Question

我正在尝试创建一个只能由“管理员”角色访问的网页，但是所有用户都可以访问它。我有User和Role实体，它们设置了一个有效的ManyToMany关系。

这是我的SecurityConfig.java：

@Configuration
public class SecurityConfig extends WebSecurityConfigurerAdapter {

@Autowired
private UserService userService;





@Override
protected void configure(HttpSecurity http) throws Exception {
    http
    .authorizeRequests()
        .antMatchers(
                "/registration",
                "/js/**",
                "/css/**",
                "/img/**",
                "/webjars/**").permitAll()
        .anyRequest().authenticated()
    .and()
        .formLogin()
            .loginPage("/login")
                .permitAll()
    .and()
       .authorizeRequests()
           .antMatchers("/competition/**").hasRole("Admin")
    .and()
        .logout()
            .invalidateHttpSession(true)
            .clearAuthentication(true)
            .logoutRequestMatcher(new AntPathRequestMatcher("/logout"))
            .logoutSuccessUrl("/login?logout")
    .permitAll();
}




@Bean
public BCryptPasswordEncoder passwordEncoder(){
    return new BCryptPasswordEncoder();
}

@Bean
public DaoAuthenticationProvider authenticationProvider(){
    DaoAuthenticationProvider auth = new DaoAuthenticationProvider();
    auth.setUserDetailsService(userService);
    auth.setPasswordEncoder(passwordEncoder());
    return auth;
}

@Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
    auth.authenticationProvider(authenticationProvider());
}

正如你所看到的那样

.antMatchers("/competition/**").hasRole("Admin")

我正在努力建立链接/竞争/ **管理员。

这是控制器：

@Controller
public class CompetitionController {

@Autowired
CompetitionRepository competitionRepository;

@GetMapping("/competition/{competitors}")
public String match(ModelMap map, @PathVariable(value = "competitors") String competitors, Principal principal) {

    String[] parts = competitors.split("-");
    String part1 = parts[0]; 
    String part2 = parts[1];

    map.addAttribute("part1", part1);
    map.addAttribute("part2", part2);
    return "match";
}

}

最后这是我的UserService：

@Service
public class UserServiceImpl implements UserService {

@Autowired
private UserRepository userRepository;

@Autowired
private BCryptPasswordEncoder passwordEncoder;

@Override
public UserDetails loadUserByUsername(String email) throws UsernameNotFoundException {
    User user = userRepository.findByEmail(email);
    if (user == null){
        throw new UsernameNotFoundException("Invalid username or password.");
    }
    return new org.springframework.security.core.userdetails.User(user.getEmail(),
            user.getPassword(),
            mapRolesToAuthorities(user.getRoles()));
}

public User findByEmail(String email){
    return userRepository.findByEmail(email);
}

public User save(UserRegistrationDto registration){
    User user = new User();
    user.setFirstName(registration.getFirstName());
    user.setLastName(registration.getLastName());
    user.setEmail(registration.getEmail());
    user.setPassword(passwordEncoder.encode(registration.getPassword()));
    user.setRoles(Arrays.asList(new Role("ROLE_USER")));

    User userAdmin = userRepository.findByEmail("admin@email.com");
    if (userAdmin == null){
       userAdmin = new User();
       userAdmin.setFirstName("Admin");
       userAdmin.setLastName("");
       userAdmin.setEmail("admin@email.com");
       userAdmin.setPassword(passwordEncoder.encode("admin"));
       userAdmin.setRoles(Arrays.asList(new Role("ROLE_Admin")));

       userRepository.save(userAdmin);
    }


    return userRepository.save(user);
}

private Collection<? extends GrantedAuthority> mapRolesToAuthorities(Collection<Role> roles){
    return roles.stream()
            .map(role -> new SimpleGrantedAuthority(role.getName()))
            .collect(Collectors.toList());
}
}

我试图将.hasRole更改为.hasAuthority，如此答案所示（无效）：Spring Security Java configuration for authenticated users with a role。

Spring-boot Spring Security;没有正确角色的用户仍在访问特定于角色的页面

0 个答案: