Spring 結合mybatis，以及Spring Security實現使用者認證（Authentication）和授權（Authorization）功能.Spring Security是專門針對基於Spring專案的

安全框架，充分利用依賴注入和AOP來實現安全功能。Spring Boot針對Spring Security 的自動配置主要是靠SecurityAutoConfigation和SecurityProperties來

完成。頁面模板Thymeleaf為我們提供了Spring Security的標籤。

新建專案

新建Spring Boot的gradle專案，引入mysql，spring-mybatis，springboot-security，thymeleaf相關依賴。

dependencies {
   compile('org.springframework.boot:spring-boot-starter-web')
   compile('org.springframework.boot:spring-boot-starter-security')
   //檢視依賴
compile('org.springframework.boot:spring-boot-starter-thymeleaf')
   //thymeleaf的Spring Security支援依賴
compile('org.thymeleaf.extras:thymeleaf-extras-springsecurity4'
 
)
   // spring-jdbc
compile "org.springframework:spring-jdbc:4.2.3.RELEASE"
//A high-performance JDBC connection pool.
compile "com.zaxxer:HikariCP"
// mysql
compile "mysql:mysql-connector-java"
//mybatis依賴
compile "org.mybatis:mybatis:3.3.1"
compile "org.mybatis:mybatis-spring:1.2.4"
compile "org.mybatis.generator:mybatis-generator-core:1.3.2"
 
//分頁外掛
compile "com.github.pagehelper:pagehelper:4.1.0"
}

application.yml檔案

server:
  port: 8081

spring:
  datasource:
    driverClassName: com.mysql.jdbc.Driver
    url: jdbc:mysql://localhost:3306/demo?useUnicode=true&characterEncoding=UTF-8
    username: root
    password: 123456
  thymeleaf:
    cache: false

mybatis:
  mapperLocations: classpath:mapper/**.xml
  config: mybatis-config.xml
  rows_per_transaction: 500

logging:
  level:
    org:
      springframework:
        security: debug

配置資料庫

首先建立一個Config配置檔案，用來配置HikariCP連線池，專案暫不使用讀寫分離，如果需要分別建立read和write的DataSource bean.

@Configuration
public class MyBatisDataSourceConfig implements EnvironmentAware {

   private RelaxedPropertyResolver propertyResolver;
   private static Logger log = LoggerFactory.getLogger(MyBatisDataSourceConfig.class);
@Override
public void setEnvironment(Environment env) {
      this.propertyResolver = new RelaxedPropertyResolver(env, "spring.dataSource.");
}

   @Bean(name = "dataSource")
   @Primary
public DataSource dataSource() {
      log.debug("Configruing Write DataSource");
HikariConfig datasource = new HikariConfig();
datasource.setDriverClassName(propertyResolver.getProperty("driverClassName"));
datasource.setJdbcUrl(propertyResolver.getProperty("url"));
datasource.setUsername(propertyResolver.getProperty("username"));
datasource.setPassword(propertyResolver.getProperty("password"));
datasource.setPoolName("dataSourcePool");
datasource.setAutoCommit(false);
      return new HikariDataSource(datasource);
}
}

然後建立了一個SqlSessionFactory，為了支援註解事務，增加了@EnableTransactionManagement,並且反回了一個PlatformTransactionManagerBean。

@Configuration
@AutoConfigureAfter({MyBatisDataSourceConfig.class})
@EnableTransactionManagement
public class MyBatisSessionFactoryConfig implements EnvironmentAware,TransactionManagementConfigurer {
   
   private static Logger logger = LoggerFactory.getLogger(MyBatisSessionFactoryConfig.class);
   private RelaxedPropertyResolver propertyResolver;
@Resource(name = "dataSource")
   private DataSource dataSource;
@Override
public void setEnvironment(Environment environment) {
      this.propertyResolver = new RelaxedPropertyResolver(environment,"mybatis.");
}

   @Bean(name="sqlSessionFactory")
   @Primary
public SqlSessionFactory sqlSessionFactory() {
      try {
         SqlSessionFactoryBean sqlSessionFactory = new SqlSessionFactoryBean();
sqlSessionFactory.setDataSource(dataSource);
sqlSessionFactory.setConfigLocation(new DefaultResourceLoader().getResource(propertyResolver.getProperty("config")));
sqlSessionFactory.setMapperLocations(new PathMatchingResourcePatternResolver().getResources(propertyResolver.getProperty("mapperLocations")));
         return sqlSessionFactory.getObject();
} catch (Exception e) {
         logger.error("Could not confiure mybatis session factory",e);
         return null;
}
   }

   @Bean
   @Override
public PlatformTransactionManager annotationDrivenTransactionManager() {
      logger.info("資料庫事務開啟~~~~~~~~~~~~~~~~~~~~~~~~~~");
      return new DataSourceTransactionManager(dataSource);
}
}

