我的 Spring Boot 项目中基于角色的授权

Question

Here is my SuccessHandler class

package com.myproject.configure;
    
import java.io.IOException;
import java.rmi.AccessException;
import java.util.ArrayList;
import java.util.Collection;
import java.util.List;

import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import org.springframework.security.core.Authentication;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.web.DefaultRedirectStrategy;
import org.springframework.security.web.authentication.AuthenticationSuccessHandler;
import org.springframework.stereotype.Component;

@Component
public class CustomLoginSuccessHandler implements AuthenticationSuccessHandler  {
    
//  @Override
//  protected void handle(HttpServletRequest request, HttpServletResponse response, Authentication authentication) throws IOException, ServletException  {
//      
//      String targetUrl = determineTargetUrl(authentication);
//      
//      System.out.println("Its a Target URL ---" + targetUrl);
//      if (response.isCommitted()) {
//          return;
//      }
//      RedirectStrategy redirectStrategy = new DefaultRedirectStrategy();
//      redirectStrategy.sendRedirect(request, response, targetUrl);
//  }
    
    protected String determineTargetUrl(Authentication authentication) {
        
        String url = "/login?error=true";

        Collection<? extends GrantedAuthority> authorities = authentication.getAuthorities();
        List<String> roles = new ArrayList<String>();
        for (GrantedAuthority a : authorities) {
            roles.add(a.getAuthority());
        }
        
        if (roles.contains("SITE_ADMIN")) {
            System.out.println(roles.toString());
            url = "/admin/home";
        }
        else if (roles.contains("SITE_USERS")) {
            url = "/users/index";
            
        }
        
        return url;
        
    }

    @Override
    public void onAuthenticationSuccess(HttpServletRequest request, HttpServletResponse response,
            Authentication authentication) throws IOException, ServletException {
        String redirectUrl = determineTargetUrl(authentication);
        
        if (redirectUrl == null) {
            throw new AccessException(redirectUrl);
        }
        new DefaultRedirectStrategy().sendRedirect(request, response, redirectUrl);
    }
}

Here I define two different Role one is "ADMIN" and another is "USER"

I have two different Entity class for my Users and another for Role. I have two different destinations for my different roles. But when I run my application and log in successfully only "USER" role can see its page but "ADMIN" role user cannot see their page. But I can see the admin print statement in my console. "It's an ADMIN!!!!!". What to do ? or where is my bug?

Here is my Entities class:

package com.myproject.entities;

import java.util.ArrayList;
import java.util.List;

import javax.persistence.CascadeType;
import javax.persistence.Column;
import javax.persistence.Entity;
import javax.persistence.GeneratedValue;
import javax.persistence.GenerationType;
import javax.persistence.Id;
import javax.persistence.JoinColumn;
import javax.persistence.ManyToOne;
import javax.persistence.OneToMany;
import javax.persistence.Table;

@Entity
@Table(name = "users")
public class Users {

    @Id
    @GeneratedValue(strategy = GenerationType.IDENTITY)
    @Column(name = "id_users")
    private int idUsers;
    private String userName;
    private String password;
    
    @ManyToOne(cascade = CascadeType.ALL)
    private UserRole userRole;

    @OneToMany(cascade = CascadeType.ALL)
    @JoinColumn(name = "id_users")
    List<Recruitment> recruitments = new ArrayList<>();
    
    public Users() {
    }

    public Users(String userName, String password, UserRole userRole, List<Recruitment> recruitments) {
        this.userName = userName;
        this.password = password;
        this.userRole = userRole;
        this.recruitments = recruitments;
    }

    public int getIdUsers() {
        return idUsers;
    }

    public String getUserName() {
        return userName;
    }

    public String getPassword() {
        return password;
    }

    public UserRole getUserRole() {
        return userRole;
    }

    public List<Recruitment> getRecruitments() {
        return recruitments;
    }

    public void setIdUsers(int idUsers) {
        this.idUsers = idUsers;
    }

    public void setUserName(String userName) {
        this.userName = userName;
    }

    public void setPassword(String password) {
        this.password = password;
    }

    public void setUserRole(UserRole userRole) {
        this.userRole = userRole;
    }

    public void setRecruitments(List<Recruitment> recruitments) {
        this.recruitments = recruitments;
    }

