Spring Security 自定义权限实现指南：详细步骤及示例

以下是一个简单的示例，演示如何使用 Spring Security 自定义权限：

1. 创建一个名为 CustomPermission 的自定义权限类，它将包含一个名称和描述：

public class CustomPermission {

    private String name;
    private String description;

    public CustomPermission(String name, String description) {
        this.name = name;
        this.description = description;
    }

    public String getName() {
        return name;
    }

    public String getDescription() {
        return description;
    }

}

2. 创建一个名为 CustomPermissionEvaluator 的自定义权限评估器，它将检查用户是否具有所需的自定义权限：

@Component
public class CustomPermissionEvaluator implements PermissionEvaluator {

    @Override
    public boolean hasPermission(Authentication authentication, Object targetDomainObject, Object permission) {
        if (authentication == null || !(permission instanceof String)) {
            return false;
        }
        String permissionName = (String) permission;
        return hasPermission(authentication, permissionName);
    }

    @Override
    public boolean hasPermission(Authentication authentication, Serializable targetId, String targetType, Object permission) {
        if (authentication == null || !(permission instanceof String)) {
            return false;
        }
        String permissionName = (String) permission;
        return hasPermission(authentication, permissionName);
    }

    private boolean hasPermission(Authentication authentication, String permissionName) {
        Collection<? extends GrantedAuthority> authorities = authentication.getAuthorities();
        for (GrantedAuthority authority : authorities) {
            if (authority instanceof CustomPermission) {
                CustomPermission customPermission = (CustomPermission) authority;
                if (customPermission.getName().equals(permissionName)) {
                    return true;
                }
            }
        }
        return false;
    }

}

3. 在 Spring Security 配置中，将自定义权限评估器添加到权限管理器中：

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired
    private CustomPermissionEvaluator customPermissionEvaluator;

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests()
                .antMatchers("/admin/**").hasAuthority("ADMIN")
                .antMatchers("/user/**").hasAuthority("USER")
                .anyRequest().authenticated()
                .and()
                .formLogin()
                .and()
                .logout()
                .and()
                .exceptionHandling().accessDeniedPage("/403");
    }

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.inMemoryAuthentication()
                .withUser("admin").password("{noop}admin").authorities(new CustomPermission("ADMIN", "Admin Permission"))
                .and()
                .withUser("user").password("{noop}user").authorities(new CustomPermission("USER", "User Permission"));
    }

    @Override
    public void configure(WebSecurity web) {
        web.ignoring().antMatchers("/resources/**");
    }

    @Override
    protected AuthenticationManager authenticationManager() throws Exception {
        ProviderManager manager = new ProviderManager(Arrays.asList(authenticationProvider()));
        return manager;
    }

    @Bean
    public DaoAuthenticationProvider authenticationProvider() {
        DaoAuthenticationProvider provider = new DaoAuthenticationProvider();
        provider.setPasswordEncoder(passwordEncoder());
        provider.setUserDetailsService(userDetailsService());
        return provider;
    }

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }

    @Bean
    public UserDetailsService userDetailsService() {
        InMemoryUserDetailsManager manager = new InMemoryUserDetailsManager();
        manager.createUser(User.builder().username("admin").password("{noop}admin")
                .authorities(new CustomPermission("ADMIN", "Admin Permission")).build());
        manager.createUser(User.builder().username("user").password("{noop}user")
                .authorities(new CustomPermission("USER", "User Permission")).build());
        return manager;
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests()
                .antMatchers("/admin/**").hasAuthority("ADMIN")
                .antMatchers("/user/**").hasAuthority("USER")
                .anyRequest().authenticated()
                .and()
                .formLogin()
                .and()
                .logout()
                .and()
                .exceptionHandling().accessDeniedPage("/403")
                .and()
                .csrf().disable();
    }

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.authenticationProvider(authenticationProvider());
    }

    @Override
    public void configure(WebSecurity web) {
        web.ignoring().antMatchers("/resources/**");
    }

    @Bean
    public PermissionEvaluator permissionEvaluator() {
        return customPermissionEvaluator;
    }

}

在上面的示例中，我们定义了两个用户，一个具有 ADMIN 权限，另一个具有 USER 权限。我们还定义了两条规则来保护 /admin 和 /user 端点，只有具有相应权限的用户才能访问。

使用自定义权限评估器时，您可以使用以下代码检查用户是否具有所需的权限：

if (auth.hasPermission(object, 'CUSTOM_PERMISSION')) {
    // user has the custom permission
} else {
    // user does not have the custom permission
}