Spring Boot整合Spring Security

<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-security</artifactId>
</dependency>

@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true) //开启方法上的认证
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Resource
    private CustomerUserDetailsService userDetailsService;
    @Resource
    private CustomerLoginSuccessHandler successHandler;
    @Resource
    private BCryptPasswordEncoder encoder;

    @Bean
    public BCryptPasswordEncoder encoder() {
        return new BCryptPasswordEncoder();
    }

    @Override
    public void configure(WebSecurity web) throws Exception {
        web.ignoring().antMatchers("/assets/**"); //不过滤静态资源
        super.configure(web);
    }

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.userDetailsService(userDetailsService) //注册自己定制的UserDetailsService
                .passwordEncoder(encoder); // 配置密码加密器
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {

        http
                .authorizeRequests() //获取请求方面的验证器
                    .antMatchers("/", "/error").permitAll()// 访问当前配置的路径可通过认证
                    //访问其他路径需要认证和角色权限
                    .anyRequest().hasAnyAuthority(AdminRole.G_ADMIN.toString(), AdminRole.S_ADMIN.toString())
                    .anyRequest().authenticated()
                    .and()
                .formLogin() //获取登录认证验证器
                    .loginPage("/login") //注册自定义的登录页面URL
                    .failureForwardUrl("/login") //登录失败后以登录时的请求转发到该链接
                    .successHandler(successHandler) //登录成功后调用该处理器
                    .permitAll() //登录请求给予通过认证
                    .and()
                .logout() //推出登录
                    .logoutSuccessUrl("/login") //退出后访问URL
                    .and()
                .csrf().disable(); //关闭csrf，默认开启

    }
}

@Component //注册为Spring组件
public class CustomerUserDetailsService implements UserDetailsService{

    @Resource
    private AdminDao adminDao;

    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        //通过dao查找当前用户名对应的用户
        Admin admin = adminDao.findAdminByUsername(username);
        if (admin == null){
            throw new UsernameNotFoundException("This username: "+username+"is not exist");
        }
        //返回一个定制的UserDetails
        //AuthorityUtils.createAuthorityList(admin.getRole())就是将我们该用户所有的权限（角色）生成一个集合
        return new CustomerUserDetails(admin, AuthorityUtils.createAuthorityList(admin.getRole()));
        
    }
}

public class CustomerUserDetails implements UserDetails {

    private Admin admin = null;
    //存放权限的集合
    private final Collection<? extends GrantedAuthority> authorities;
    private final boolean accountNonExpired;
    private final boolean accountNonLocked;
    private final boolean credentialsNonExpired;
    private final boolean enabled;

    public CustomerUserDetails(Admin admin, Collection<? extends GrantedAuthority> authorities) {
        this(admin, true, true, true,true,authorities);
    }

    public CustomerUserDetails(Admin admin, boolean enabled, boolean accountNonExpired, boolean credentialsNonExpired, boolean accountNonLocked, Collection<? extends GrantedAuthority> authorities) {
        if(admin.getUsername() != null && !"".equals(admin.getUsername()) && admin.getPassword() != null) {
            this.admin = admin;
            this.enabled = enabled;
            this.accountNonExpired = accountNonExpired;
            this.credentialsNonExpired = credentialsNonExpired;
            this.accountNonLocked = accountNonLocked;
            this.authorities = authorities;
        } else {
            throw new IllegalArgumentException("Cannot pass null or empty values to constructor");
        }
    }

    public Admin getAdmin() {
        return admin;
    }

    public void setAdmin(@NotNull Admin admin) {
        this.admin = admin;
    }

    public boolean equals(Object rhs) {
        return rhs instanceof CustomerUserDetails && this.getUsername().equals(((CustomerUserDetails) rhs).getUsername());
    }

    public int hashCode() {
        return this.getUsername().hashCode();
    }

    @Override
    public Collection<? extends GrantedAuthority> getAuthorities() {
        return this.authorities;
    }

    @Override
    public String getPassword() {
        return this.admin.getPassword();
    }

    @Override
    public String getUsername() {
        return this.admin.getUsername();
    }

    @Override
    public boolean isAccountNonExpired() {
        return this.accountNonExpired;
    }

    @Override
    public boolean isAccountNonLocked() {
        return this.accountNonLocked;
    }

    @Override
    public boolean isCredentialsNonExpired() {
        return this.credentialsNonExpired;
    }

    @Override
    public boolean isEnabled() {
        return this.enabled;
    }
}

@Component
public class CustomerLoginSuccessHandler extends SavedRequestAwareAuthenticationSuccessHandler {

    @Override
    public void onAuthenticationSuccess(HttpServletRequest request, HttpServletResponse response, Authentication authentication) throws IOException, ServletException {
        //SecurityContextHolder是Spring Security的核心组件，可获取框架爱内的一些信息
        //这里我得到登录成功后的UserDetails
        Object principal = SecurityContextHolder.getContext().getAuthentication().getPrincipal();
        if (principal instanceof UserDetails) {
            request.getSession().setAttribute("admin", ((CustomerUserDetails) principal).getAdmin());
        }
        super.onAuthenticationSuccess(request, response, authentication);
    }
}