Spring Security使用单点登录的权限功能

import javax.servlet.*;

import javax.servlet.annotation.WebFilter;

import javax.servlet.http.HttpServletRequest;

import java.io.IOException;

import java.util.HashMap;

import java.util.List;

import java.util.Map;

import java.util.stream.Collectors;

@WebFilter ( urlPatterns = "/*" , filterName = "reqResFilter" )

public class ReqResFilter implements Filter{

     @Autowired

     private SSOUtils ssoUtils;

     @Autowired

     private UserManager userManager;

     @Autowired

     private RoleManager roleManager;

     @Override

     public void init( FilterConfig filterConfig ) throws ServletException{

     }

     @Override

     public void doFilter( ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain )

             throws IOException, ServletException{

         setAuthentication(servletRequest);

         filterChain.doFilter( servletRequest, servletResponse );

         clearAuthentication();

     }

     @Override

     public void destroy(){

     }

     private void setAuthentication( ServletRequest request ){

         Map<String, String> data;

         try {

             data = ssoUtils.getLoginData( ( HttpServletRequest )request );

         }

         catch ( Exception e ){

             data = new HashMap<>();

             data.put( "name" , "visitor" );

         }

         String username = data.get( "name" );

         if ( username != null ){

             userManager.findAndInsert( username );

         }

         List<Role> userRole = userManager.findUserRole( username );

         List<Long> roleIds = userRole.stream().map( Role::getId ).collect( Collectors.toList() );

         List<Permission> rolePermission = roleManager.findRolePermission( roleIds );

         List<SimpleGrantedAuthority> authorities = rolePermission.stream().map( one -> new SimpleGrantedAuthority( one.getName() ) ).collect(

                 Collectors.toList() );

         UsernamePasswordAuthenticationToken authenticationToken = new UsernamePasswordAuthenticationToken( username, "" , authorities );

         SecurityContextHolder.getContext().setAuthentication( authenticationToken );

     }

     private void clearAuthentication(){

         SecurityContextHolder.clearContext();

     }

}

16:04:07.429 [http-nio-8081-exec-9] DEBUG org.springframework.security.access.intercept.aopalliance.MethodSecurityInterceptor - Previously Authenticated: org.springframework.security.authentication.UsernamePasswordAuthenticationToken@cc4c6ea0: Principal: visitor; Credentials: [PROTECTED]; Authenticated: true; Details: null; Granted Authorities: CHANGE_USER_ROLE, CHANGE_ROLE_PERMISSION, ROLE_ADD

...

org.springframework.security.access.AccessDeniedException: 不允许访问

private void loginInSpringSecurity( String username, String password ){

     UsernamePasswordAuthenticationToken loginToken = new UsernamePasswordAuthenticationToken( username, password );

     Authentication authenticatedUser = authenticationManager.authenticate( loginToken );

     SecurityContextHolder.getContext().setAuthentication( authenticatedUser );

}

import org.slf4j.Logger;

import org.slf4j.LoggerFactory;

import org.springframework.beans.factory.annotation.Autowired;

import org.springframework.security.core.GrantedAuthority;

import org.springframework.security.core.authority.SimpleGrantedAuthority;

import org.springframework.security.core.userdetails.UserDetails;

import org.springframework.security.core.userdetails.UserDetailsService;

import org.springframework.security.core.userdetails.UsernameNotFoundException;

import org.springframework.stereotype.Service;

import java.util.List;

import java.util.stream.Collectors;

@Service

public class UserDetailsServiceImpl implements UserDetailsService{

     private static final Logger logger = LoggerFactory.getLogger( UserDetailsServiceImpl. class );

     @Autowired

     private UserManager userManager;

     @Autowired

     private RoleManager roleManager;

     @Override

     public UserDetails loadUserByUsername( String username ) throws UsernameNotFoundException{

         User user = userManager.findByName( username );

         if ( user == null ){

             logger.info( "登录用户[{}]没注册!" , username );

             throw new UsernameNotFoundException( "登录用户[" + username + "]没注册!" );

         }

         return new org.springframework.security.core.userdetails.User( user.getUsername(), "" , getAuthority( username ) );

     }

     private List<? extends GrantedAuthority> getAuthority( String username ){

         List<Role> userRole = userManager.findUserRole( username );

         List<Long> roleIds = userRole.stream().map( Role::getId ).collect( Collectors.toList() );

         List<Permission> rolePermission = roleManager.findRolePermission( roleIds );

         return rolePermission.stream().map( one -> new SimpleGrantedAuthority( one.getName() ) ).collect( Collectors.toList() );

     }

}

@Override

@Bean

public AuthenticationManager authenticationManagerBean() throws Exception{

     DaoAuthenticationProvider daoAuthenticationProvider = new DaoAuthenticationProvider();

     daoAuthenticationProvider.setUserDetailsService( userDetailsService );

     daoAuthenticationProvider.setPasswordEncoder( NoOpPasswordEncoder.getInstance() );

     return new ProviderManager( daoAuthenticationProvider );

}

import org.springframework.beans.factory.annotation.Autowired;

import org.springframework.context.annotation.Bean;

import org.springframework.context.annotation.Configuration;

import org.springframework.security.authentication.AuthenticationManager;

import org.springframework.security.authentication.ProviderManager;

import org.springframework.security.authentication.dao.DaoAuthenticationProvider;

import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;

import org.springframework.security.config.annotation.web.builders.HttpSecurity;

import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;

import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;

import org.springframework.security.core.userdetails.UserDetailsService;

import org.springframework.security.crypto.password.NoOpPasswordEncoder;

import org.springframework.web.cors.CorsConfiguration;

import org.springframework.web.cors.CorsConfigurationSource;

import org.springframework.web.cors.UrlBasedCorsConfigurationSource;

import java.util.Arrays;

import java.util.Collections;

@Configuration

@EnableWebSecurity

@EnableGlobalMethodSecurity (prePostEnabled = true )

public class WebSecurityConfig extends WebSecurityConfigurerAdapter{

     @Autowired

     private UserDetailsService userDetailsService;

     @Override

     protected void configure( HttpSecurity http ) throws Exception{

         http

                 .cors()

                 .and()

                 .csrf()

                 .disable()

                 .sessionManagement()

                 .and()

                 .authorizeRequests()

                 .anyRequest()

                 .permitAll()

                 .and()

                 .exceptionHandling()

                 .accessDeniedHandler( new SimpleAccessDeniedHandler() );

     }

     @Override

     @Bean

     public AuthenticationManager authenticationManagerBean() throws Exception{

         DaoAuthenticationProvider daoAuthenticationProvider = new DaoAuthenticationProvider();

         daoAuthenticationProvider.setUserDetailsService( userDetailsService );

         daoAuthenticationProvider.setPasswordEncoder( NoOpPasswordEncoder.getInstance() );

         return new ProviderManager( daoAuthenticationProvider );

     }

     @Bean

     public CorsConfigurationSource corsConfigurationSource(){

         CorsConfiguration configuration = new CorsConfiguration();

         configuration.setAllowedOrigins( Collections.singletonList( "*" ) );

         configuration.setAllowedMethods( Arrays.asList( "GET" , "HEAD" , "POST" , "PUT" , "DELETE" , "OPTIONS" ) );

         configuration.setAllowCredentials( true );

         configuration.setAllowedHeaders( Collections.singletonList( "*" ) );

         configuration.setMaxAge( 3600L );

         UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();

         source.registerCorsConfiguration( "/**" , configuration );

         return source;

     }

}