springboot security 动态权限

Spring Boot Security 动态权限是指在运行时动态地给予用户或用户组不同的权限，以实现更灵活的权限管理。在传统的权限控制中，用户的权限是在系统启动时就已经确定的，无法在运行时进行修改。而在动态权限控制中，系统管理员可以随时根据需求调整用户或用户组的权限，从而实现更高效、更灵活的权限管理。

在 Spring Boot Security 中，实现动态权限控制主要有两种方式：

1. 基于表达式的权限控制：Spring Security 提供了一种基于表达式的权限控制方式，可以在运行时根据表达式的结果动态决定是否给予用户权限。这种方式需要在代码中手动编写表达式，比较繁琐，但灵活性较高。

2. 基于数据库的权限控制：Spring Security 还提供了一种基于数据库的权限控制方式，可以在运行时从数据库中读取用户权限信息，并根据权限信息动态决定是否给予用户权限。这种方式需要在数据库中维护用户权限信息，比较方便，但灵活性较低。

综上所述，Spring Boot Security 动态权限控制是在 Spring Security 的基础上进行的，可以根据具体需求选择合适的实现方式。

相关问题

springbootsecurity动态权限

Spring Boot Security提供了动态权限管理的支持，可以在运行时动态地添加、修改和删除用户权限，而无需重新启动应用程序。以下是实现动态权限的步骤：

1. 配置Spring Security

在Spring Security配置类中，需要指定权限管理器和访问决策管理器：

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired
    private CustomUserDetailsService userDetailsService;

    @Autowired
    private CustomPermissionEvaluator permissionEvaluator;

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests()
                .anyRequest().authenticated()
                .accessDecisionManager(accessDecisionManager())
                .and()
                .formLogin()
                .and()
                .httpBasic()
                .and()
                .csrf().disable();
    }

    @Bean
    public DefaultWebSecurityExpressionHandler webSecurityExpressionHandler() {
        DefaultWebSecurityExpressionHandler handler = new DefaultWebSecurityExpressionHandler();
        handler.setPermissionEvaluator(permissionEvaluator);
        return handler;
    }

    @Bean
    public AccessDecisionManager accessDecisionManager() {
        List<AccessDecisionVoter<?>> decisionVoters = Arrays.asList(
                new WebExpressionVoter(),
                new RoleVoter(),
                new AuthenticatedVoter(),
                new CustomPermissionVoter(permissionEvaluator)
        );
        return new AffirmativeBased(decisionVoters);
    }

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.userDetailsService(userDetailsService);
    }

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }
}

2. 实现自定义权限管理器和访问决策管理器

自定义权限管理器和访问决策管理器是实现动态权限管理的关键。权限管理器负责加载用户权限，访问决策管理器负责根据用户权限决策是否允许访问某个资源。

@Component
public class CustomPermissionEvaluator implements PermissionEvaluator {

    @Autowired
    private PermissionService permissionService;

    @Override
    public boolean hasPermission(Authentication authentication, Object targetDomainObject, Object permission) {
        if (authentication == null || targetDomainObject == null || !(permission instanceof String)) {
            return false;
        }

        CustomUserDetails userDetails = (CustomUserDetails) authentication.getPrincipal();
        String targetType = targetDomainObject.getClass().getSimpleName().toUpperCase();
        PermissionType permissionType = PermissionType.valueOf((String) permission);

        return permissionService.hasPermission(userDetails.getUserId(), targetType, permissionType);
    }

    @Override
    public boolean hasPermission(Authentication authentication, Serializable targetId, String targetType, Object permission) {
        if (authentication == null || targetType == null || !(permission instanceof String)) {
            return false;
        }

        CustomUserDetails userDetails = (CustomUserDetails) authentication.getPrincipal();
        PermissionType permissionType = PermissionType.valueOf((String) permission);

        return permissionService.hasPermission(userDetails.getUserId(), targetType.toUpperCase(), permissionType);
    }
}

