Spring Security权限控制

public int vote(Authentication authentication, Object object, Collection<ConfigAttribute> attributes) {  
    int result = ACCESS_ABSTAIN;  
    Collection<? extends GrantedAuthority> authorities = extractAuthorities(authentication);  
  
    for (ConfigAttribute attribute : attributes) {  
        if (this.supports(attribute)) {  
            result = ACCESS_DENIED;  
  
            // Attempt to find a matching granted authority  
            for (GrantedAuthority authority : authorities) {  
                if (attribute.getAttribute().equals(authority.getAuthority())) {  
                    return ACCESS_GRANTED;  
                }  
            }  
        }  
    }  
  
    return result;  
}  
  
Collection<? extends GrantedAuthority> extractAuthorities(Authentication authentication) {  
    return authentication.getAuthorities();  
}  

public class DefaultAccessDecisionManager extends AbstractAccessDecisionManager {  
      
    public void decide( Authentication authentication, Object object,   
            Collection<ConfigAttribute> configAttributes)   
        throws AccessDeniedException, InsufficientAuthenticationException{  
          
        SysUser user = (SysUser)authentication.getPrincipal();  
        logger.info("访问资源的用户为"+user.getUsername());  
          
        //如果访问资源不需要任何权限则直接通过  
        if( configAttributes == null ) {  
            return ;  
        }  
          
        Iterator<ConfigAttribute> ite = configAttributes.iterator();  
        //遍历configAttributes看用户是否有访问资源的权限  
        while( ite.hasNext()){  
              
            ConfigAttribute ca = ite.next();  
            String needRole = ((SecurityConfig)ca).getAttribute();  
              
            //ga 为用户所被赋予的权限。 needRole 为访问相应的资源应该具有的权限。  
            for( GrantedAuthority ga: authentication.getAuthorities()){  
                  
                if(needRole.trim().equals(ga.getAuthority().trim())){  
  
                    return;  
                }  
            }  
        }  
          
        throw new AccessDeniedException("");  
          
    }  
}  

@Configuration
@EnableWebSecurity//打开web支持
public class SpringSecurityConfig extends WebSecurityConfigurerAdapter {
/**
     * 设置http请求放开与拦截
     * @param http
     * @throws Exception
     */
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests()
                .antMatchers("/").permitAll()//根目录可以直接访问
                .anyRequest().authenticated()//其他路径不能直接访问
                .and()
                .logout().permitAll()//注销任何权限都可以访问
                .and()
                .formLogin();//允许表单登录
        http.csrf().disable();//关闭默认的csrf的认证
    }

    /**
     * 设置静态资源放开
     * @param web
     * @throws Exception
     */
    @Override
    public void configure(WebSecurity web) throws Exception {
        web.ignoring().antMatchers("/js/**", "/css/**", "/images/**");
    }
}

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
//        设置可以登录的用户名和密码
        auth.inMemoryAuthentication().withUser("admin").password("123456").roles("ADMIN");
    }

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
//        设置可以登录的用户名和密码
        auth.inMemoryAuthentication().withUser("admin").password("123456").roles("ADMIN");
        auth.inMemoryAuthentication().withUser("zhangsan").password("zhangsan").roles("ADMIN");
        auth.inMemoryAuthentication().withUser("demo").password("demo").roles("USER");

    }

　  @PreAuthorize("hasRole('ROLE_ADMIN')")
    @RequestMapping("/roleAuth")
    public String role() {
        return "admin auth";
    }

    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        return null;
    }

    @Autowired
    private MyUserService myUserService;

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
//        设置可以登录的用户名和密码
//        auth.inMemoryAuthentication().withUser("admin").password("123456").roles("ADMIN");
//        auth.inMemoryAuthentication().withUser("zhangsan").password("zhangsan").roles("ADMIN");
//        auth.inMemoryAuthentication().withUser("demo").password("demo").roles("USER");
//
        auth.userDetailsService(myUserService)
                .passwordEncoder(new MyPasswordEncoder());//使用自己定义的验证器

        //默认的Security数据库验证，如果使用，需要使用给定的数据库表结构
        auth.jdbcAuthentication().usersByUsernameQuery("").authoritiesByUsernameQuery("").passwordEncoder(new MyPasswordEncoder());
    }

public class MyPasswordEncoder implements PasswordEncoder {

    private final static String SALT = "123456";

    /**
     * 密码加密
     * @param rawPassword
     * @return
     */
    @Override
    public String encode(CharSequence rawPassword) {
        Md5PasswordEncoder encoder = new Md5PasswordEncoder();
        return encoder.encodePassword(rawPassword.toString(), SALT);
    }

    /**
     * 密码匹配
     * @param rawPassword
     * @param encodedPassword
     * @return
     */
    @Override
    public boolean matches(CharSequence rawPassword, String encodedPassword) {
        Md5PasswordEncoder encoder = new Md5PasswordEncoder();
        return encoder.isPasswordValid(encodedPassword, rawPassword.toString(), SALT);
    }
}

    @PreAuthorize("#id<10 and principal.username.equals(#username) and #user.username.equals('abc')")
    @PostAuthorize("returnObject%2==0")//返回的值是偶数，对2取余为0，此注解用于对返回值进行过滤，在方法完成后进行权限检查
    @RequestMapping("/test")
    public Integer test(Integer id, String username, User user) {
        // ...
        return id;
    }

    @PreFilter("filterObject%2==0")//传入的过滤
    @PostFilter("filterObject%4==0")//返回的过滤
    @RequestMapping("/test2")
    public List<Integer> test2(List<Integer> idList) {
        // ...
        return idList;
    }