Spring Security动态角色

Question

<http use-expressions="true" >
        <intercept-url pattern="/**" access="isAuthenticated()"/>
        <form-login  login-page="/login.jsp" 
                     login-processing-url="/login"
                     username-parameter="userName"
                     password-parameter="password"
                     authentication-success-handler-ref="authenticationSuccessHandler"
                     authentication-failure-handler-ref="authenticationFailedHandler"
                     />
        <logout logout-url="/logout" invalidate-session="true" logout-success-url="/login.jsp?logout=true"/>
        <access-denied-handler error-page="/accessDenied"/>
    </http>

自定义身份验证提供程序

List<GrantedAuthority> AUTHORITIES = new ArrayList<GrantedAuthority>();
    if(userName.equals("admin")){
        System.out.println("++++++ admin user +++++");
        AUTHORITIES.add(new SimpleGrantedAuthority("/hello"));
        AUTHORITIES.add(new SimpleGrantedAuthority("/hello1"));
        AUTHORITIES.add(new SimpleGrantedAuthority("/hello2"));
    }else{
        AUTHORITIES.add(new SimpleGrantedAuthority("/hello"));
        AUTHORITIES.add(new SimpleGrantedAuthority("/hello1"));
    }
    return new UsernamePasswordAuthenticationToken(userName,null,AUTHORITIES);

在上面的例子中，现在所有的用户都可以访问所有的URL，但请帮助限制他们只能访问授予他的URL。

Answer 1

试试这个,

<http use-expressions="true" >
    <intercept-url pattern="/**" access="hasRole('ROLE_USER') or hasRole('ROLE_ADMIN') or hasRole('ROLE_MYCUSTOMROLE')"/>
    <form-login  login-page="/login.jsp" 
                 login-processing-url="/login"
                 username-parameter="userName"
                 password-parameter="password"
                 authentication-success-handler-  ref="authenticationSuccessHandler"
                 authentication-failure-handler-  ref="authenticationFailedHandler"
                 />
    <logout logout-url="/logout" invalidate-session="true" logout-success-url="/login.jsp?logout=true"/>
    <access-denied-handler error-page="/accessDenied"/>
</http>

注意1：为了清晰起见，使用安全名称空间，访问属性应该有一些角色，而不是url

不是将URl传递给GrantedAuthority，而是传递一些角色，甚至您也可以做得更好，只需创建一个User pojo类并实现UserDetails，这样您就可以避免大量的锅炉板代码。