{"id":124764,"date":"2020-06-26T23:02:12","date_gmt":"2020-06-26T15:02:12","guid":{"rendered":"http:\/\/4563.org\/?p=124764"},"modified":"2020-06-28T07:11:55","modified_gmt":"2020-06-27T23:11:55","slug":"spring-security%ef%bc%8c%e6%9c%89%e6%b2%a1%e6%9c%89%e5%af%b9%e9%9c%80%e8%a6%81%e6%9d%83%e9%99%90%e6%8e%a7%e5%88%b6%e7%9a%84-url-%e5%ad%98%e5%85%a5%e6%95%b0%e6%8d%ae%e5%ba%93%e7%9a%84%e5%ae%9e%e7%8e%b0","status":"publish","type":"post","link":"http:\/\/4563.org\/?p=124764","title":{"rendered":"spring-security\uff0c\u6709\u6ca1\u6709\u5bf9\u9700\u8981\u6743\u9650\u63a7\u5236\u7684 url \u5b58\u5165\u6570\u636e\u5e93\u7684\u5b9e\u73b0\u3002"},"content":{"rendered":"
\n
\n
\n

spring-security\uff0c\u6709\u6ca1\u6709\u5bf9\u9700\u8981\u6743\u9650\u63a7\u5236\u7684 url \u5b58\u5165\u6570\u636e\u5e93\u7684\u5b9e\u73b0\u3002 <\/h1>\n

<\/p>\n

\n
\u8cc7\u6df1\u5927\u4f6c : zhaoxixiangban <\/span> <\/i> 6<\/span> <\/div>\n
<\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n
\u6211\u7528\u4e86 rabbitmq\uff0c\u83b7\u53d6\u65b9\u6cd5\u7684\u63a5\u53e3\u4fe1\u606f \u7136\u540e\u62fc\u63a5\u5b58\u5165\u6570\u636e\u5e93 <\/div>\n
\u5927\u4f6c\u6709\u8a71\u8aaa<\/b> (28<\/span>) <\/div>\n
<\/div>\n<\/p><\/div>\n<\/p><\/div>\n
    \n
  • \n
    \n
    \n
    \u8cc7\u6df1\u5927\u4f6c : admin7785 <\/span> <\/div>\n
    <\/i> <\/span> <\/div>\n<\/p><\/div>\n
    \u8003\u8651\u8fc7\u8fd9\u4e2a\u95ee\u9898\uff0c\u57fa\u4e8e\u94fe\u63a5\u7684\u6388\u6743\uff1a
    1. Spring Security \u4e2d\u8bbe\u7f6e\u6240\u6709 (\u67d0\u4e9b) \u94fe\u63a5\u90fd\u9700\u8981\u89d2\u8272 USER \u624d\u80fd\u8bbf\u95ee
    2. AuthenticationFilter \u83b7\u53d6\u7528\u6237\u767b\u5f55\u4fe1\u606f\u65f6 (\u57fa\u4e8e token) \u67e5\u8be2\u7528\u6237\u662f\u5426\u53ef\u4ee5\u8bbf\u95ee\u6b64\u94fe\u63a5\uff0c\u5982\u679c\u53ef\u4ee5\u8bbe\u7f6e\u89d2\u8272\u4e3a USER \u4f7f\u5f97\u5176\u6709\u6743\u8bbf\u95ee\uff0c\u5426\u5219\u8bbe\u7f6e\u4e3a\u6ca1\u6709\u6743\u9650\u7684\u7528\u6237\u89d2\u8272\u5982 NO \u5373\u53ef <\/div>\n<\/p><\/div>\n<\/li>\n
  • \n
    \n
    \n
    \u8cc7\u6df1\u5927\u4f6c : jorneyr <\/span> <\/div>\n
    <\/i> <\/span> <\/div>\n<\/p><\/div>\n
    \u4f60\u8fd9\u4e2a\uff0c\u53ef\u4ee5\u7528 PreAuth \u6ce8\u89e3\uff0c\u5728 el \u5f15\u7528\u4e00\u4e2a \u9a8c\u8bc1 bean \u5bf9\u73b0\u6709\u51ed\u636e\u8fdb\u884c\u62e6\u622a\u3002\u6211\u5f85\u4f1a\u5199\u4e00\u4e2a demo \u770b\u770b\u3002 <\/div>\n<\/p><\/div>\n<\/li>\n
  • \n
    \n
    \n
    \u8cc7\u6df1\u5927\u4f6c : siweipancc <\/span> <\/div>\n
    <\/i> <\/span> <\/div>\n<\/p><\/div>\n
    \u3002\u3002\u3002\u4e0d\u5c31\u662f\u63a5\u53e3\u7ea7\u6743\u9650\u4e48\uff0c\u7f51\u4e0a\u5b9e\u73b0\u5e94\u8be5\u5f88\u591a\u554a\u3002spring security \u91cc\u6709\u6388\u6743\u7ba1\u7406\u5668\uff0c\u81ea\u5df1\u91cd\u5199\u4e00\u904d\u8986\u76d6\u6389\u9ed8\u8ba4\u7684\u5c31\u884c\u4e86 <\/div>\n<\/p><\/div>\n<\/li>\n
  • \n
    \n
    \n
    \u8cc7\u6df1\u5927\u4f6c : skypyb <\/span> <\/div>\n
    <\/i> <\/span> <\/div>\n<\/p><\/div>\n
    \u5b9e\u73b0\u4e0d\u96be\uff0c\u4f46\u662f\u5b8c\u5168\u6ca1\u5fc5\u8981\u3002\u56fd\u5185\u5f88\u591a\u9700\u6c42\u90fd\u662f\u626f\u86cb\u7684\uff0c\u4e00\u822c\u9879\u76ee\u51e0\u79cd Role \u5c31\u57fa\u672c\u53ef\u4ee5\u4e86\u3002<\/p>\n

