SpringSecurity实战教程（六）基于数据库的ABAC属性权限模型实战开发

1
        <!--Lombok-->
2
        <dependency>
3
            <groupId>org.projectlombok</groupId>
4
            <artifactId>lombok</artifactId>
5
            <scope>provided</scope>
6
        </dependency>
7
        <!--使用 HikariCP 连接池-->
8
        <dependency>
9
            <groupId>org.springframework.boot</groupId>
10
            <artifactId>spring-boot-starter-data-jpa</artifactId>
11
        </dependency>
12
        <!-- mysql驱动 -->
13
        <dependency>
14
            <groupId>mysql</groupId>
15
            <artifactId>mysql-connector-java</artifactId>
16
            <version>8.0.30</version>
17
        </dependency>
18
        <!-- mybatis-plus -->
19
        <dependency>
20
            <groupId>com.baomidou</groupId>
21
            <artifactId>mybatis-plus-spring-boot3-starter</artifactId>
22
            <version>3.5.9</version>
23
        </dependency>

1
server:
2
  port: 8084
3

4
spring:
5
  application:
6
    name: abac-spring-security # 最新Spring Security实战教程（六）基于数据库的ABAC属性权限模型实战开发
7
  datasource:
8
    url: jdbc:mysql://localhost:3306/slave_db?useSSL=false&serverTimezone=UTC
9
    username: root
10
    password: root
11
    driver-class-name: com.mysql.cj.jdbc.Driver
12
    hikari:
13
      maximum-pool-size: 5
14

15
mybatis-plus:
16
  configuration:
17
    map-underscore-to-camel-case: true # 开启驼峰转换
18
    log-impl: org.apache.ibatis.logging.stdout.StdOutImpl # 打印SQL
19
    cache-enabled: true # 开启二级缓存
20
  global-config:
21
    db-config:
22
      logic-delete-field: delFlag # 逻辑删除字段
23
      logic-delete-value: 1 # 删除值
24
      logic-not-delete-value: 0 # 未删除值

1
@Mapper
2
public interface UserMapper extends BaseMapper<SysUser> {
3

4
    @Select("SELECT r.* FROM sys_role r " +
5
            "JOIN sys_user_role ur ON r.role_id = ur.role_id " +
6
            "WHERE ur.user_id = #{userId}")
7
    @Results({
8
            @Result(property = "roleId", column = "role_id"),
9
            @Result(property = "menus", column = "role_id",
10
                    many = @Many(select = "com.toher.springsecurity.demo.abac.mapper.MenuMapper.selectByUserId"))
11
    })
12
    List<SysRole> selectRolesByUserId(Long userId);
13

14
    /**
15
     * 获取用户属性
16
     * @param userId
17
     * @return
18
     */
19
    @Select("SELECT * FROM sys_user_attr WHERE user_id = #{userId}")
20
    List<SysUserAttr> selectUserAttrByUserId(Long userId);
21
}

1
@Service
2
@RequiredArgsConstructor
3
public class UserDetailsServiceImpl implements UserDetailsService {
4

5
    private final UserMapper userMapper;
6
    private final RoleMapper roleMapper;
7

8
    @Override
9
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
10

11
        // 1. 查询基础用户信息
12
        LambdaQueryWrapper<SysUser> wrapper = new LambdaQueryWrapper<>();
13
        wrapper.eq(SysUser::getUsername, username);
14
        SysUser user = userMapper.selectOne(wrapper);
15

16
        if (user == null) {
17
            throw new UsernameNotFoundException("用户不存在");
18
        }
19

20
        // 2. 加载角色和权限
21
        List<SysRole> roles = userMapper.selectRolesByUserId(user.getUserId());
22
        roles.forEach(role ->
23
                role.setMenus(roleMapper.selectMenusByRoleId(role.getRoleId()))
24
        );
25
        user.setRoles(roles);
26

27
        // 3. 检查账户状态
28
        if (!user.isEnabled()) {
29
            throw new DisabledException("用户已被禁用");
30
        }
31

32
        // 4. 用户的属性集合，用于 ABAC 动态权限评估
33
        List<SysUserAttr> attrs = userMapper.selectUserAttrByUserId(user.getUserId());
34
        // 转成map集合
35
        user.setAttrs(attrs.stream()
36
                .collect(Collectors.toMap(SysUserAttr::getAttrKey, SysUserAttr::getAttrValue)));
37
        return user;
38
    }
39
}

1
@Component
2
public class AbacDecisionEngine {
3
    private final SpelExpressionParser parser = new SpelExpressionParser();
4

5
    @Autowired
6
    private SysPolicyMapper sysPolicyMapper;
7

8
    public boolean check(Authentication authentication, String resource) {
9
        SysUser userDetails = (SysUser) authentication.getPrincipal();
10

11
        // 加载策略集
12
        LambdaQueryWrapper<SysPolicy> queryWrapper = new LambdaQueryWrapper<>();
13
        queryWrapper.eq(SysPolicy::getTargetResource, resource);
14
        List<SysPolicy> policies = sysPolicyMapper.selectList(queryWrapper);
15
        if (policies.isEmpty()) {
16
            return false;
17
        }
18

