SSM項目整合SpringSecurity

SpringSecurity和Shiro的區別：

簡單來說，Shiro使用比較簡單，但SpringSecurity的功能更加強大。Springsecurity是屬於Spring家族的，與Spring框架整合的比較貼切，充分利用了Spring框架的一些特性，IOC，AOP等。

SSM項目整合SpringSecurity框架：

１，導入springsecurity環境

在health_parent父工程的pom.xml中導入Spring Security的maven坐標

<dependency>
  <groupId>org.springframework.security</groupId>
  <artifactId>spring-security-web</artifactId>
  <version>${spring.security.version}</version>
</dependency>
<dependency>
  <groupId>org.springframework.security</groupId>
  <artifactId>spring-security-config</artifactId>
  <version>${spring.security.version}</version>
</dependency>

在health_web工程的web.xml文件中配置用於整合Spring Security框架的過濾器DelegatingFilterProxy

<!--委派過濾器，用於整合其他框架-->
<filter>
  <!--整合spring security時，此過濾器的名稱固定springSecurityFilterChain-->
  <filter-name>springSecurityFilterChain</filter-name>
  <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>
<filter-mapping>
  <filter-name>springSecurityFilterChain</filter-name>
  <url-pattern>/*</url-pattern>
</filter-mapping>

2， 實現認證和授權

在health_web工程中按照Spring Security框架要求提供SpringSecurityUserService，並且實現UserDetailsService接口。

package cn.ftf.service;  2 
import cn.ftf.pojo.Permission;  4 import cn.ftf.pojo.Role;  5 import cn.ftf.pojo.User;  6 import com.alibaba.dubbo.config.annotation.Reference;  7 import org.springframework.security.core.GrantedAuthority;  8 import org.springframework.security.core.authority.SimpleGrantedAuthority;  9 import org.springframework.security.core.userdetails.UserDetails; 10 import org.springframework.security.core.userdetails.UserDetailsService; 11 import org.springframework.security.core.userdetails.UsernameNotFoundException; 12 import org.springframework.stereotype.Component; 13 
import java.util.ArrayList; 15 import java.util.List; 16 import java.util.Set; 17 
@Component 19 public class SpringSecurityUserService implements UserDetailsService { 20     //通過dubbo通過網絡來遠程調用服務提供方
 @Reference 22     private UserService userService; 23  @Override 24     public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException { 25         User user=userService.findByUsername(username); 26         if(user==null){ 27             return null; 28  } 29         List<GrantedAuthority> list=new ArrayList<>(); 30 
        //動態為當前用戶授權
        Set<Role> roles=user.getRoles(); 33         if(!roles.isEmpty()){ 34             for(Role role:roles){ 35                 list.add(new SimpleGrantedAuthority(role.getKeyword())); 36                 Set<Permission> permissions=role.getPermissions(); 37                 if(!permissions.isEmpty()) { 38                     for (Permission permission : permissions) { 39                         list.add(new SimpleGrantedAuthority(permission.getKeyword())); 40  } 41  } 42  } 43  } 44 
        org.springframework.security.core.userdetails.User securityUser=new org.springframework.security.core.userdetails.User(username,user.getPassword(),list); 46         return securityUser; 47  } 48 }

Service層和Dao層就不再展示，具體為根據user對象獲取其權限標識。