    @Override
    public String toString() {
        return "Users [idUsers=" + idUsers + ", userName=" + userName + ", password=" + password + ", userRole="
                + userRole + ", recruitments=" + recruitments + "]";
    }

    
    
    
}

package com.myproject.entities;

import java.util.List;

import javax.persistence.Column;
import javax.persistence.Entity;
import javax.persistence.GeneratedValue;
import javax.persistence.GenerationType;
import javax.persistence.Id;
import javax.persistence.OneToMany;
import javax.persistence.Table;

@Entity
@Table(name = "user_role")
public class UserRole {

    @Id
    @Column(name = "iduser_role")
    @GeneratedValue(strategy = GenerationType.IDENTITY)
    private int idUserRole;
    private String roleName;
    
    @OneToMany(mappedBy = "userRole")
    private List<Users> users;

    public UserRole() {
    }

    public int getIdUserRole() {
        return idUserRole;
    }

    public String getRoleName() {
        return roleName;
    }

    public List<Users> getUsers() {
        return users;
    }

    public void setIdUserRole(int idUserRole) {
        this.idUserRole = idUserRole;
    }

    public void setRoleName(String roleName) {
        this.roleName = roleName;
    }

    public void setUsers(List<Users> users) {
        this.users = users;
    }

}

Here is my Controller:

@RequestMapping("/login")
    public String login() {
        Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
        
        if (authentication == null || authentication instanceof AnonymousAuthenticationToken) {
            return "login";
        }
        
        return "redirect:/login";
        
    }
    
    @RequestMapping("/logout")
    public String logout() {
        
        return "login";
        
    }
    
    @GetMapping
    public String login(@RequestParam(value = "error", defaultValue = "false") boolean loginError) {
        if (loginError) {
            return "error-404";
            }
        return "login";
        
    }
    
    @RequestMapping("/admin/home")
public String loginAdmin(Model model) {
    
    System.out.println("From Admin Controller");
    return "/admin/home";
}

@RequestMapping("/user/home")
public String loginUser(Model model) {
    
    System.out.println("From User Controller");
    
    return "/user/home";
}

Here is my WebSecurityConfiguration File:

package com.myproject.configure;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.authentication.dao.DaoAuthenticationProvider;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.builders.WebSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.web.authentication.logout.LogoutSuccessHandler;
import org.springframework.security.web.util.matcher.AntPathRequestMatcher;

import com.recruitmentmanagement.service.CustomUserDetailsService;

@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired
    private CustomUserDetailsService userDetailsService;
    
    @Autowired
    private CustomLoginSuccessHandler successHandler;
    
    
    
    @Bean
    public PasswordEncoder  passwordEncoder() {
        return new BCryptPasswordEncoder();
    }
    
    
    @Override
    protected void configure(HttpSecurity httpSecurity) throws Exception {

        httpSecurity
        .authorizeRequests()
        .antMatchers("/login","/registration", "/process_registration", "/userhome", "/landing", "/order", "/jobdetails/**").permitAll()
        .antMatchers("/user/**").hasAnyAuthority("USER", "ADMIN")
        .antMatchers("/admin/**").hasAnyAuthority("ADMIN")
        .anyRequest().authenticated()
        .and()
        .csrf().disable().formLogin()
        .loginPage("/login")
        .failureUrl("/login?error=true")
        .successHandler(successHandler)
        .usernameParameter("userName")
        .passwordParameter("password")
    .and()
    .logout()
    .logoutRequestMatcher(new AntPathRequestMatcher("/logout"))
    .logoutSuccessUrl("/login").and()
    .exceptionHandling()
    .accessDeniedPage("/access-denied");
        
