个人中心
gpt4 book ai didi

spring security动态配置url权限的2种实现方法

转载 作者：qq735679552 更新时间：2022-09-28 22:32:09 25 4
gpt4 key购买 nike

CFSDN坚持开源创造价值，我们致力于搭建一个资源共享平台，让每一个IT人在这里找到属于你的精彩世界.

这篇CFSDN的博客文章spring security动态配置url权限的2种实现方法由作者收集整理，如果你对这篇文章有兴趣，记得点赞哟.

缘起 。

标准的rabc, 权限需要支持动态配置，spring security默认是在代码里约定好权限，真实的业务场景通常需要可以支持动态配置角色访问权限，即在运行时去配置url对应的访问角色.

基于spring security，如何实现这个需求呢?

最简单的方法就是自定义一个filter去完成权限判断，但这脱离了spring security框架，如何基于spring security优雅的实现呢?

spring security 授权回顾 。

spring security 通过filterchainproxy作为注册到web的filter，filterchainproxy里面一次包含了内置的多个过滤器，我们首先需要了解spring security内置的各种filter:

  。

alias filter class namespace element or attribute
channel_filter channelprocessingfilter http/intercept-url@requires-channel
security_context_filter securitycontextpersistencefilter http
concurrent_session_filter concurrentsessionfilter session-management/concurrency-control
headers_filter headerwriterfilter http/headers
csrf_filter csrffilter http/csrf
logout_filter logoutfilter http/logout
x509_filter x509authenticationfilter http/x509
pre_auth_filter abstractpreauthenticatedprocessingfilter subclasses n/a
cas_filter casauthenticationfilter n/a
form_login_filter usernamepasswordauthenticationfilter http/form-login
basic_auth_filter basicauthenticationfilter http/http-basic
servlet_api_support_filter securitycontextholderawarerequestfilter http/@servlet-api-provision
jaas_api_support_filter jaasapiintegrationfilter http/@jaas-api-provision
remember_me_filter remembermeauthenticationfilter http/remember-me
anonymous_filter anonymousauthenticationfilter http/anonymous
session_management_filter sessionmanagementfilter session-management
exception_translation_filter exceptiontranslationfilter http
filter_security_interceptor filtersecurityinterceptor http
switch_user_filter switchuserfilter n/a

  。

最重要的是filtersecurityinterceptor，该过滤器实现了主要的鉴权逻辑，最核心的代码在这里:

?
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
protected interceptorstatustoken beforeinvocation(object object) {
  // 获取访问url所需权限
  collection<configattribute> attributes = this .obtainsecuritymetadatasource()
  .getattributes(object);
 
 
  authentication authenticated = authenticateifrequired();
 
  // 通过accessdecisionmanager鉴权
  try {
  this .accessdecisionmanager.decide(authenticated, object, attributes);
  }
  catch (accessdeniedexception accessdeniedexception) {
  publishevent( new authorizationfailureevent(object, attributes, authenticated,
   accessdeniedexception));
 
  throw accessdeniedexception;
  }
 
  if (debug) {
  logger.debug( "authorization successful" );
  }
 
  if (publishauthorizationsuccess) {
  publishevent( new authorizedevent(object, attributes, authenticated));
  }
 
  // attempt to run as a different user
  authentication runas = this .runasmanager.buildrunas(authenticated, object,
  attributes);
 
  if (runas == null ) {
  if (debug) {
  logger.debug( "runasmanager did not change authentication object" );
  }
 
  // no further work post-invocation
  return new interceptorstatustoken(securitycontextholder.getcontext(), false ,
   attributes, object);
  }
  else {
  if (debug) {
  logger.debug( "switching to runas authentication: " + runas);
  }
 
  securitycontext origctx = securitycontextholder.getcontext();
  securitycontextholder.setcontext(securitycontextholder.createemptycontext());
  securitycontextholder.getcontext().setauthentication(runas);
 
  // need to revert to token.authenticated post-invocation
  return new interceptorstatustoken(origctx, true , attributes, object);
  }
  }

从上面可以看出，要实现动态鉴权，可以从两方面着手:

  • 自定义securitymetadatasource，实现从数据库加载configattribute
  • 另外就是可以自定义accessdecisionmanager，官方的unanimousbased其实足够使用，并且他是基于accessdecisionvoter来实现权限认证的，因此我们只需要自定义一个accessdecisionvoter就可以了

下面来看分别如何实现.