    \u4ee5\u524d\u4e00\u4e2a\u9879\u76ee\uff0c\u5ba2\u6237\u8981\u6c42\u5b9e\u73b0\u81ea\u5df1 \u4e00\u5957\u9897\u7c92\u5ea6\u5f88\u7ec6\u7684\u6743\u9650\u7ba1\u7406\uff0c\u81ea\u5df1\u53ef\u4ee5\u7f16\u8f91\u914d\u7f6e\u3002\u5b9e\u73b0\u8fc7\u7a0b\u8981\u82b1\u70b9\u65f6\u95f4\uff0c\u96be\u5ea6\u4e0d\u5927\uff0c\u5168\u90e8\uff08 API \u7684 URLPattern\uff0cHTTPMETHOD\uff0c\u4e00\u6761\u4e0d\u540c\u64cd\u4f5c\u5bf9\u5e94\u4e00\u6761\u6388\u6743 Permission \uff09\u4fdd\u5b58\u5230\u6570\u636e\u5e93\uff0c\u7528\u6237\u9875\u9762\u53ef\u4ee5\u6253\u5f00\u6388\u6743\uff0c\u6574\u9875\u9762\u90fd\u662f CheckBox \u7684 Permissions\uff0c\u5ba2\u6237\u770b\u5230\u90a3\u4e2a\u540e\u81ea\u5df1\u90fd\u6655\u4e86\uff0c\u611f\u89c9\u81ea\u5df1\u8822\u4e86\u3002 <\/p><\/div>\n<\/p><\/div>\n<\/li>\n

  • \n
    \n
    \n
    \u8cc7\u6df1\u5927\u4f6c : hantsy <\/span> <\/div>\n
    <\/i> <\/span> <\/div>\n<\/p><\/div>\n
    https:\/\/docs.spring.io\/spring-security\/site\/docs\/5.4.0-M1\/reference\/html5\/#el-access-web-beans
    `
    public class WebSecurity {
    public boolean check(Authentication authentication, HttpServletRequest request) {
    …
    }
    }
    You could refer to the method using:<\/p>\n

    <http>
    <intercept-url pattern=”\/user\/**”
    access=”@webSecurity.check(authentication,request)”\/>
    …
    <\/http>
    or in Java configuration<\/p>\n

    http
    .authorizeRequests(authorize -> authorize
    .antMatchers(“\/user\/**”).access(“@webSecurity.check(authentication,request)”)
    …
    )
    `
    Reactive \u5e94\u7528\u5c31\u66f4\u7b80\u5355
    `
    public SecurityWebFilterChain springSecurityFilterChain(ServerHttpSecurity http) {
    http
    .authorizeExchange()
    .pathMatchers(“\/api\/**”).access(customerAccessCheck)
    …
    return http.build();
    }
    ` <\/div>\n<\/p><\/div>\n<\/li>\n

  • \n
    \n
    \n
    \u8cc7\u6df1\u5927\u4f6c : ourslay <\/span> <\/div>\n
    <\/i> <\/span> <\/div>\n<\/p><\/div>\n
    \/\/ ———model
    @Entity
    @Data
    @Accessors(chain = true)
    public class AuthUrl implements Serializable {
    @Id
    @GeneratedValue
    private Long id;<\/p>\n

    private String url;<\/p>\n

    @ElementCollection
    private List<Long> uIds;
    }<\/p>\n

    \/\/ —– \u63a7\u5236\u5c42 @PreAuthorize(“@userProfileManager.currentUserAuthForUlr(authentication,httpServletRequest.requestURL.toString())”)
    @PutMapping(“password”)
    public ResponseEntity<String> changePassword(@RequestParam String newPassword, Authentication authentication) {
    profileManager.changePassword(newPassword, authentication);
    return ResponseEntity.ok(“success”);
    }<\/p>\n

    \/\/ ——– service
    public class UserProfileManager {
    \/\/ \u5404\u79cd\u6ce8\u5165
    public boolean currentUserAuthForUlr(Authentication authentication, String url) {
    Optional<UserProfile> optional = userProfileMapper.findOne(Example.of(new UserProfile().setEmail(authentication.getPrincipal().toString())));
    UserProfile profile = optional.orElseThrow(() -> new BadCredentialsException(“\u8bf7\u91cd\u65b0\u767b\u5f55”));
    AuthUrl authUrl = authUrlMapper.findOne(Example.of(new AuthUrl().setUrl(url))).orElse(null);
    if (authUrl == null) {
    return true;
    }
    List<Long> uIds = authUrl.getUIds();
    return uIds == null || uIds.isEmpty() || uIds.contains(profile.getId());
    }<\/p>\n

    public void changePassword(String newPassword, Authentication authentication) {
    Optional<UserProfile> optional = userProfileMapper.findOne(Example.of(new UserProfile().setEmail(authentication.getPrincipal().toString())));
    UserProfile profile = optional.orElseThrow(() -> new BadCredentialsException(“\u8bf7\u91cd\u65b0\u767b\u5f55”));
    String encode = passwordEncoder.encode(newPassword);
    profile.setPassword(encode);
    userProfileMapper.saveAndFlush(profile);
    }
    \/\/ **
    } <\/div>\n<\/p><\/div>\n<\/li>\n

