SSM整合SpringSecurity

<project xmlns="http://maven.apache.org/POM/4.0.0"
	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
	xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
	<modelVersion>4.0.0</modelVersion>
	<groupId>com.qingfeng</groupId>
	<artifactId>SpringSecurity</artifactId>
	<version>0.0.1-SNAPSHOT</version>
	<packaging>war</packaging>

	<properties>
		<spring.security.version>5.1.3.RELEASE</spring.security.version>
	</properties>

	<dependencies>


		<!--引入Servlet支持 -->
		<dependency>
			<groupId>javax.servlet</groupId>
			<artifactId>javax.servlet-api</artifactId>
			<version>3.1.0</version>
			<scope>provided</scope>
		</dependency>


		<!--引入Spring Security支持 -->
		<!-- https://mvnrepository.com/artifact/org.springframework.security/spring-security-core -->
		<dependency>
			<groupId>org.springframework.security</groupId>
			<artifactId>spring-security-core</artifactId>
			<version>${spring.security.version}</version>
		</dependency>

		<!-- https://mvnrepository.com/artifact/org.springframework.security/spring-security-web -->
		<dependency>
			<groupId>org.springframework.security</groupId>
			<artifactId>spring-security-web</artifactId>
			<version>${spring.security.version}</version>
		</dependency>

		<!-- https://mvnrepository.com/artifact/org.springframework.security/spring-security-config -->
		<dependency>
			<groupId>org.springframework.security</groupId>
			<artifactId>spring-security-config</artifactId>
			<version>${spring.security.version}</version>
		</dependency>
	</dependencies>	
	
	<build>
        <plugins>
            <plugin>
                <groupId>org.apache.tomcat.maven</groupId>
                <artifactId>tomcat7-maven-plugin</artifactId>
                <configuration>
                    <!-- 指定端口 -->
                    <port>9001</port>
                    <!-- 请求路径 -->
                    <path>/</path>
                </configuration>
            </plugin>
        </plugins>
    </build>

</project>

<?xml version="1.0" encoding="UTF-8"?>
<web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xmlns="http://java.sun.com/xml/ns/javaee"
         xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd"
         version="2.5">
    <context-param>
        <param-name>contextConfigLocation</param-name>
        <param-value>classpath:spring-security.xml</param-value>
    </context-param>
    
    <listener>
        <listener-class>
            org.springframework.web.context.ContextLoaderListener
        </listener-class>
    </listener>
    
    <filter>
        <filter-name>springSecurityFilterChain</filter-name>
        <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
    </filter>
    <filter-mapping>
        <filter-name>springSecurityFilterChain</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>
</web-app>

<?xml version="1.0" encoding="UTF-8"?>
<beans:beans
	xmlns="http://www.springframework.org/schema/security"
	xmlns:beans="http://www.springframework.org/schema/beans"
	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
	xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
						http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security.xsd">

	<!--以下页面不被拦截 -->
	<http pattern="/login.html" security="none"></http>
	<http pattern="/login_error.html" security="none"></http> 

	<!--页面拦截规则 -->
	<http>
		<!-- intercept-url:表示拦截规则 pattern：页码的匹配规则，在webapp下面的 access：资源的控制规则，需要什么的条件 -->
		<!-- 所有的资源都需要是ROLE_ADMIN的角色可以访问 -->
		<intercept-url pattern="/**"
			access="hasRole(‘ROLE_ADMIN‘)" />
		<!-- 表单登录 
				login-page：登录页面
				default-target-url：默认跳转页面
				authentication-failure-url：登录错误，跳转错误页面
		-->
		<form-login  login-page="/login.html"  default-target-url="/index.html"  authentication-failure-url="/login_error.html"/>
		<!-- 退出登录 -->
		<logout />
		<!--  关闭跨域请求伪造控制。因为静态页无法动态生成token，所以将此功能关闭。一般静态页采用图形验证码的方式实现防止跨域请求伪造的功能。-->
		<csrf  disabled="true" />
	</http>

	<!-- 认证管理器 -->
	<!-- <authentication-manager> 认证管理器 <authentication-provider> 认证的提供者，就是用来配置用户名和密码 
		<user-service> 用户的服务 <user /> 配置用户和密码 -->
	<authentication-manager>
		<authentication-provider   user-service-ref="userDetailsService">
			<!-- <user-service>
				name：用户名，password:用户密码 authorities：指定用户的角色
				<user name="admin"
					password="$2a$10$rIxa8dDL8F8Bf.TeC5rOeev96e0wTo0FIuLmtdJ6T/a8CptHlAlga"
					authorities="ROLE_ADMIN" />
			</user-service> -->

			<!-- 密码使用bcrypt加密 -->
			<password-encoder ref="bcryptEncoder" />
		</authentication-provider>
	</authentication-manager>

	<!-- bcrypt加密 -->
	<beans:bean id="bcryptEncoder"
		class="org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder"></beans:bean>

	<beans:bean id="userDetailsService"  class="com.qingfeng.service.UserDetailsServiceImpl"></beans:bean>

</beans:beans>

package com.qingfeng.service;

import java.util.ArrayList;
import java.util.List;

import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.authority.SimpleGrantedAuthority;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.core.userdetails.UsernameNotFoundException;

public class UserDetailsServiceImpl implements UserDetailsService {

	@Override
	public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
		//构建角色集合 ，项目中此处应该是根据用户名查询用户的角色列表
		List<GrantedAuthority> geAuthorities = new ArrayList<GrantedAuthority>();
		//添加角色ROLE_ADMIN
		geAuthorities.add(new SimpleGrantedAuthority("ROLE_ADMIN"));
		/**
		 * 第一参数：username
		 * 第二参数："$2a$10$rIxa8dDL8F8Bf.TeC5rOeev96e0wTo0FIuLmtdJ6T/a8CptHlAlga"是BCrypt加密的密码
		 * 第三参数：geAuthorities是它的角色
		 */
		return new User(username,"$2a$10$rIxa8dDL8F8Bf.TeC5rOeev96e0wTo0FIuLmtdJ6T/a8CptHlAlga",geAuthorities);
	}

}

<!DOCTYPE html>
<html>
<head>
<meta charset="UTF-8">
<title>登录</title>
</head>
<body>

	<form action="/login" method="post">
		<table>
			<tr>
				<td>用户名
				<td />
				<td><input name="username" />
				<td />
			<tr />
			<tr>
				<td>密码
				<td />
				<td><input type="password" name="password" />
				<td />
			<tr />
		</table>
		<button>登录</button>
	</form>

</body>
</html>

<!DOCTYPE html>
<html>
<head>
<meta charset="UTF-8">
<title>登录错误</title>
</head>
<body>
<h1 >用户名和密码错误！</h1>
</body>
</html>

<!DOCTYPE html>
<html>
<head>
<meta charset="UTF-8">
<title>欢迎来到 SpringSecurity</title>
</head>
<body>
	<h1>欢迎来到 SpringSecurity</h1>
</body>
</html>