Spring Security权限控制的实现接口

2023-03-28 10:11 开发作者： T.Y.Bao

Introduction

认证过程中会一并获得用户权限，Authentication#getAuthorities接口方法提供权限，认证过后python即是鉴权，Spring Security使用GrantedAuthority接口代表权限。早期版本在FilterChain中使用FilterSecurityInterceptor中执行鉴权过程，现使用AuthorizationFilter执行，开始执行顺序两者一致，此外，Filter中具体实现也由 AccessDecisionManager + AccessDecisionVoter 变为 AuthorizationManager

本文关注新版本的实现：AuthorizationFilter和AuthorizationManager。

AuthorizationManager最常用的实现类为RequestMatcherDelegatingAuthorizationManager，其中会根据你的配置生成一系列RequestMatcherEntry，每个entry中包含一个匹配器RequestMatcher和泛型类被匹配对象。

UML类图结构如下：

Spring Security权限控制的实现接口

另外，对于 method security ，实现方式主要为AOP+Spring EL，常用权限方法注解为：

@EnableMethodSecurity
@PreAuthorize
@PostAuthorize
@PreFilter
@PostFilter
@Secured

这些注解可以用在controller方法上用于权限控制，注解中填写Spring EL表述权限信息。这些注解一起使用时的执行顺序由枚举类AuthorizationInterceptorsOrder控制：

public enum AuthorizationInterceptorsOrder {
	FIRST(Integer.MIN_VALUE),
	/**
	 * {@link PreFilterAuthorizationMethodInterceptor}
	 */
	PRE_FILTER,
	PRE_AUTHORIZE,
	SECURED,
	jsR250,
	POST_AUTHORIZE,
	/**
	 * {@link PostFilterAuthorizationMethodInterceptor}
	 */
	POST_FILTER,
	LAST(Integer.MAX_VALUE);
	...
}

而这些权限注解的提取和配置主要由org.springframework.security.config.annotation.method.configuration包下的几个配置类完成：

PrePostMethodSecurityConfiguration
SecuredMethodSecurityConfiguration

等

权限配置

权限配置可以通过两种方式配置：

SecurityFilterChain配置类配置
@EnableMethodSecurity 开启方法上注解配置

下面是关于SecurityFilterChain的权限配置，以及method security使用

@Configuration
// 其中prepostEnabled默认true,其他注解配置默认false,需手动改为true
@EnableMethodSecurity(securedEnabled = true)
@RequiredArgsConstructor
public class SecurityConfig {
	// 白名单
	private static final String[] AUTH_WHITELIST = ... 
    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
	    // antMatcher or mvcMatcher
        http.authorizeHttpRequests()
                .antMatchers(AUTH_WHITELIST).permitAll()
                // hasRole中不需要添加 ROLE_前缀
                // ant 匹配 /admin /admin/a /admin/a/b 都会匹配上
                .antMatchers("/admin/**").hasRole("ADMIN")
                .anyRequest().authenticated();
                // denyAll慎用
//                .anyRequest().denyAll();
//        http.authorizeHttpRequests()
//                .mvcMatchers(AUTH_WHITELIST).permitAll()
//                        // 效果同上
//                        .mvcMatchers("/admin").hasRole("ADMIN")
//                        .anyRequest().denyAll();
    }
}

以@PreAuthorize为例，在controller方法上使用：

@Api("user")
@RestController
@RequestMapping("/user")
@RequiredArgsConstructor
public class UserController {
	/**
     * {@link EnableMethodSecurity} 注解必须配置在配置类上<br/>
     * {@link PreAuthorize}等注解中表达式使用 Spring EL
     * @return
     */
    @PreAuthorize("hasRole('ADMIN')")
    @GetMapping("/admin")
    public ResponseEntity<Map<String, Object>> admin() {
        return ResponseEntithttp://www.devze.comy.ok(Collections.singletonMap("msg","u r admin"));
    }
}