另外，為了掃描MyBatis的Mapper介面，我們就需要配置MapperScannerConfigurer這個類，這個配置我們需要單獨放到一個類中。

@Configuration
//TODO 注意，由於MapperScannerConfigurer執行的比較早，所以必須有下面的註解
@AutoConfigureAfter({MyBatisSessionFactoryConfig.class})
public class MyBatisMapperScannerConfig {
   private static Logger logger = LoggerFactory.getLogger(MyBatisMapperScannerConfig.class);
@Bean(name="mapperScannerConfigurer")
    public MapperScannerConfigurer mapperScannerConfigurer() {
       logger.info("Database Scanner File ~~~~~~~~~~~~~~~~~~~");
MapperScannerConfigurer mapperScannerConfigurer = new MapperScannerConfigurer();
mapperScannerConfigurer.setSqlSessionFactoryBeanName("sqlSessionFactory");
mapperScannerConfigurer.setBasePackage(BaseMapper.class.getPackage().getName());
mapperScannerConfigurer.setMarkerInterface(BaseMapper.class);
        return mapperScannerConfigurer;
}
}

建立mapper介面，所有mapper介面都繼承該介面。

package com.xjj.mapper;
public interface BaseMapper {
}

定義使用者和角色實體類

使用者類：實現了UserDetails介面，我們的使用者實體即為Srping Security所使用的使用者。重寫getAuthorities方法，將使用者的角色作為許可權。

public class SysUser implements UserDetails {

    private static final long serialVersionUID = -7071429258899138676L;
    private Long id;
    private String username;
    private String password;
    private List<SysRole> roles;
@Override
public Collection<? extends GrantedAuthority> getAuthorities() {
        List<GrantedAuthority> auths = new ArrayList<>();
List<SysRole> roles = this.getRoles();
        for (SysRole role:roles) {
            auths.add(new SimpleGrantedAuthority(role.getName()));
}
        return auths;
}

    @Override
public String getPassword() {
        return password;
}

    @Override
public String getUsername() {
        return username;
}

    @Override
public boolean isAccountNonExpired() {
        return true;
}

    @Override
public boolean isAccountNonLocked() {
        return true;
}

    @Override
public boolean isCredentialsNonExpired() {
        return true;
}

    @Override
public boolean isEnabled() {
        return true;
} //省略getset方法

角色：

public class SysRole {
    private Long id;
    private String name;
}//省略getset方法

定義好資料結構，建立表，並進行初始化。

使用者表：sys_user

角色表：sys_role

使用者角色關係表：sys_user_roles（使用者與角色是多對多的關係）

初始化資料

insert  into `sys_role`(`id`,`name`) values (1,'ROLE_ADMIN'),(2,'ROLE_USER');

insert  into `sys_user`(`id`,`password`,`username`) values (1,'xjj','xjj'),(2,'xianjj','xianjj');

insert  into `sys_user_roles`(`sys_user_id`,`roles_id`) values (1,1),(2,2),(1,2);

具體sql語句見專案resource下的sql.sql

定義傳值實體

根據角色不同，頁面顯示不同內容。

public class Msg {

    private String title;
    private String content;
    private  String etraInfo;
    public Msg(String title, String content, String etraInfo) {
        super();
        this.content = content;
        this.etraInfo = etraInfo;
        this.title = title;
}
    //省略get set 方法
}

資料查詢

自定義介面需要實現UserDetailsService介面，重寫loadUserByUsername方法，查詢使用者資訊。我們當前的使用者實現了UserDetails介面，可直接返回給Spring Security使用。

public class CustomUserSevice implements UserDetailsService {

    @Autowired
SysUserMapper sysUserMapper;
@Override
public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        SysUser user = sysUserMapper.findByUsername(username);
        if (user == null){
            throw new UsernameNotFoundException("使用者名稱不存在");
}
        return user;
}
}

public interface SysUserMapper extends BaseMapper {
    SysUser findByUsername(String username);
List<SysRole> findRolesByUsername(String username);
}

<?xml version="1.0" encoding="UTF-8" ?>
<!DOCTYPE mapper
        PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
        "http://mybatis.org/dtd/mybatis-3-mapper.dtd">
<mapper namespace="com.xjj.mapper.SysUserMapper">
    <resultMap id="sysUserMap" type="com.xjj.domain.SysUser" >
        <id column="id" property="id" jdbcType="INTEGER" />
        <result column="id"          property="id"        jdbcType="VARCHAR" />
        <result column="username"        property="username"      jdbcType="VARCHAR" />
        <result column="password"        property="password"      jdbcType="VARCHAR" />
        <collection property="roles"     column="username"   select="findRolesByUsername" />
    </resultMap>
    <select id="findByUsername" resultMap="sysUserMap">
SELECT * from sys_user WHERE username = #{0}
    </select>
    <select id="findRolesByUsername" resultType="com.xjj.domain.SysRole">
SELECT
          sysrole.id,
          sysrole.name
        FROM
          sys_user_roles roles
          INNER JOIN sys_role sysrole
            ON roles.roles_id = sysrole.id
          INNER JOIN sys_user sysuser
            ON sysuser.id = roles.sys_user_id
        WHERE sysuser.username = #{0}
    </select>
</mapper>