  • \n
    \n
    \n
    \u8cc7\u6df1\u5927\u4f6c : siweipancc <\/span> <\/div>\n
    <\/i> <\/span> <\/div>\n<\/p><\/div>\n
    @hantsy \u4f60\u7684\u6743\u9650\u7cfb\u7edf\u7684\u601d\u8def\uff0c\u80fd\u8bf4\u660e\u4e00\u4e0b\u4e48\uff1f <\/div>\n<\/p><\/div>\n<\/li>\n
  • \n
    \n
    \n
    \u8cc7\u6df1\u5927\u4f6c : tctc4869 <\/span> <\/div>\n
    <\/i> <\/span> <\/div>\n<\/p><\/div>\n
    @skypyb #4 \u9700\u8981\u524d\u7aef\u8fdb\u884c\u81ea\u5b9a\u4e49\u914d\u7f6e\u89d2\u8272\u6743\u9650\u7684\uff0c\u7c7b\u4f3c\u4e94\u7684\u9700\u6c42\u3002- -\u00b7 \u6c57 \uff0c\u6240\u4ee5\u9700\u8981\u628a\u53ef\u914d\u7f6e\u7684\u6743\u9650\u90fd\u7ed9\u5230\u524d\u7aef <\/div>\n<\/p><\/div>\n<\/li>\n
  • \n
    \n
    \n
    \u4e3b<\/span> \u8cc7\u6df1\u5927\u4f6c : zhaoxixiangban <\/span> <\/div>\n
    <\/i> <\/span> <\/div>\n<\/p><\/div>\n
    \u76ee\u6d4b xy problem <\/div>\n<\/p><\/div>\n<\/li>\n
  • \n
    \n
    \n
    \u8cc7\u6df1\u5927\u4f6c : Vegetable <\/span> <\/div>\n
    <\/i> <\/span> <\/div>\n<\/p><\/div>\n
    @siweipancc #7 \u55ef \u73b0\u5728\u540e\u53f0\u6743\u9650\u8fd9\u8fb9\u95ee\u9898\u4e0d\u5927\uff0c\u50cf\u4e0a\u9762\u4e94\u8bf4\u7684\u7c7b\u4f3c\uff0c\u9700\u8981\u7528\u6237\u5bf9\u7ec6\u7c92\u5ea6\u7684\u6743\u9650\u8fdb\u884c\u81ea\u5b9a\u4e49\u914d\u7f6e\uff0c\u5c31\u9700\u8981\u6211\u4eec\u628a\u76f8\u5e94\u7684\u63a5\u53e3\u6570\u636e\u90fd\u5b58\u8d77\u6765\u7ed9\u524d\u7aef,\u63a5\u53e3\u5217\u8868\u6570\u636e\u8fd9\u90e8\u5206\u90fd\u662f\u600e\u4e48\u5b9e\u73b0\u7684\u5462\uff1f\u624b\u52a8\u52a0\u6570\u636e\u5e93\uff1f <\/div>\n<\/p><\/div>\n<\/li>\n
  • \n
    \n
    \n
    \u4e3b<\/span> \u8cc7\u6df1\u5927\u4f6c : zhaoxixiangban <\/span> <\/div>\n
    <\/i> <\/span> <\/div>\n<\/p><\/div>\n
    @hantsy #5 \u5bf9\u5c31\u662f\u8fd9\u79cd\u9700\u6c42 \uff0c\u64cd\u4f5c\u63a5\u53e3\u662f\u81ea\u5df1\u624b\u52a8\u52a0\u6570\u636e\u5e93\u5417 \"spring-security\uff0c\u6709\u6ca1\u6709\u5bf9\u9700\u8981\u6743\u9650\u63a7\u5236\u7684 <\/div>\n<\/p><\/div>\n<\/li>\n
  • \n
    \n
    \n
    \u4e3b<\/span> \u8cc7\u6df1\u5927\u4f6c : zhaoxixiangban <\/span> <\/div>\n
    <\/i> <\/span> <\/div>\n<\/p><\/div>\n
    @jorneyr #2
    @ourslay #6
    \u62b1\u6b49\u662f\u6211\u6ca1\u6709\u8bf4\u6e05\u695a \uff0c\u95ee\u9898\u70b9\u662f\u4e94\u9610\u8ff0\u7684\u8fd9\u79cd\u72b6\u51b5\u3002 <\/div>\n<\/p><\/div>\n<\/li>\n
  • \n
    \n
    \n
    \u4e3b<\/span> \u8cc7\u6df1\u5927\u4f6c : zhaoxixiangban <\/span> <\/div>\n
    <\/i> <\/span> <\/div>\n<\/p><\/div>\n
    @admin7785 #1 \u5177\u4f53\u600e\u4e48\u4e2a\u641e\u6cd5 \"spring-security\uff0c\u6709\u6ca1\u6709\u5bf9\u9700\u8981\u6743\u9650\u63a7\u5236\u7684 <\/div>\n<\/p><\/div>\n<\/li>\n
  • \n
    \n
    \n
    \u4e3b<\/span> \u8cc7\u6df1\u5927\u4f6c : zhaoxixiangban <\/span> <\/div>\n
    <\/i> <\/span> <\/div>\n<\/p><\/div>\n
    @zhaoxixiangban \u6211\u5efa\u8bae\u4f60\u4e0d\u8981\u8fd9\u4e48\u73a9\uff0c\u6700\u540e\u53cc\u5934\u5751\uff0c\u89d2\u8272\u6216\u8005\u7ec4\u8ddf\u6a21\u5757\u7ed1\u5b9a\u7684\u8bbe\u8ba1\u624d\u80fd\u7ee7\u7eed\u7ef4\u62a4\u3002 <\/div>\n<\/p><\/div>\n<\/li>\n
  • \n
    \n
    \n
    \u8cc7\u6df1\u5927\u4f6c : siweipancc <\/span> <\/div>\n
    <\/i> <\/span> <\/div>\n<\/p><\/div>\n
    \u624b\u52a8\u52a0\u6570\u636e\u5e93\uff0c\u7136\u540e\u52a0\u8f7d\u6743\u9650\u4fe1\u606f\u5230\u7528\u6237\uff0c\u6700\u540e\u914d\u7f6e\u5168\u5c40\u6743\u9650\u63a7\u5236\uff1b <\/div>\n<\/p><\/div>\n<\/li>\n
  • \n
    \n
    \n
    \u8cc7\u6df1\u5927\u4f6c : daimubai <\/span> <\/div>\n
    <\/i> <\/span> <\/div>\n<\/p><\/div>\n
    \u770b\u4e00\u4e0b\u6211\u7684\u5b9e\u73b0\uff0c\u53ef\u80fd\u6709 bug\uff0c\u4e0d\u8fc7\u53ef\u4ee5\u501f\u9274\u4e00\u4e0b\u3002https:\/\/github.com\/chenzhenjia\/niubi-commons\/blob\/master\/README.md <\/div>\n<\/p><\/div>\n<\/li>\n
  • \n
    \n
    \n
    \u8cc7\u6df1\u5927\u4f6c : zhenjiachen <\/span> <\/div>\n
    <\/i> <\/span> <\/div>\n<\/p><\/div>\n
    @ourslay URL \u6ca1\u6709\u52a8\u6001\u914d\u7f6e\u3002
    @siweipancc \u5f88\u597d\u7684\u5229\u7528 Spring Security \u66f4\u7b80\u5355\u3002
    @zhaoxixiangban @tctc4869
    \u601d\u8def\uff1a
    1\uff0c \u6743\u9650\u5b9a\u4e49\u7528\u4e00\u4e2a\u8868\uff08 JPA Entity \uff09\uff0c\u7c7b\u4f3c\u7ed3\u6784\uff1a
    name \u552f\u4e00\uff0c\u53e6\u5916\uff08 urlPattern \u4e0e httpMethod \uff09\u7ec4\u5408\u552f\u4e00\u3002<\/p>\n