自定义accessdecisionmanager 。

官方的三个accessdecisionmanager都是基于accessdecisionvoter来实现权限认证的，因此我们只需要自定义一个accessdecisionvoter就可以了.

自定义主要是实现accessdecisionvoter接口，我们可以仿照官方的rolevoter实现一个:

?
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
public class rolebasedvoter implements accessdecisionvoter<object> {
  @override
  public boolean supports(configattribute attribute) {
  return true ;
  }
 
  @override
  public int vote(authentication authentication, object object, collection<configattribute> attributes) {
  if (authentication == null ) {
  return access_denied;
  }
  int result = access_abstain;
  collection<? extends grantedauthority> authorities = extractauthorities(authentication);
  for (configattribute attribute : attributes) {
  if (attribute.getattribute()== null ){
  continue ;
  }
  if ( this .supports(attribute)) {
  result = access_denied;
 
  // attempt to find a matching granted authority
  for (grantedauthority authority : authorities) {
   if (attribute.getattribute().equals(authority.getauthority())) {
   return access_granted;
   }
  }
  }
  }
  return result;
  }
 
  collection<? extends grantedauthority> extractauthorities(
  authentication authentication) {
  return authentication.getauthorities();
  }
 
  @override
  public boolean supports( class clazz) {
  return true ;
  }
}

如何加入动态权限呢?

vote(authentication authentication, object object, collection<configattribute> attributes)里的object object的类型是filterinvocation，可以通过getrequesturl获取当前请求的url

?
1
2
filterinvocation fi = (filterinvocation) object;
string url = fi.getrequesturl();

因此这里扩展空间就大了，可以从db动态加载，然后判断url的configattribute就可以了.

如何使用这个rolebasedvoter呢？在configure里使用accessdecisionmanager方法自定义，我们还是使用官方的unanimousbased，然后将自定义的rolebasedvoter加入即可.

?
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
@enablewebsecurity
@enableglobalmethodsecurity (prepostenabled = true , securedenabled = true )
public class securityconfiguration extends websecurityconfigureradapter {
  @override
  protected void configure(httpsecurity http) throws exception {
  http
  .addfilterbefore(corsfilter, usernamepasswordauthenticationfilter. class )
  .exceptionhandling()
  .authenticationentrypoint(problemsupport)
  .accessdeniedhandler(problemsupport)
  .and()
  .csrf()
  .disable()
  .headers()
  .frameoptions()
  .disable()
  .and()
  .sessionmanagement()
  .sessioncreationpolicy(sessioncreationpolicy.stateless)
  .and()
  .authorizerequests()
  // 自定义accessdecisionmanager
  .accessdecisionmanager(accessdecisionmanager())
  .and()
  .apply(securityconfigureradapter());
 
  }
 
  @bean
  public accessdecisionmanager accessdecisionmanager() {
  list<accessdecisionvoter<? extends object>> decisionvoters
  = arrays.aslist(
  new webexpressionvoter(),
  // new rolevoter(),
  new rolebasedvoter(),
  new authenticatedvoter());
  return new unanimousbased(decisionvoters);
  }

自定义securitymetadatasource 。

自定义filterinvocationsecuritymetadatasource只要实现接口即可，在接口里从db动态加载规则.

为了复用代码里的定义，我们可以将代码里生成的securitymetadatasource带上，在构造函数里传入默认的filterinvocationsecuritymetadatasource.

?
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
public class appfilterinvocationsecuritymetadatasource implements org.springframework.security.web.access.intercept.filterinvocationsecuritymetadatasource {
  private filterinvocationsecuritymetadatasource supermetadatasource;
  @override
  public collection<configattribute> getallconfigattributes() {
  return null ;
  }
 
  public appfilterinvocationsecuritymetadatasource(filterinvocationsecuritymetadatasource expressionbasedfilterinvocationsecuritymetadatasource){
   this .supermetadatasource = expressionbasedfilterinvocationsecuritymetadatasource;
   // todo 从数据库加载权限配置
  }
 
  private final antpathmatcher antpathmatcher = new antpathmatcher();
 