源码

配置类权限控制

AuthorizationFilter

public class AuthorizationFilter extends OncePerRequestFilter {
	// 在配置类中默认实现为 RequestMatcherDelegatingAuthorizationManager
	private final AuthorizationManager<HttpServletRequest> authorizationManager;
		@Override
	protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain)
			throws ServletException, IOException {
		// 委托给AuthorizationManager
		AuthorizationDecision decision = this.authorizationManager.check(this::getAuthentication, request);
		if (decision != null && !decision.isGranted()) {
			throw new AccessDeniedException("Access Denied");
		}
		filterChain.doFilter(request, response);
	}
}

来看看AuthorizationManager默认实现RequestMatcherDelegatingAuthorizationManager：

public final class RequestMatcherDelegatingAuthorizationManager implements AuthorizationManager<HttpServletRequest> {
	// http.authorizeHttpRequests().antMatchers(AUTH_WHITELIST)...
	// SecurityFilterChain中每配置一项就会增加一个Entry
	// RequestMatcherEntry包含一个RequestMatcher和一个待鉴权对象，这里是AuthorizationManager
	private final List<RequestMatcherEntry<AuthorizationManager<RequestAuthorizationContext>>> mappings;
	...
	@Override
	public AuthorizationDecision check(Supplier<Authentication> authentication, HttpServletRequest request) {
		for (RequestMatcherEntry<AuthorizationManager<RequestAuthorizationContext>> mapping : this.mappings) {
			RequestMatcher matcher = mapping.getRequestMatcher();
			MatchResult matchResult = matcher.matcher(request);
			if (matchResult.isMatch()) {
				AuthorizationManager<RequestAuthorizationContext> manager = mapping.getEntry();
				return manager.check(authentication,
						new RequestAuthorizationContext(request, matchResult.getVariables()));
			}
		}
		return null;
	}
}

方法权限控制

总的实现基于 AOP + Spring EL

以案例中 @PreAuthorize注解的源码为例

PrePostMethodSecurityConfiguration

@Configuration(proxyBeanMethods = false)
@Role(BeanDefinition.ROLE_INFRASTRUCTURE)
final class PrePostMethodSecurityConfiguration {
	private final AuthorizationManagerBeforeMethodInterceptor preAuthorizeAuthorizationMethodInterceptor;
	private final PreAuthorizeAuthorizationManager preAuthorizeAuthorizationManager = new PreAuthorizeAuthorizationManager();
	private final DefaultMethodSecurityExpressionHandler expressionHandl开发者_JS开发er = new DefaultMethodSecurityExpressionHandler();
	...
	@Autowired
	PrePostMethodSecurityConfiguration(ApplicationContext context) {
		// 设置 Spring EL 解析器
		this.preAuthorizeAuthorizationManager.setExpressionHandler(this.expressionHandler);	
		// 拦截@PreAuthorize方法
		this.preAuthorizeAuthorizationMethodInterceptor = AuthorizationManagerBeforeMethodInterceptor
				.preAuthorize(this.preAuthorizeAuthorizationManager);
		...
	}
	...
}