    Permission{
    name\/\/\u552f\u4e00\uff0c\u6bd4\u5982 PERM_GET_ALL_POSTS
    urlPattern\/\/\u6bd4\u5982\uff1a\/posts\/*
    httpMethod\/\/ \u6bd4\u5982\uff1aGET\uff0c \u53ef\u7528 enum \u6216\u76f4\u63a5\u7528 Spring web HttpMethod. \u5e38\u7528\u7684\u6709 GET,POST,PUT,DELETE,PATCH
    longDescription\/\/\u5176\u5b83\u8f85\u52a9\u8bf4\u660e\uff08\u7528\u4e8e\u9875\u9762\u8865\u5145\uff09
    }<\/p>\n

    \u90a3\u4e48 user \u4e0e Permission \u6743\u9650\u5173\u7cfb\uff1a
    user->permission 1:n<\/p>\n

    2. Repository \u7c7b\uff0cPermissionRepository
    3. Spring Security \u4e2d\u76f4\u63a5\u4f7f\u7528 Apply \u3002<\/p>\n

    allPermissions= permissionRepository.findAll(Sort.by(…)) <\/p>\n

    http
    .authorizeRequests(authorize ->
    allPermissions.forEach(perm->{
    authorize
    .antMatchers(per.urlPattern, per.httpMethod).hasAuthority(perm.name)\/\/\u8fd9\u91cc\u67e5 Spring Security \u6587\u6863\uff0c\u6211\u8bb0\u5f97\u4ee5\u524d\u4e0d\u7528 AntMatcher\uff0c\u800c\u4f7f\u7528 RegexMatcher\uff0c\u8868\u8fbe\u6bd4 ANT \u65b9\u5f0f\u66f4\u4e30\u5bcc\u3002
    })<\/p>\n

    4. \u914d\u7f6e\u4e00\u4e2a\u8d85\u7ea7\u7ba1\u7406\u5458\uff0c\u7ed5\u8fc7\u6240\u6709\u6743\u9650\uff08\u4e0d\u8bfb\u6570\u636e\u5e93\uff09\uff0c\u53ef\u4ee5\u7ef4\u62a4\u7cfb\u7edf\u7684 permission \u5217\u8868\u3002
    \u9ed8\u8ba4\u7ed9\u5b9a\u4e00\u4e2a\u7ba1\u7406\u5458\uff0c\u914d\u7f6e\u6240\u6709\u6743\u9650\u3002\u7ba1\u7406\u5458\u53ef\u4ee5\u7528\u7ba1\u7406\u7528\u6237\uff0c\u53ef\u4ee5\u7ba1\u7406\u7528\u6237\u6743\u9650\uff08\u9875\u9762\u53ef\u4ee5\u662f Checkbox\uff0c\u6216\u8005\u4e24\u5217\u9009\u62e9\uff0c\u7b49\uff09\uff0c\u6700\u7ec8\u5f71\u54cd user -> permission \u5173\u7cfb\u8868\u3002
    \u6240\u6709\u65b0\u6ce8\u518c\u7528\u6237\u9ed8\u8ba4\u5e94\u8be5\u534f\u5546\u597d\uff0c\u5e94\u8be5\u7ed9\u90a3\u4e9b\u6743\u9650\uff0c\u53ef\u4ee5\u8bbe\u8ba1\u4e00\u4e9b DUMMY \u6743\u9650\u6bd4\u5982 READ\uff0c\u90a3\u4e48\u5728 persmission \u8868\u6240\u6709 httpmethod GET \u6743\u9650\u5c31\u62ff\u5230\u4e86\uff08 UserDetailsService \u4e2d\u8f6c\u6362\u6210\u5b9e\u9645 permissions \u7684 Authories \uff09\u3002
    5. \uff08\u6269\u5c55\uff09 \u6240\u6709\u6743\u9650\u7684\u521d\u59cb\u6570\u636e\u53ef\u4ee5\u7528 Reflection \u751f\u6210\uff0c\u5728\u7cfb\u7edf\u542f\u52a8\u65f6\u521d\u59cb\u5316(\u6dfb\u52a0\uff0c\u66f4\u65b0)\u3002
    6. \uff08\u6269\u5c55\uff09 \u53ef\u4ee5\u6dfb\u52a0 Role\uff0crole->Permission \u53ef\u4ee5\u662f\u4e00\u5bf9\u591a\u7684\u5173\u7cfb, \u76f8\u5f53\u4e8e\u6743\u9650\u5206\u7ec4\u4e86\u3002\u5728 UserDetailsService \u7684 findByusername \u5c06\u6240\u6709\u7684 Role \u8f6c\u6362\u6210 Permission \u6dfb\u52a0\u5230 authories \u4e2d\uff08\u56e0\u4e3a\u4e0a\u9762\u7684 Spring Security \u4e2d\u53ea\u914d\u7f6e\u6bd4\u8f83 Permission \uff09\u3002\u8fd9\u6837\u7684\u8bdd\uff0c\u6570\u636e\u5e93\u5173\u7cfb\u53d8\u6210 user->role>permission 1:n,1:n \u3002
    7. \uff08\u6269\u5c55) \u6240\u6709\u524d\u7aef\u7684\u6743\u9650\u53ef\u4ee5\u767b\u5f55\u65f6\u62ff\u5230\u4e00\u4e2a\u4e2a\u4eba\u7684\u5141\u8bb8\u7684 permission \u5217\u8868\uff0c\u53ef\u4ee5\u7528\u6765\u8f85\u52a9\u524d\u7aef\u7684\u9875\u9762\u63a7\u5236\u3002\u6bd4\u5982\u6ca1\u6709\u6388\u6743 PERM_GET_ALL_POSTS \u7684\u65f6\u5019\uff0c\u53ef\u4ee5\u4ece\u9875\u9762\u628a\u9876\u7ea7\u83dc\u5355\u4e0a\u7684 posts \u53bb\u6389\u4e86\u3002API \u8d44\u6e90\u672c\u8eab\u5c31\u662f\u53ef\u4ee5\u5f52\u7c7b\u7684\uff0c\u6211\u4ece\u6765\u6ca1\u7528\u8fc7 V \u7ad9\u90a3\u4e9b\u8d44\u6e90\u5171\u4eab\u7248\u672c\u4e2d\u8d34\u7684\u90a3\u4e9b\u4ec0\u4e48\u529f\u80fd\u6a21\u5757\u4e0e\u6743\u9650\u914d\u7f6e\u8868\u3002<\/p>\n

