Spring Boot基于角色的认证 [英] Spring Boot Role Based Authentication

问题描述

我遇到有关基于Spring Boot角色的身份验证的问题。基本上，我想有用户和管理员，我想阻止用户访问管理资源。所以我创建了一个SecurityConfig类：

I have a problem concerning Spring Boot role based authentication. Basically, I would like to have users and admins and I want to prevent users from accessing admin resources. So I created a SecurityConfig class:

package test;

import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.config.annotation.web.servlet.configuration.EnableWebMvcSecurity;

@Configuration
@EnableWebMvcSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

   @Override
   protected void configure(AuthenticationManagerBuilder auth) throws Exception {
       auth.inMemoryAuthentication()
           .withUser("user1").password("password1").roles("USER, ADMIN")
           .and()
           .withUser("user2").password("password2").roles("USER");
   }

   @Override
   protected void configure(HttpSecurity http) throws Exception {
       http.authorizeRequests()
           .antMatchers("/service/test").access("hasRole('USER') or hasRole('ADMIN')")
           .antMatchers("/service/admin").access("hasRole('ADMIN')");
   }
}

这是我的小型REST服务：

This is my little REST service:

package test;

import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RequestMethod;
import org.springframework.web.bind.annotation.RestController;

@RestController
@RequestMapping("/service")
public class RestService {

    @RequestMapping(value = "/test", method = RequestMethod.GET)
    public String echo() {
        return "This is a test";
    }

    @RequestMapping(value = "/admin", method = RequestMethod.GET)
    public String admin() {
        return "admin page";
    }
}

我的申请类：

package test;

import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.EnableAutoConfiguration;
import org.springframework.boot.autoconfigure.SpringBootApplication;

@SpringBootApplication
@EnableAutoConfiguration 
public class Application {

    public static void main(String[] args) {
        SpringApplication.run(Application.class, args);
    }
}

不幸的是，我总是得到403禁止/访问执行时拒绝错误消息curl user1：password1 @ localhost：8080 / service / admin...我在配置方法中是否遗漏了什么？

Unfortunately, I always get a 403 "forbidden/access denied" error message when executing "curl user1:password1@localhost:8080/service/admin"... Did I miss anything in the configure method?

非常感谢你提前很多！

推荐答案

我按照以下方式更改了它，现在它似乎正在工作：

I changed it in the following way, now it seems to be working:

@Configuration
@EnableWebMvcSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

     @Autowired
     protected void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
         auth.inMemoryAuthentication()
            .withUser("user1").password("password1").roles("USER", "ADMIN")
            .and()
            .withUser("user2").password("password2").roles("USER");
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.formLogin().permitAll()
            .and()
            .authorizeRequests()
            .antMatchers("/service/test").hasAnyRole("USER", "ADMIN")
            .antMatchers("/service/admin").hasRole("ADMIN")
            .anyRequest().authenticated();
    }
}

非常感谢您的回答！

这篇关于Spring Boot基于角色的认证的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！