@Component
public class CustomPermissionVoter extends AbstractAccessDecisionVoter<Object> {

    private final PermissionEvaluator permissionEvaluator;

    public CustomPermissionVoter(PermissionEvaluator permissionEvaluator) {
        super("ROLE_USER");
        this.permissionEvaluator = permissionEvaluator;
    }

    @Override
    public boolean supports(ConfigAttribute attribute) {
        return attribute.getAttribute() != null && attribute.getAttribute().startsWith("PERM_");
    }

    @Override
    public boolean supports(Class<?> clazz) {
        return true;
    }

    @Override
    public int vote(Authentication authentication, Object object, Collection<ConfigAttribute> attributes) {
        int result = ACCESS_ABSTAIN;
        CustomUserDetails userDetails = (CustomUserDetails) authentication.getPrincipal();

        for (ConfigAttribute attribute : attributes) {
            if (this.supports(attribute)) {
                result = ACCESS_DENIED;
                String permission = attribute.getAttribute().substring(5);
                Object targetObject = object;

                if (object instanceof FilterInvocation) {
                    FilterInvocation filterInvocation = (FilterInvocation) object;
                    HttpServletRequest request = filterInvocation.getRequest();
                    targetObject = new CustomWebSecurityExpressionRoot(authentication, request);
                }

                if (permissionEvaluator.hasPermission(authentication, targetObject, permission)) {
                    return ACCESS_GRANTED;
                }
            }
        }

        return result;
    }
}

3. 实现自定义用户权限加载器

自定义用户权限加载器负责从数据库或其他数据源中加载用户权限，可以在运行时动态地添加、修改和删除用户权限。

@Service
public class CustomUserDetailsService implements UserDetailsService {

    @Autowired
    private UserService userService;

    @Autowired
    private PermissionService permissionService;

    @Override
    public CustomUserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        User user = userService.getUserByUsername(username);

        if (user == null) {
            throw new UsernameNotFoundException("User not found");
        }

        List<Permission> permissions = permissionService.getPermissionsByUserId(user.getId());
        Set<GrantedAuthority> authorities = new HashSet<>();

        for (Permission permission : permissions) {
            authorities.add(new SimpleGrantedAuthority("PERM_" + permission.getPermissionType()));
        }

        return new CustomUserDetails(user.getId(), user.getUsername(), user.getPassword(), authorities);
    }
}

4. 实现自定义权限管理器

自定义权限管理器负责将用户权限加载到Spring Security的安全上下文中。

@Component
public class CustomSecurityMetadataSource implements FilterInvocationSecurityMetadataSource {

    private final Map<String, Collection<ConfigAttribute>> resourceMap = new ConcurrentHashMap<>();

    @Autowired
    private PermissionService permissionService;

    @Override
    public Collection<ConfigAttribute> getAttributes(Object object) throws IllegalArgumentException {
        if (object instanceof FilterInvocation) {
            FilterInvocation filterInvocation = (FilterInvocation) object;
            HttpServletRequest request = filterInvocation.getRequest();
            String url = request.getRequestURI();
            String method = request.getMethod();
            String key = url + ":" + method;

            if (resourceMap.containsKey(key)) {
                return resourceMap.get(key);
            } else {
                List<Permission> permissions = permissionService.getPermissionsByUrlAndMethod(url, method);
                Collection<ConfigAttribute> configAttributes = new HashSet<>();

                for (Permission permission : permissions) {
                    configAttributes.add(new SecurityConfig("PERM_" + permission.getPermissionType()));
                }

                resourceMap.put(key, configAttributes);
                return configAttributes;
            }
        }

        return null;
    }

    @Override
    public Collection<ConfigAttribute> getAllConfigAttributes() {
        return null;
    }

    @Override
    public boolean supports(Class<?> clazz) {
        return FilterInvocation.class.isAssignableFrom(clazz);
    }
}