    \u6211\u9075\u5faa\u7684\u4e00\u4e2a\u539f\u5219\uff0c\u7528\u6237\u7ec6\u7c97\u5ea6\u7684\u884c\u4e3a\uff08\u4e00\u4e2a\u70b9\u51fb\uff0c\u4e00\u4e2a\u64cd\u4f5c\uff09\u5728\u4e00\u4e2a\u5e94\u7528\u7a0b\u5e8f\u4e2d\u57fa\u672c\u662f\u53ef\u4ee5\u56fa\u5b9a\u4e0b\u6765\u7684\u3002\u6240\u4ee5 \u6bcf\u4e00\u4e2a\u4e0d\u540c\u64cd\u4f5c\u6700\u7ec8\u53d8\u6210\u4e00\u4e2a\u4e0d\u540c\u7684\u6743\u9650\uff0cPermission \u5728\u4f60\u7684\u9879\u76ee(\u5e94\u7528)\u4e0a\u7ebf\u65f6\u5019\uff0c\u57fa\u672c\u53ef\u4ee5\u662f\u56fa\u5b9a\u4e0b\u6765\u7684\uff0c\u800c Role \u5b8c\u5168\u53ef\u4ee5\u7531\u7528\u6237\u968f\u4fbf\u6dfb\u52a0\uff0c\u968f\u610f\u4fee\u6539\u3002 <\/p><\/div>\n<\/p><\/div>\n<\/li>\n

  • \n
    \n
    \n
    \u8cc7\u6df1\u5927\u4f6c : hantsy <\/span> <\/div>\n
    <\/i> <\/span> <\/div>\n<\/p><\/div>\n
    user->permission\uff0cuser->role>permission \u5e94\u8be5\u90fd\u662f n:m \u591a\u5bf9\u591a\u3002 <\/div>\n<\/p><\/div>\n<\/li>\n
  • \n
    \n
    \n
    \u8cc7\u6df1\u5927\u4f6c : hantsy <\/span> <\/div>\n
    <\/i> <\/span> <\/div>\n<\/p><\/div>\n
    \u56de\u5230\u4e4b\u524d\u7684\u89c2\u70b9\uff1a\u5b8c\u5168\u6ca1\u5fc5\u8981\u8fd9\u6837\u7075\u6d3b\u8bbe\u8ba1\u3002\u4e4b\u524d\u52a0\u4e86 ROLE \u4e4b\u540e \uff0cROLE A \u5305\u542b\u4e86 perm a, ROLE B \u6ca1\u6709\u5305\u542b perm a \u3002\u90a3\u4e48\u95ee\u9898\uff0c\u9047\u5230\u5ba2\u6237\u4e00\u4e2a\u7528\u6237\u6dfb\u52a0\u4e86 A,B\uff0c\u5b83\u89c9\u5f97\u83ab\u540d\u5176\u5999\u7684\u6765\u4e86\uff0c\u4e3a\u4ec0\u4e48 ROLE B \u6ca1\u6709 perm a\uff0c\u6211\uff08\u7528\u6237\uff09\u5374\u6709 perm a \u3002\u90a3\u4e48\u66f4\u590d\u6742\u7684\u95ee\u9898\u6765\u4e86\uff0c\u5f53\u4e00\u4e2a\u7528\u6237\u8bbe\u7f6e\u4e86 ROLE, A\uff0cB\uff0cC\uff0cD\uff0c\u90a3\u4e48\u662f\u4e0d\u662f\u8981\u7528\u6237\u53bb\u51b3\u5b9a A\uff0cB\uff0cC\uff0cD \u4e4b\u95f4\u7684\u6743\u9650\u662f\u7ee7\u627f\u8fd8\u662f\u8986\u76d6\u5173\u7cfb\uff1f\uff1f\uff1f<\/p>\n

