Spring Security 插件

// springsecurity的组件实现类，将安全的的查询类库与本地应用的表格结合
@Component
public class CoreSecurityComponent implements CoreSecurityOperater {
    @Autowired
    RequestmapRepository requestmapRepository;
    @Autowired
    BaseUserRepository baseUserRepository;
    @Autowired
    BaseUserBaseRoleRepository baseUserBaseRoleRepository;
    @Autowired
    BaseRolePrivilegeRepository baseRolePrivilegeRepository;
    @Override
    public Object findUserByUsername(String username) {
        return baseUserRepository.findByUsername(username);
    }

    @Override
    public Object findUserById(Object id) {
        return baseUserRepository.findById((String)id);
    }

    @Override
    public List findAllUserAuthorities(Object user) {
        List<String> roleNameList= new ArrayList<String>();
        List<BaseUserBaseRole> list=baseUserBaseRoleRepository.findAllByBaseUserId(((BaseUser)user).getId());
        list.forEach(baseUserBaseRole->{
            roleNameList.add(baseUserBaseRole.getBaseRole().getAuthority());
        });
        return roleNameList;
    }

    @Override
    public List findAllUserPrivileges(List<String> roleNames) {
        List<String> privilegeNameList= new ArrayList<String>();
        List<BaseRolePrivilege> list=baseRolePrivilegeRepository.findAllByBaseRoleIdIn(roleNames);
        list.forEach(baseRolePrivilege->{
            privilegeNameList.add(baseRolePrivilege.getPrivilege().getName());
        });
        return privilegeNameList;
    }

    @Override
    public List findAllRequestmaps() {
        return requestmapRepository.findAll(Sort.by(Sort.Direction.ASC,"id"));
    }

    @Override
    public List findAllRequestmapsByRoleName(String roleName) {
        return requestmapRepository.findAllByConfigAttributeLike(roleName);
    }
}

SpringSecurityUtils类
静态方法
    ifAllGranted(String roles)    当前用户是否全部授予角色
    ifNotGranted(String roles)   当前用户是否全部未授予角色
    ifAnyGranted(String roles)   当前用户是否授予其中任一角色
    isAjax(HttpServletRequest request)   当前是否ajax请求
    reauthenticate(String username, String password)  重新认证
    PasswordEncoder findPasswordEncoder(String algorithm)  //获取指定算法的PasswordEncoder
SpringSecurityService类
需要使用@Autowired 注入
    getPrincipal()        获取当前登录principal ，匿名用户为字符串 anonymous
    注意：登录用户为 CoreUser 的实例
    getCurrentUser()   获取当前用户实例 （BaseUser）
    encodePassword(String password)
    encodePassword(String password, Object salt = null)
    isLoggedIn()
    clearCachedRequestmaps()   清除当前缓存的访问控制列表
    PasswordEncoder findPasswordEncoder(String algorithm)  //获取指定算法的PasswordEncoder

base:
    springsecurity:
      cors: disable

#spring security
security.basic.enabled: false
base:
    springsecurity:
      csrf: disable
      cors: disable
      frameOptions: disabled   #disabled,deny,sameOrigin
      csrf: disable
      cors: enable
      corsConfig:
        allowCredentials: true # true or false
        allowedOrigins:  '*'  # * or http://localhost:8080
        allowedHeaders:  '*'  #
        allowedMethods:  '*' # GET,POST or *
        corsPath: /**
      headers:
        - {Access-Control-Expose-Headers: WWW-Authenticate,Authorization,Set-Cookie,X-Frame-Options}
        - {Access-Control-Max-Age: 3600}
      ajaxHeader: X-Requested-With
      password:
        encodeHashAsBase64: false
        algorithm: bcrypt # bcrypt,pbkdf2,SHA-512,SHA-384,SHA-256,SHA-224,SHA-1,MD5,MD2
      securityConfigType :  Requestmap
      userLookup:
        userDomainClassName: org.yunchen.gb.example.demo.domain.core.BaseUser
        authorityJoinClassName: org.yunchen.gb.example.demo.domain.core.BaseUserBaseRole
      authority.className: org.yunchen.gb.example.demo.domain.core.BaseRole
      requestMap.className: org.yunchen.gb.example.demo.domain.core.Requestmap
      apf:     #/** authenticationProcessingFilter */
        filterProcessesUrl: /login/authenticate
      auth:
        loginFormUrl: /login/auth
        alreadyLogin: /login/alreadyLogin #注释此行，则不再做当前session是否登录检查
        useForward: false
      adh:     #/*accessDeniedHandler*/
        errorPage: /login/denied
        ajaxErrorPage: /login/ajaxDenied
        useForward: true
      failureHandler:
        defaultFailureUrl: /login/authfail
        defaultAjaxFailureUrl: /login/authajaxfail
      successHandler:
        defaultTargetUrl: /workspace/index  #登录成功后，若没有rediretUrl则引导进此url
        ajaxSuccessUrl: /login/ajaxSuccess
        #如注释systemloginRecord 则不进行登录日志记录
        systemloginRecord: org.yunchen.gb.example.demo.domain.core.SystemLoginRecord
      logout:
        afterLogoutUrl: /
        filterProcessesUrl: /logoff
      sessionAuthenticationStrategy:
        maximumSessions: 1  #//-1 为不限,1为只可登录一个用户实例   不可为0
        maxSessionsPreventsLogin: false  #// true 为后登陆用户异常，false 为先登陆用户被踢出
        expiredUrl: /login/concurrentSession