系統比較簡單,所以只有使用者表, 角色表和域表, 沒有許可權表. 各個域的使用者是隔離的, 因為前後端分離, 控制起來格外不方便, 不過好歹是用filter實現了,bug還很多改天再說.
現在的問題就是登入 ,前端獲取登入使用者以及許可權攔截 .其中比較花時間的是使用者登入. 登入可以使用AuthenticationProvider 或者UserDetailsService實現,我傾向於使用前者,看起來DIY程度比較高,下面是程式碼:

@Component
public class CloudinsAuthProvider implements AuthenticationProvider {

@Autowired
 
CloudinsUserDao userDao;
@Autowired
CloudinsRoleDao roleDao;
@Override
public Authentication authenticate(Authentication authentication) throws AuthenticationException {
      String username = authentication.getName();
String password = (String) authentication.getCredentials();
List<CloudinsUser> users = userDao
 
.fetchByAccount(username);
      if(users.size()==0) {
         users = userDao.fetchByName(username);
}
if(users.size()==0){
throw new BadCredentialsException("Account and username not found.");
}
      CloudinsUserDetail dbUser = new CloudinsUserDetail(users.get(0));
//加密過程在這裡體現
if (!password.equals(dbUser.getPassword())) {
throw new 
 
BadCredentialsException("Wrong password.");
}

      Collection<? extends GrantedAuthority> authorities = dbUser.getAuthorities(roleDao);
      return new UsernamePasswordAuthenticationToken(dbUser, password, authorities);
}

@Override
public boolean supports(Class<?> aClass) {
return true;
}
}

其中用到的user需要實現UserDetails介面,其中的屬性資訊我寫在父類中:

public class CloudinsUserDetail extends CloudinsUser implements UserDetails {

CloudinsUserDetail(){}
public CloudinsUserDetail(CloudinsUser user){
super(user);
}

@Deprecated
   @Override
public Collection<? extends GrantedAuthority> getAuthorities() {
return new ArrayList<>();
}
public Collection<? extends GrantedAuthority> getAuthorities(YarnJooqDao<CloudinsRole,Long> roleDao) {
      List<GrantedAuthority> auth = new ArrayList<>();
CloudinsRole role = roleDao.fetchOneById(super.getRoleId());
auth.add(new SimpleGrantedAuthority(role.getName()));
      return auth;
}

@Override
public String getPassword() {
return super.getPassword();
}

@Override
public String getUsername() {
return super.getAccount();
}

@Override
public boolean isAccountNonExpired() {
return true;
}

@Override
public boolean isAccountNonLocked() {
return true;
}

@Override
public boolean isCredentialsNonExpired() {
return true;
}

@Override
public boolean isEnabled() {
return true;
}
}

之後就是核心的WebSecurityConfigurerAdapter ,在這裡選擇使用者登入時的驗證方式,以及攔截配置:

@Configuration
//@EnableWebSecurity: 禁用Boot的預設Security配置，配合@Configuration啟用自定義配置
// （需要擴充套件WebSecurityConfigurerAdapter）
@EnableWebSecurity
//@EnableGlobalMethodSecurity(prePostEnabled = true): 啟用Security註解，
// 例如最常用的@PreAuthorize
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class CloudinsSecurity extends WebSecurityConfigurerAdapter {
@Autowired
private CloudinsAuthProvider provider;
@Autowired
private CloudinsUserDetailsService userService;
//兩種驗證使用者方式選一種
// @Override
// protected void configure(AuthenticationManagerBuilder auth) throws Exception {
//    auth.userDetailsService(this.userService);
// }
@Autowired
public void configure(AuthenticationManagerBuilder auth) throws Exception {
      auth.authenticationProvider(provider);
}
@Override
protected void configure(HttpSecurity http) throws Exception {
      http.authorizeRequests()

            .antMatchers("/help","/api/v1/manage/user_register","/api/v1/manage/user","/**/*.js","/**/*.json","/**/*.html","/**/*.css","/**/*.png",
"/**/*.jpg", "/**/*.gif","/**/*.woff2","/**/*.svg","/**/*.ttf","/**/*.eot","/**/*.map")
            .permitAll()
            .anyRequest().authenticated()
            .antMatchers("/warn","/sysetting","/setting","/api/v1/manage/roles","/api/v1/receive/*")
            .hasAnyRole(Const.ROLE_SUPER_ADMIN)
            .and().formLogin().loginPage("/user_login").loginProcessingUrl("/login_process")
                .successForwardUrl("/api/v1/manage/user").permitAll()
            .and().logout().permitAll();
//    關閉csrf 防止迴圈定向
http.csrf().disable();
}


}

以上定義了使用AuthenticationProvider 進行使用者驗證,對很多靜態資源不做攔截,其他url需要登入,某些url需要特定角色才能開啟,登入頁面是/user_login,登入表單提交url是/login_process. 於是我們就完成了簡單的使用者分級許可權控制,關於具體的mvc方法,還能用註解單獨控制:

@PreAuthorize("hasAnyRole('ROLE_FIELD_ADMIN','ROLE_SUPER_ADMIN')")
@RequestMapping(value = "/users", method = RequestMethod.DELETE)
public ResponseEntity<Map<String, Object>> removeUser(@RequestParam Long id) {...}