配置

Spring MVC配置，註冊訪問/login轉向login.html頁面

@Configuration
public class WebMvcConfig extends WebMvcConfigurerAdapter {

    @Override
public void addViewControllers(ViewControllerRegistry registry) {
        registry.addViewController("/login").setViewName("login");
}
}

Spring Security配置

擴充套件Spring Security配置，需要繼承WebSecurityConfigurerAdapter類，新增自定義的UserDetailsService認證，重寫configure方法。

前臺頁面

登入頁面login.html

<!DOCTYPE html>
<html xmlns:th="http://www.thymeleaf.org">
<head>
    <meta content="text/html;charset=UTF-8"/>
    <title>登入頁面</title>
    <link rel="stylesheet" th:href="@{css/bootstrap.min.css}" />
    <style>
body{
            padding-top: 50px;
}
        .starter-template{
            padding: 40px 15px;
text-align: center;
}
    </style>
</head>
<body>
    <nav class="narbar navbar-inverse navbar-fixed-top">
        <div class="container">
            <div class="navbar-header">
                <a class="navbar-brand" href="#">Spring Security 演示</a>
            </div>
            <div id="navbar" class="collapse navbar-collapse">
                <ul class="nav navbar-nav">
                    <li><a th:href="@{/}">首頁</a></li>
                </ul>
            </div>
        </div>
    </nav>
    <div class="container">
        <div class="starter-template">
            <p th:if="${param.logout}" class="bg-warning">已成功登出</p>
            <p th:if="${param.error}" class="bg-danger">有錯誤請重試</p>
            <h2>使用賬號密碼登入</h2>
            <form name="form" th:action="@{/login}" action="/login" method="post">
                <div class="form-group">
                    <label for="username">賬號</label>
                    <input type="text" class="form-control" name="username" value="" placeholder="賬號"/>
                </div>
                <div class="form-group">
                    <label for="password">密碼</label>
                    <input type="password" class="form-control" name="password" placeholder="密碼"/>
                </div>
                <input type="submit" id="login" value="Login" class="btn btn-primary"/>
            </form>
        </div>
    </div>
</body>
</html>

首頁

登入成功後跳轉到首頁

<!DOCTYPE html>
<html xmlns:th="http://www.thymeleaf.org"
xmlns:sec="http://www.thymeleaf.org/thymeleaf-extras-springsecurity4">
<head>
    <meta content="text/html;charset=UTF-8"/>
    <title sec:authentication="name"></title>
    <link rel="stylesheet" th:href="@{css/bootstrap.min.css}" />
    <style>
body{
            padding-top: 50px;
}
        .starter-template{
            padding: 40px 15px;
text-align: center;
}
    </style>
</head>
<body>
    <nav class="narbar navbar-inverse navbar-fixed-top">
        <div class="container">
            <div class="navbar-header">
                <a class="navbar-brand" href="#">Spring Security 演示</a>
            </div>
            <div id="navbar" class="collapse navbar-collapse">
                <ul class="nav navbar-nav">
                    <li><a th:href="@{/}">首頁</a></li>
                </ul>
            </div>
        </div>
    </nav>
    <div class="container">
        <div class="starter-template">
            <h1 th:text="${msg.title}"></h1>
            <p class="bg-primary" th:text="${msg.content}"></p>
            <div sec:authorize="hasRole('ROLE_ADMIN')" >
                <p class="bg-info" th:text="${msg.etraInfo}"></p>
            </div>
            <div sec:authorize="hasRole('ROLE_USER')" >
                <p class="bg-info">無更多資訊顯示</p>
            </div>
            <form th:action="@{/logout}" method="post">
                <input type="submit" class="btn btn-primary" value="登出"/>
            </form>
        </div>
    </div>
</body>
</html>

控制器

為首頁準備顯示資料

@Controller
public class HomeController {

    @RequestMapping("/")
    public String index(Model model){
        Msg msg = new Msg("測試標題", "測試內容", "額外資訊，只對管理員顯示");
model.addAttribute(msg);
        return "index";
}
}

執行結果

http://127.0.0.1:8081/

分別用管理員和普通使用者登入，觀察頁面回顯結果；

登入成功後點擊登出，返回到登入頁面；

使用者名稱或密碼不正確時，校驗失敗；