AuthorizationManagerBeforeMethodInterceptor

基于AOP实现

public final class AuthorizationManagerBeforeMethodInterceptor
		implements Ordered, MethodInterceptor, PointcutAdvisor, AopInfrastructureBean {
	/**
	 * 调用起点
	 */
	public static AuthorizationManagerBeforeMethodInterceptor preAuthorize() {		
		// 针对 @PreAuthorize注解提供的AuthorizationManager为PreAuthorizeAuthorizationManager
		return preAuthorize(new PreAuthorizeAuthorizationManager());
	}
	/**
	 * 初始化，创建基于@PreAuthorize注解的aop方法拦截器
	 * Creates an interceptor for the {@link PreAuthorize} annotation
	 * @param authorizationManager the {@link PreAuthorizeAuthorizationManager} to use
	 * @return the interceptor
	 */
	public static AuthorizationManagerBeforeMethodInterceptor preAuthorize(
			PreAuthorizeAuthorizationManager authorizationManager) {
		AuthorizationManagerBeforeMethodInterceptor interceptor = new AuthorizationManagerBeforeMethodInterceptor(
				AuthorizationMethodPointcuts.forAnnotations(PreAuthorize.class), authorizationManager);
		interceptor.setOrder(AuthorizationInterceptorsOrder.PRE_AUTHORIZE.getOrder());
		return interceptor;
	}
	...	
	// 实现MethodInterceptor方法，在调用实际方法是会首先触发这个
	@Override
	public Object invoke(MethodInvocation mi) throws Throwable {
		// 先鉴权
		attemptAuthorization(mi);
		// 后执行实际方法
		return mi.proceed();
	}
	private void attemptAuthorization(MethodInvocation mi) {
		// 判断, @PreAuthorize方法用的manager就是
		// PreAuthorizeAuthorizationManager
		// 是通过上面的static类构造的
		AuthorizationDecision decision = this.authorizationManager.check(AUTHENTICATION_SUPPLIER, mi);
		if (decision != null && !decisio编程客栈n.isGranted()) {
			throw new AccessDeniedException("Access Denied");
		}
		...
	}
	static final Supplier<Authentication> AUTHENTICATION_SUPPLIER = () -> {
		Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
		if (authentication == null) {
			throw new AuthenticationCredentialsNotFoundException(
					"An Authentication object was not found in the SecurityContext");
		}
		return authentication;
	};
}

针对@PreAuthorize方法用的manager就是 PreAuthorizeAuthorizationManager#check，下面来看看

PreAuthorizeAuthorizationMana编程客栈ger

public final class PreAuthorizeAuthorizationManager implements AuthorizationManager<MethodInvocation> {
	private final PreAuthorizeExpressionAttributeRegistry registry = new PreAuthorizeExpressionAttributeRegistry();
	private MethodSecurityExpressionHandler expressionHandler = new DefaultMethodSecurityExpressionHandler();
	@Override
	public AuthorizationDecision check(Supplier<Authentication> authentication, MethodInvocation mi) {
		// 获取方法上@PreAuthorize注解中的Spring EL 表达式属性
		ExpressionAttribute attribute = this.registry.getAttribute(mi);
		if (attribute == ExpressionAttribute.NULL_ATTRIBUTE) {
			return null;
		}
		// Spring EL 的 context
		EvaLuationContext ctx = this.expressionHandler.createEvaluationContext(authentication.get(), mi);
		// 执行表达式中结果, 会执行SecurityExpressionRoot类中对应方法。涉及Spring EL执行原理，pass
		boolean granted = ExpressionUtils.evaluateAsBoolean(attribute.getExpression(), ctx);	
		// 返回结果
		return new ExpressionAttributeAuthorizationDecision(granted, attribute);
	}
}

到此这篇关于Spring Security权限控制的实现接口的文章就介绍到这了,更多相关Spring Security权限控制内容请搜索我们以前的文章或继续浏览下面的相关文章希望大家以后多多支持我们！

继续阅读：Spring Security权限控制 Spring权限控制

Spring Security权限控制的实现接口

目录

Introduction

权限配置

源码

配置类权限控制

方法权限控制

更多精彩内容

精彩评论

最新开发

如何实现Python编写的图形界面可以自由拖动

mysql字符集引起的java.sql.SQLException:Incorrect string value:问题

解决Feign异步调用丢失上下文问题

python模拟重载初始化函数的方法详解

SQL注入攻击及其在SpringBoot中使用MyBatisPlus的防范策略的方法

开发排行榜

springboot后端存储富文本内容的思路与步骤(含图片内容)

PyCharm运行python测试,报错“没有发现测试”/“空套件”的解决

return base64.b64encode(b).decode(

基于C语言实现钻石棋游戏的示例代码

Sublime Text 3解决中文乱码问题（实测可用）