  // 这里的需要从db加载
  private final map<string,string> urlrolemap = new hashmap<string,string>(){{
  put( "/open/**" , "role_anonymous" );
  put( "/health" , "role_anonymous" );
  put( "/restart" , "role_admin" );
  put( "/demo" , "role_user" );
  }};
 
  @override
  public collection<configattribute> getattributes(object object) throws illegalargumentexception {
  filterinvocation fi = (filterinvocation) object;
  string url = fi.getrequesturl();
  for (map.entry<string,string> entry:urlrolemap.entryset()){
   if (antpathmatcher.match(entry.getkey(),url)){
   return securityconfig.createlist(entry.getvalue());
   }
  }
  // 返回代码定义的默认配置
  return supermetadatasource.getattributes(object);
  }
 
  @override
  public boolean supports( class <?> clazz) {
  return filterinvocation. class .isassignablefrom(clazz);
  }
}

怎么使用？和accessdecisionmanager不一样，expressionurlauthorizationconfigurer 并没有提供set方法设置filtersecurityinterceptor的filterinvocationsecuritymetadatasource，how to do？

发现一个扩展方法withobjectpostprocessor，通过该方法自定义一个处理filtersecurityinterceptor类型的objectpostprocessor就可以修改filtersecurityinterceptor.

?
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
@enablewebsecurity
@enableglobalmethodsecurity (prepostenabled = true , securedenabled = true )
public class securityconfiguration extends websecurityconfigureradapter {
  @override
  protected void configure(httpsecurity http) throws exception {
  http
   .addfilterbefore(corsfilter, usernamepasswordauthenticationfilter. class )
   .exceptionhandling()
   .authenticationentrypoint(problemsupport)
   .accessdeniedhandler(problemsupport)
  .and()
   .csrf()
   .disable()
   .headers()
   .frameoptions()
   .disable()
  .and()
   .sessionmanagement()
   .sessioncreationpolicy(sessioncreationpolicy.stateless)
  .and()
   .authorizerequests()
   // 自定义filterinvocationsecuritymetadatasource
   .withobjectpostprocessor( new objectpostprocessor<filtersecurityinterceptor>() {
   @override
   public <o extends filtersecurityinterceptor> o postprocess(
    o fsi) {
    fsi.setsecuritymetadatasource(mysecuritymetadatasource(fsi.getsecuritymetadatasource()));
    return fsi;
   }
   })
  .and()
   .apply(securityconfigureradapter());
  }
 
  @bean
  public appfilterinvocationsecuritymetadatasource mysecuritymetadatasource(filterinvocationsecuritymetadatasource filterinvocationsecuritymetadatasource) {
  appfilterinvocationsecuritymetadatasource securitymetadatasource = new appfilterinvocationsecuritymetadatasource(filterinvocationsecuritymetadatasource);
  return securitymetadatasource;
}

小结 。

本文介绍了两种基于spring security实现动态权限的方法，一是自定义accessdecisionmanager，二是自定义filterinvocationsecuritymetadatasource。实际项目里可以根据需要灵活选择.

延伸阅读

spring security 架构与源码分析 。

总结 。

以上就是这篇文章的全部内容了，希望本文的内容对大家的学习或者工作具有一定的参考学习价值，如果有疑问大家可以留言交流，谢谢大家对我的支持.

原文链接：http://www.cnblogs.com/xiaoqi/p/spring-security-rabc.html 。

最后此篇关于spring security动态配置url权限的2种实现方法的文章就讲到这里了,如果你想了解更多关于spring security动态配置url权限的2种实现方法的内容请搜索CFSDN的文章或继续浏览相关文章，希望大家以后支持我的博客！ 。

25 4 0
文章推荐： Windows 10系统怎么更新显卡驱动？Windows 10系统更新显卡驱动方法
文章推荐： 用C语言编写推箱子游戏
文章推荐： 升级到Windows 11后如何删除旧的Windows 10系统文件，回收硬盘空间
文章推荐： Spring Boot 配置和使用多线程池的实现
qq735679552
个人简介

我是一名优秀的程序员,十分优秀！

滴滴打车优惠券免费领取
滴滴打车优惠券
全站热门文章
Copyright 2021 - 2024 cfsdn All Rights Reserved 蜀ICP备2022000587号
广告合作:1813099741@qq.com 6ren.com