如何在Spring Boot security中配置站点授权？[重复]

Question

我在Spring Boot安全方面遇到了一些授权问题。首先是在应用程序中。属性，我键入如下所示的角色查询，

# MySQL Queries for AuthenticationManagerBuilder
spring.queries.users-query = SELECT username, password, role FROM blog_user WHERE username=?
spring.queries.roles-query = SELECT username, role FROM blog_user WHERE username=?

我做了Spring Boot的安全配置

@Configuration
@EnableWebSecurity
public class BlogWebSecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired
    private DataSource dataSource;

    @Value("${spring.queries.users-query}")
    private String usersQuery;

    @Value("${spring.queries.roles-query}")
    private String rolesQuery;

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        // TODO Auto-generated method stub
        auth.jdbcAuthentication().usersByUsernameQuery(usersQuery).authoritiesByUsernameQuery(rolesQuery)
                .dataSource(dataSource).passwordEncoder(passwordEncoder());
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        // TODO Auto-generated method stub
        http.csrf().disable()
            .authorizeRequests()
                .antMatchers("/" ,"/home*", "/js/**", "/css/**", "/icon/**", "/users/login", "/users/register").permitAll()
                .antMatchers("/users", "/posts/create", "posts/view", "/tags/create").hasAnyRole("USER") // only .permitAll() method makes it work.
                .anyRequest().authenticated()
                .and() 
            .formLogin()
                .loginPage("/users/login").defaultSuccessUrl("/")
                .usernameParameter("username").passwordParameter("password")
                .and()
            .logout()
                .invalidateHttpSession(true)
                .clearAuthentication(true)
                .logoutSuccessUrl("/").and()
            .exceptionHandling().accessDeniedPage("/error/403");
    }

     @Bean 
     public PasswordEncoder passwordEncoder() {
         return new BCryptPasswordEncoder();
     }
}

。hasAnyRole（“用户”）行的效果不好。网站“/users”、“/posts/create”、“posts/view”、“/tags/create”抛出404个错误。我的意思是我的“用户”角色代码有一些问题。当我更改角色方法时。hasAnyRole（“用户”）到。permitAll（）方法，然后它就可以工作了。如何在系统中输入正确的授权角色代码？

Answer 1

blog_user表中role的值应该以role_作为前缀（即，它应该是role_user）。

Spring Security 4在检查hasRole（）时总是添加角色前缀。有关更多信息，请参阅Spring security 3至4迁移指南。