    \u8fd9\u79cd\u7075\u6d3b\u8bbe\u8ba1\uff0c\u5bf9\u7528\u6237\u548c\u5f00\u53d1\u4eba\u5458\u90fd\u662f\u4f5c\u8327\u81ea\u7f1a\uff0c\u7528\u5904\u4e0d\u5927\uff0c\u6280\u672f\u6ca1\u542b\u91cf\uff0c\u5f88\u8d39\u4e8b\u3002\u57fa\u672c\u8fc7\u53bb\u5341\u51e0\u5e74\u7684\u9879\u76ee\u7ecf\u9a8c\u53ef\u4ee5\u80af\u5b9a\u7684\u8bf4\uff0c\u57fa\u672c\u4e0a\u90fd\u662f\u53ef\u4ee5\u56fa\u5b9a\u7684 ROLE \u641e\u5b9a\uff0c\u7ed3\u679c\u5927\u91cf\u7684\u65f6\u95f4\u53bb\u5f00\u53d1\u6240\u6709\u6743\u9650\u7cfb\u7edf\u3002\u4e3a\u4ec0\u4e48\u7528\u6237\u4f1a\u5f3a\u8c03 ROLE \u8981\u7075\u6d3b\u914d\u7f6e\uff0c\u8bf4\u767d\u4e86\u4e00\u70b9\uff0c\u4ece\u9700\u6c42\u89d2\u5ea6\u6765\u5206\u6790\uff0c\u5c31\u662f\u5b83\u81ea\u5df1\u9700\u6c42\u4e0d\u786e\u5b9a\uff0c\u4e0d\u77e5\u9053\u8981\u505a\u4ec0\u4e48\u4e1c\u897f\u3002 <\/p><\/div>\n<\/p><\/div>\n<\/li>\n

  • \n
    \n
    \n
    \u8cc7\u6df1\u5927\u4f6c : hantsy <\/span> <\/div>\n
    <\/i> <\/span> <\/div>\n<\/p><\/div>\n
    \u770b keycloak \u7684\u7ec6\u7c92\u5ea6\u6743\u9650\u63a7\u5236 <\/div>\n<\/p><\/div>\n<\/li>\n
  • \n
    \n
    \n
    \u8cc7\u6df1\u5927\u4f6c : zzl22100048 <\/span> <\/div>\n
    <\/i> <\/span> <\/div>\n<\/p><\/div>\n
    @zzl22100048 Keycloak \u63a8\u8350\u8fc7\u597d\u591a\u6b21\u4e86\u3002\u56fd\u5185\u6ca1\u51e0\u4e2a\u4eba\u7528\u7684\uff0c\u5728 V \u7ad9\u770b\u5230\u7684\u4eba\u90fd\u662f\u89c9\u5f97\u81ea\u5df1\u5f00\u53d1\u7684\u6743\u9650 \/\u5b89\u5168\u7cfb\u7edf\u6700\u597d\u7684\u3002 <\/div>\n<\/p><\/div>\n<\/li>\n
  • \n
    \n
    \n
    \u8cc7\u6df1\u5927\u4f6c : hantsy <\/span> <\/div>\n
    <\/i> <\/span> <\/div>\n<\/p><\/div>\n
    @hantsy \u95ee\u4e00\u4e0b\uff0cABAC \u4e0e RBAC \u4e24\u79cd\u6743\u9650\u6a21\u578b\uff0c\u6709\u4ec0\u4e48\u672c\u8d28\u533a\u522b\u4e48\uff1f\u6ca1\u7528\u8fc7 ABAC \u6743\u9650\u6a21\u578b\uff0c\u6211\u76ee\u524d\u63a5\u89e6\u5230\u7684\u6743\u9650\u4f53\u7cfb\u5c31\u662f\u5173\u4e8e RBAC \u7684\uff0c\u6709\u535a\u5ba2\u8bf4 ABAC \u7684\u6743\u9650\u914d\u7f6e\u6bd4 RBAC \u66f4\u7075\u6d3b\uff0c\u914d\u7f6e\u6743\u9650\u4e5f\u66f4\u590d\u6742\u3002\u5230\u5e95\u662f\u600e\u4e48\u6837\u7684\u5462\uff1f <\/div>\n<\/p><\/div>\n<\/li>\n
  • \n
    \n
    \n
    \u8cc7\u6df1\u5927\u4f6c : tctc4869 <\/span> <\/div>\n
    <\/i> <\/span> <\/div>\n<\/p><\/div>\n
    @hantsy \u6d4f\u89c8\u4e86\u5f88\u591a\u6709\u5173\u6743\u9650\u7cfb\u7edf\u7684\u8bf4\u660e\u535a\u5ba2\uff0c\u5173\u4e8e ABAC \u6743\u9650\u4f53\u7cfb\uff0c\u5982\u679c\u8981\u5728\u7528\u9014\u5f52\u7eb3\u8d77\u6765\uff0c\u6211\u611f\u89c9\u5c31\u662f\u57fa\u4e8e\u5e73\u53f0\u5e94\u7528\u7ea7\u522b\u7684\u6743\u9650\u7cfb\u7edf\uff0c\u4e0d\u540c\u7684\u7ec4\u7ec7\uff0c\u5728\u8fd9\u4e2a\u5e73\u53f0\u4e0a\uff0c\u53ef\u4ee5\u6709\u4e0d\u4e00\u6837\u7684\u6743\u9650\u4f53\u7cfb\u3002\u81f3\u5c11\u6bcf\u4e2a\u7ec4\u7ec7\u5bf9\u5185\u6743\u9650\u4f53\u7cfb\uff0c\u53ef\u4ee5\u4e0d\u4e00\u6837\u3002\u800c RBAC \u6743\u9650\u6a21\u578b\u505a\u4e0d\u5230\u8fd9\u4e00\u70b9\uff0c\u6216\u8005\u8bf4\u5f88\u56f0\u96be\uff0c\u81f3\u5c11\u5982\u679c\u6709\u4e24\u4e2a\u5ba2\u6237\u7fa4\u4f53\u5bf9\u5185\u6709\u4e0d\u4e00\u6837\u7684\u6743\u9650\u9700\u6c42\uff0cRBAC \u5b9e\u73b0\u8d77\u6765\u5c31\u4f1a\u5f88\u56f0\u96be\u3002\u662f\u8fd9\u6837\u7684\u4e48\uff1f\u6bd4\u5982\u505a\u4e00\u4e2a\u9762\u5411\u591a\u4f01\u4e1a\u5ba2\u6237\u7ea7\u522b\u7684\u5e73\u53f0\u5e94\u7528\uff0c\u90a3\u4e48\u6743\u9650\u7cfb\u7edf\u91c7\u7528 ABAC \u662f\u6700\u5408\u9002\u7684\u4e48 <\/div>\n<\/p><\/div>\n<\/li>\n
  • \n
    \n
    \n
    \u8cc7\u6df1\u5927\u4f6c : tctc4869 <\/span> <\/div>\n
    <\/i> <\/span> <\/div>\n<\/p><\/div>\n
    \u8fd9\u4e2a\u81ea\u5df1 Google \u4e0b\u5427\uff0chttps:\/\/www.dnsstuff.com\/rbac-vs-abac-access-control#rbac-vs-abac
    \u6211\u53ea\u5173\u6ce8\u8fc7 RBAC\uff0c\u4f3c\u4e4e Java EE \u6807\u51c6\u4f53\u7cfb\u4e5f\u53ea\u6709\u57fa\u4e8e ROLE \uff08\u548c Group\uff0c\u540c\u7b49 ROLE \uff09\u7684\u8bbe\u8ba1\u3002 <\/div>\n<\/p><\/div>\n<\/li>\n
  • \n
    \n
    \n
    \u8cc7\u6df1\u5927\u4f6c : hantsy <\/span> <\/div>\n
    <\/i> <\/span> <\/div>\n<\/p><\/div>\n
    ABAC \u770b\u4ecb\u7ecd\u8fd9\u53ea\u662f\u66f4\u7ec6\u4e00\u4e9b\uff0c\u800c\u4e14\u662f\u53e6\u5916\u4e00\u4e2a\u65b9\u5411\u3002
    RBAC \u4ee5 ROLE\uff0c\u884c\u4e3a\uff08\u6743\u9650\uff09\u4e3a\u57fa\u7840\u7684\u3002<\/p>\n