5. 实现自定义权限服务

自定义权限服务负责提供添加、修改和删除用户权限的接口。

@Service
public class PermissionService {

    @Autowired
    private PermissionRepository permissionRepository;

    public List<Permission> getPermissionsByUserId(Long userId) {
        return permissionRepository.findByUserId(userId);
    }

    public List<Permission> getPermissionsByUrlAndMethod(String url, String method) {
        return permissionRepository.findByUrlAndMethod(url, method);
    }

    public boolean hasPermission(Long userId, String targetType, PermissionType permissionType) {
        List<Permission> permissions = permissionRepository.findByUserIdAndTargetTypeAndPermissionType(userId, targetType, permissionType);
        return !permissions.isEmpty();
    }

    public void addPermission(Permission permission) {
        permissionRepository.save(permission);
    }

    public void updatePermission(Permission permission) {
        permissionRepository.save(permission);
    }

    public void deletePermission(Long permissionId) {
        permissionRepository.deleteById(permissionId);
    }
}

6. 在运行时动态添加、修改和删除用户权限

在需要添加、修改和删除用户权限的地方，调用自定义权限服务的接口即可。

例如，可以实现一个RESTful API，用于添加、修改和删除用户权限：

@RestController
@RequestMapping("/permissions")
public class PermissionController {

    @Autowired
    private PermissionService permissionService;

    @PostMapping
    public void addPermission(@RequestBody Permission permission) {
        permissionService.addPermission(permission);
    }

    @PutMapping("/{id}")
    public void updatePermission(@PathVariable Long id, @RequestBody Permission permission) {
        permission.setId(id);
        permissionService.updatePermission(permission);
    }

    @DeleteMapping("/{id}")
    public void deletePermission(@PathVariable Long id) {
        permissionService.deletePermission(id);
    }
}

权限框架springboot security

SpringBoot Security是一个基于Spring框架的安全性解决方案，用于实现权限控制功能。它可以与SpringBoot无缝集成，提供了一套简单而强大的安全保护机制。[1]该权限框架支持多渠道对接，可以自动路由支付网关。同时，它还可以实现用户、角色和权限三个主要模块的管理，方便进行权限的控制和管理。在项目中集成了SpringBoot Security，可以使用其提供的功能来实现鉴权功能，同时还可以与其他技术栈如Redis、MyBatis等进行集成，以实现更加丰富的功能需求。总的来说，SpringBoot Security是一个强大且灵活的权限框架，可以满足项目的安全性需求。<span class="em">1</span><span class="em">2</span><span class="em">3</span>
#### 引用[.reference_title]
- *1* [通用权限管理系统+springboot+mybatis plus+spring security+jwt+redis+mysql](https://download.csdn.net/download/qq_37049128/87842802)[target="_blank" data-report-click={"spm":"1018.2226.3001.9630","extra":{"utm_source":"vip_chatgpt_common_search_pc_result","utm_medium":"distribute.pc_search_result.none-task-cask-2~all~insert_cask~default-1-null.142^v93^chatsearchT3_2"}}] [.reference_item style="max-width: 33.333333333333336%"]
- *2* [全开源JAVA支付系统/jeepay聚合支付四方支付系统](https://download.csdn.net/download/weixin_36643308/88277311)[target="_blank" data-report-click={"spm":"1018.2226.3001.9630","extra":{"utm_source":"vip_chatgpt_common_search_pc_result","utm_medium":"distribute.pc_search_result.none-task-cask-2~all~insert_cask~default-1-null.142^v93^chatsearchT3_2"}}] [.reference_item style="max-width: 33.333333333333336%"]
- *3* [springboot+security+mybatis+redis+jwt，鉴权框架搭建](https://download.csdn.net/download/weixin_42065235/85736885)[target="_blank" data-report-click={"spm":"1018.2226.3001.9630","extra":{"utm_source":"vip_chatgpt_common_search_pc_result","utm_medium":"distribute.pc_search_result.none-task-cask-2~all~insert_cask~default-1-null.142^v93^chatsearchT3_2"}}] [.reference_item style="max-width: 33.333333333333336%"]
[ .reference_list ]