    }
    
    @Bean
    public LogoutSuccessHandler logoutSuccessHandler() {
        return new CustomLogoutSuccessHandler();
    }

    @Override
    public void configure(WebSecurity webSecurity) throws Exception {
        webSecurity.ignoring().antMatchers("/webjars/**",
                                            "/css/**", 
                                            "/js/**",
                                            "/images/**",
                                            "/node_modules/**",
                                            "/bower_components/**");
    }

    
    @Bean
    public DaoAuthenticationProvider authProvider() throws Exception {
        
        DaoAuthenticationProvider authenticationProvider = new DaoAuthenticationProvider();
        authenticationProvider.setPasswordEncoder(passwordEncoder());
        authenticationProvider.setUserDetailsService(userDetailsService);
        return authenticationProvider;
    }
    
    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        System.out.println("WebSecurityConfig -- " + authProvider().toString());
        auth.authenticationProvider(authProvider());
    }
    
}

Answer 1

Consider using official Spring Security model

So everything would be done for you

You could specify there roles and permissions for certain pages

Answer 2

Ok so first off, you'll have to extend AuthenticationSuccessHandler, and your handle method should look something like this

@Component
public class CustomSuccessHandler implements AuthenticationSuccessHandler {

    @Override
    public void onAuthenticationSuccess(HttpServletRequest request, HttpServletResponse response,
            Authentication authentication) throws IOException, ServletException {

        String redirectUrl = determineTargetUrl(authentication);

        if (redirectUrl == null) {
            throw new SomeException();
        }

        new DefaultRedirectStrategy().sendRedirect(request, response, redirectUrl);
    }
}

At this point the url 'login?error=true' is reduntant. You can safely remove it from the defineTargeUrl since you defined in the failure login url within the WebSecurityConfig class.

With this said the controller should look so like this

@Controller
@RequestMapping
public class TestController {

    ...
}

I couldn't see the top of your controller class so make sure you've got both of those annotations. Also be careful when defining the following conditions

hasAnyAuthority("USER", "ADMIN")

and

roleName.contains("ADMIN")

You must use the 'equals' inside the redirect class it might cause ambiguities

Answer 3

Actually i was getting only [USER] as authorities, its i found when i print authentication.getAuthorities(); from my SuccessHandler class. And when i check my authProvider() function from WebSecurity class where my users authorities provided by my CustomUserDetailsService. I check my CustomUserDetailsService class and I found following :

package com.myproject.service;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.core.userdetails.UsernameNotFoundException;
import org.springframework.stereotype.Service;

import com.recruitmentmanagement.entities.Users;

@Service
public class CustomUserDetailsService implements UserDetailsService {

    @Autowired
    UsersService usersService;
    
    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        
        final Users users = usersService.getUsersByUsers(username);
        
        if (users == null) {

            throw new UsernameNotFoundException("User not found !!!");              
        }

        UserDetails userDetails = User.withUsername(users.getUserName()).password(users.getPassword()).authorities("USER").build(); 
        
        
        
        return userDetails;

    }

}

Then i change my code and here is my final CustomUserDetailService class

package com.myproject.service;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.core.userdetails.UsernameNotFoundException;
import org.springframework.stereotype.Service;

import com.recruitmentmanagement.entities.Users;

@Service
public class CustomUserDetailsService implements UserDetailsService {

    @Autowired
    UsersService usersService;
    
    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        
        final Users users = usersService.getUsersByUsers(username);
        
        if (users == null) {

            throw new UsernameNotFoundException("User not found !!!");              
        }

        UserDetails userDetails = User.withUsername(users.getUserName()).password(users.getPassword()).authorities(users.getUserRole().getRoleName()).build();  
        
        
        
        return userDetails;

    }

}

Thank you to everyone who tries to help me.