19
        // 构建评估上下文
20
        EvaluationContext context = new StandardEvaluationContext();
21
        // 将用户传入表达式上下文 如：#user.attrs['department'] == 'IT'
22
        // 其中user前缀就是我们传入的user
23
        context.setVariable("user", userDetails);
24
        return policies.stream().allMatch(policy ->
25
                parser.parseExpression(policy.getConditionExpression()).getValue(context, Boolean.class)
26
        );
27
    }
28
}

1
@RequiredArgsConstructor
2
public class AbacPermissionEvaluator implements PermissionEvaluator {
3

4
    private final AbacDecisionEngine abacEngine;
5

6
    @Override
7
    public boolean hasPermission(Authentication auth, Object targetDomainObject, Object permission) {
8
        return abacEngine.check(auth, (String) permission);
9
    }
10

11
    @Override
12
    public boolean hasPermission(Authentication authentication, Serializable targetId, String targetType, Object permission) {
13
        // 本示例仅实现 hasPermission(Authentication, Object, Object)
14
        return false;
15
    }
16
}

1
@Component("authz")
2
@RequiredArgsConstructor
3
public class AuthorizationLogic {
4

5
    private final SpelExpressionParser parser = new SpelExpressionParser();
6
    private final SysPolicyMapper sysPolicyMapper;
7

8
    public boolean check(MethodSecurityExpressionOperations operations, String permission) {
9
        SysUser userDetails = (SysUser) operations.getAuthentication().getPrincipal();
10

11
        // 加载策略集
12
        LambdaQueryWrapper<SysPolicy> queryWrapper = new LambdaQueryWrapper<>();
13
        queryWrapper.eq(SysPolicy::getTargetResource, permission);
14
        List<SysPolicy> policies = sysPolicyMapper.selectList(queryWrapper);
15
        if (policies.isEmpty()) {
16
            return false;
17
        }
18

19
        // 构建评估上下文
20
        EvaluationContext context = new StandardEvaluationContext();
21
        // 将用户传入表达式上下文 如：#user.attrs['department'] == 'IT'
22
        // 其中user前缀就是我们传入的user
23
        context.setVariable("user", userDetails);
24
        return policies.stream().allMatch(policy ->
25
                parser.parseExpression(policy.getConditionExpression()).getValue(context, Boolean.class)
26
        );
27
    }
28
}

1
@Configuration
2
// 开启方法级的安全控制
3
@EnableMethodSecurity
4
@RequiredArgsConstructor
5
public class AbacSecurityConfig {
6

7
    private final UserDetailsServiceImpl userDetailsService;
8
    private final AbacDecisionEngine abacEngine;
9

10
    @Bean
11
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
12
        http
13
            .authorizeHttpRequests(authorize -> authorize
14
                .requestMatchers("/setPassword").permitAll()
15
                // 配置形式：ADMIN角色可以访问/admin/view
16
                .requestMatchers("/admin/view").hasRole("ADMIN")
17
                .anyRequest().authenticated()
18
            )
19
            .userDetailsService(userDetailsService)
20
            .formLogin(withDefaults())
21
            .logout(withDefaults());
22
        return http.build();
23
    }
24

25
    @Bean
26
    public PasswordEncoder passwordEncoder() {
27
        return new BCryptPasswordEncoder();
28
    }
29

30
    /**
31
     * 配置 Method Security Expression Handler，使用自定义的 PermissionEvaluator
32
     */
33
    @Bean
34
    public MethodSecurityExpressionHandler methodSecurityExpressionHandler(AbacDecisionEngine abacEngine) {
35
        DefaultMethodSecurityExpressionHandler handler = new DefaultMethodSecurityExpressionHandler();
36
        handler.setPermissionEvaluator(new AbacPermissionEvaluator(abacEngine));
37
        return handler;
38
    }
39
}

1
@RestController
2
@RequestMapping("/api")
3
public class AdminController {
4

5
    /**
6
     * MethodSecurityExpressionHandler方式
7
     */
8
    @PreAuthorize("hasPermission(null, 'admin:menu')")
9
    @GetMapping("/admin")
10
    public ResponseEntity<?> getAdminData() {
11
        return ResponseEntity.ok("MethodSecurityExpressionHandler方式");
12
    }
13

14
    /**
15
     * 自定义注解的方式
16
     */
17
    @PreAuthorize("@authz.check(#root, 'admin:menu')")
18
    @GetMapping("/authz")
19
    public ResponseEntity<?> authz() {
20
        return ResponseEntity.ok("自定义注解的方式");
21
    }
22

23
    /**
24
     * 以下RBAC角色 + ABAC属性的混合校验 可以复制测试
25
     * @PreAuthorize("hasAuthority('admin:menu') and @abacDecisionEngine.check(authentication, 'admin:menu')")
26
     * @PreAuthorize("hasRole('ADMIN') and @authz.check(#root, 'admin:menu')")
27
     */
28
    @PreAuthorize("hasRole('ADMIN') and @abacDecisionEngine.check(authentication, 'admin:menu')")
29
    @GetMapping("/admin/test")
30
    public ResponseEntity<?> test() {
31
        return ResponseEntity.ok("RBAC角色 + ABAC属性的混合校验");
32
    }
33
}