserDetails userDetails = userDetailsService.loadUserByUsername(username);
        UsernamePasswordAuthenticationToken authentication = 
            new UsernamePasswordAuthenticationToken(
                userDetails, null, userDetails.getAuthorities());
        
        authentication.setDetails(new WebAuthenticationDetailsSource().buildDetails(request));
        SecurityContextHolder.getContext().setAuthentication(authentication);
    }
    
    chain.doFilter(request, response);
}

}

4.3 权限缓存优化

java @Configuration @EnableCaching public class CacheConfig {

@Bean
public CacheManager cacheManager() {
    return new ConcurrentMapCacheManager("userDetails", "permissions");
}

}

@Service public class CachedUserDetailsService implements UserDetailsService {

@Autowired
private CustomUserDetailsService delegate;

@Cacheable(value = "userDetails", key = "username")
@Override
public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
    return delegate.loadUserByUsername(username);
}