    ABAC \u66f4\u7684\u591a\u5173\u6ce8\u5bf9\u4e00\u4e2a\u8d44\u6e90\u7684\u4e2a\u522b\u5c5e\u6027\u7684\u8bbf\u95ee\u63a7\u5236\u6743\u9650\uff0c\u66f4\u7ec6\u7684\u63a7\u5236\u3002\u8fd9\u4e2a\u9664\u975e\u662f\u57fa\u4e8e\u4f20\u7edf\u6570\u636e\u6a21\u578b\u7684\u7684\u5f00\u53d1\uff0c\u6bd4\u5982\u4f20\u7edf\u7684 MIS \u4e4b\u7c7b\u7684\u7cfb\u7edf\u3002\u6211\u89c9\u5f97\u7528\u5728 API \u7684\u63a7\u5236\u4e0d\u5927\u53ef\u80fd \u3002\u4f20\u7edf\u57fa\u4e8e\u6570\u636e\u7684\u5f00\u53d1\uff0c\u5b9e\u73b0\u4e5f\u4e0d\u96be\u3002\u4ee5\u524d\u7684 JBoss \u4e0b\u7684 http:\/\/picketlink.org\/ \u5e94\u8be5\u76f8\u5e94\u7684\u65b9\u6848\uff0c\u8bb0\u5f97\u89c1\u8fc7\u4e86\u3002\u6570\u636e\u6a21\u578b\uff0c\u6bd4\u5982 JPA Entity\uff0c\u6bcf\u4e2a\u5c5e\u6027\u7528\u67d0\u4e2a Annotation \u6807\u6ce8\uff0c\u5168\u90e8\u8fd0\u884c\u65f6\u53ef\u4ee5\u63d0\u53d6\u51fa\u6765 \uff0c\u4e00\u6837\u53ef\u4ee5\u5b58\u653e\u5728\u6570\u636e\u5e93\u6216\u8005\u57fa\u4e8e LDAP \u8fd9\u79cd\u5c42\u5c42\u76ee\u5f55\u8bbf\u95ee\u7684\u65b9\u5f0f \uff0c\u7136\u540e\u5269\u4e0b\u5c31\u662f\u5c31\u662f\u5728\u6570\u636e CRUD \u64cd\u4f5c\u4e0b\u63a7\u5236\u4e86\u3002 <\/p><\/div>\n<\/p><\/div>\n<\/li>\n

  • \n
    \n
    \n
    \u8cc7\u6df1\u5927\u4f6c : hantsy <\/span> <\/div>\n
    <\/i> <\/span> <\/div>\n<\/p><\/div>\n
    @tctc4869 \u5f88\u591a\u65f6\u5019\u9762\u5bf9\u5ba2\u6237\uff0c\u53ea\u662f\u628a\u6709\u4e9b\u4e1c\u897f\u5728\u8111\u5b50\u91cc\u9762\u60f3\u5f97\u592a\u590d\u6742\u3002\u4e2d\u56fd\u4eba\u8fd9\u79cd\u7ec6\u7c92\u5ea6\u7684\u63a7\u5236\uff0c\u8bf4\u767d\u4e86\u4e5f\u662f\u6211\u4eec\u6587\u5316\u7684\u4e00\u90e8\u5206\uff0c\u63a7\u5236\u6b32\u592a\u5f3a\u4e86\u3002\u56fd\u5916\u89d2\u8272\u66f4\u591a\u662f\u7cfb\u7edf\u4e0a\u7684\u5206\u5de5\uff0c\u56fd\u5185\u7684\u8bb2\u6743\u9650\uff08\u5b9e\u9645\u56fd\u5185\u5ba2\u6237\u5f88\u5c11\u8ddf\u8c08\u89d2\u8272\u8fd9\u4e2a\u8bcd\uff0c\u5f88\u591a\u6ca1\u6709\u89d2\u8272\u8fd9\u4e2a\u6982\u5ff5\uff09\u66f4\u591a\u7684\u8bb2\u64cd\u63a7\u4e0a\u7684\u6743\u529b\uff0c\u53ef\u4ee5\u6388\u6743\uff0c\u53ef\u4ee5\u53d6\u6d88\u6388\u6743\u3002<\/p>\n

    \u5176\u5b9e\u53ea\u8981\u5f04\u6e05\u695a\uff0c\u5f52\u7c7b\u51fa\u6765\u6709\u51e0\u79cd\u4eba\u53ef\u4ee5\u7528\u8fd9\u4e2a\u7cfb\u7edf\uff08\u5e94\u7528\uff09\uff0c\u89d2\u8272\u5c31\u53ef\u4ee5\u6ee1\u8db3\u3002\u6b27\u7f8e\u7684\u9879\u76ee\u6211\u505a\u5f88\u591a\uff0c\u6709\u7535\u5546\uff0c\u6709\u652f\u4ed8\uff0c\u6ca1\u6709\u4e00\u4e2a\u8981\u8fd9\u4e2a\u79cd\u6743\u9650\u914d\u7f6e\u7cfb\u7edf \u3002\u6709\u4e9b\u9879\u76ee\uff0c\u4eba\u5bb6\u4e00\u5f00\u59cb\u9700\u6c42\u5c31\u5f88\u660e\u786e\u7684\u63d0\u51fa\u4e86\u6709\u51e0\u79cd\u4eba\u7528\u8fd9\u4e2a\u7cfb\u7edf\uff0c\u64cd\u4f5c\u65b9\u5f0f\u4e0a\u6709\u5e94\u8be5\u4ec0\u4e48\u5dee\u522b\u3002 <\/p><\/div>\n<\/p><\/div>\n<\/li>\n

  • \n
    \n
    \n
    \u8cc7\u6df1\u5927\u4f6c : hantsy <\/span> <\/div>\n
    <\/i> <\/span> <\/div>\n<\/p><\/div>\n
    @hantsy \u90a3\u6211\u6709\u53e6\u4e00\u4e2a\u95ee\u9898\uff0c\u5982\u679c\u6709\u4e00\u4e2a\u9879\u76ee\uff0c\u8981\u9762\u5411\u4e0d\u540c\u7c7b\u578b\u7684\u5ba2\u6237\u7fa4\u4f53\uff0c\u800c\u4e14\u53ef\u80fd\u6bcf\u4e2a\u5ba2\u6237\u7fa4\u4f53\u5185\u90e8\u6709\u4e0d\u4e00\u6837\u7684\u6743\u9650\u9700\u6c42\u3002\u8fd9\u4e2a\u65f6\u5019\u6743\u9650\u7cfb\u7edf\u8981\u600e\u4e48\u914d\u7f6e\uff0c\u82e5\u662f\u5728 rbac \u6743\u9650\u4f53\u7cfb\u4e0b\uff0c\u662f\u8fdb\u884c\u89d2\u8272\u5206\u7c7b\u4e0a\u7684\u4e0d\u540c\u7684\u5ba2\u6237\u5173\u7cfb\u6269\u5c55\uff0c\u8fd8\u5728\u91cd\u65b0\u505a\u9488\u5bf9\u5ba2\u6237\u9700\u6c42\u7684\u4e00\u5957\u5e94\u7528\uff1f\u8fd8\u662f\u7528 abac \u6a21\u578b\u4f53\u7cfb\u4e0b\u8bbe\u8ba1\u5462\uff1f <\/div>\n<\/p><\/div>\n<\/li>\n
  • \n
    \n
    \n
    \u8cc7\u6df1\u5927\u4f6c : tctc4869 <\/span> <\/div>\n
    <\/i> <\/span> <\/div>\n<\/p><\/div>\n
    \u4e1a\u52a1\u76f8\u5173\u7684\u6743\u9650\u672c\u8eab\u5c31\u548c\u5f00\u516c\u7684\u4e00\u4e9b\u6743\u9650\u6807\u51c6\uff08\u89c4\u8303\u7b49\uff09\u6ca1\u592a\u5927\u7684\u5173\u7cfb\uff0c\u81ea\u5df1\u6839\u636e\u4e1a\u52a1\u9700\u6c42\u51b3\u5b9a\u4e86\u3002 <\/div>\n<\/p><\/div>\n<\/li>\n
  • \n","protected":false},"excerpt":{"rendered":"

    spring-security\uff0c\u6709…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[],"tags":[],"_links":{"self":[{"href":"http:\/\/4563.org\/index.php?rest_route=\/wp\/v2\/posts\/124764"}],"collection":[{"href":"http:\/\/4563.org\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/4563.org\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/4563.org\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/4563.org\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=124764"}],"version-history":[{"count":1,"href":"http:\/\/4563.org\/index.php?rest_route=\/wp\/v2\/posts\/124764\/revisions"}],"predecessor-version":[{"id":124767,"href":"http:\/\/4563.org\/index.php?rest_route=\/wp\/v2\/posts\/124764\/revisions\/124767"}],"wp:attachment":[{"href":"http:\/\/4563.org\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=124764"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/4563.org\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=124764"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/4563.org\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=124764"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}