权限不生效，配置类如下：
```java
@Configuration
//@EnableGlobalMethodSecurity(prePostEnabled = true) //开启全局安全认证
public class SecurityConfig extends WebSecurityConfigurerAdapter {
@Resource
private UserDetailsService userDetailsService;
@Resource
private AuthenticationHandler authenticationHandler;
@Resource
private AuthenticationTokenFilter AuthenticationTokenFilter;
@Bean
@Override
public AuthenticationManager authenticationManagerBean() throws Exception {
return super.authenticationManagerBean();
}
@Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
auth.userDetailsService(userDetailsService).passwordEncoder(new BCryptPasswordEncoder());
}
@Override
public void configure(WebSecurity web) throws Exception {
web.ignoring().antMatchers(HttpMethod.OPTIONS,"/**");
}
@Override
protected void configure(HttpSecurity http) throws Exception {
// http.csrf().csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse());
http
// CSRF禁用，因为不使用session
.csrf().disable()
// 认证失败处理类，指定异常处理实现类
.exceptionHandling().authenticationEntryPoint(authenticationHandler).and()
// 基于token，所以不需要session
.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS).and()
// 过滤请求
.authorizeRequests()
// .antMatchers("/admin/**")
// //.hasRole("ADMIN")
// .hasAnyRole("ADMIN")
//.mvcMatchers("/admin/**").hasRole("admin")
//.antMatchers("/admin/**").hasRole("ROLE_admin") //访问/admin/**下的路径，必须具备admin身份
// .antMatchers("/ordinary/**").hasRole("ordinary") //访问/ordinary/**下的路径，必须具备user身份
//对于登录login 验证码 允许匿名访问
.antMatchers("/user/getcode", "/user/login","/login/**").permitAll()
.antMatchers("/admin/**").hasAnyAuthority("admin")
//其他全部拦截认证
.anyRequest()
.authenticated();
//将认证过滤器添加到security中
http.addFilterBefore(AuthenticationTokenFilter, UsernamePasswordAuthenticationFilter.class);
}
/**
* 设置加密方式
*
* @return
*/
@Bean
public PasswordEncoder passwordEncoder() {
return new BCryptPasswordEncoder();
}
//授权时去掉默认角色前缀"ROLE_"
@Bean
GrantedAuthorityDefaults grantedAuthorityDefaults() {
return new GrantedAuthorityDefaults(""); // Remove the ROLE_ prefix
}
}
接口：
@Slf4j
@RestController
@RequestMapping("/admin")
@CrossOrigin //关闭跨域验证
public class AdminTestController {
//@PreAuthorize("hasAnyRole('ADMIN')")
//@PreAuthorize("hasAuthority('PERMISSION_TEST')")
//@Secured({"admin:select"})
@GetMapping("/test")
public R test() {
return R.success("admin权限测试成功");
}
}
权限：
```java
@AllArgsConstructor
@NoArgsConstructor
@Data
public class LoginUser implements UserDetails {
private TUser tUser;
private List<SimpleGrantedAuthority> roles;
@Override
public Collection<? extends GrantedAuthority> getAuthorities() {
return AuthorityUtils.commaSeparatedStringToAuthorityList("admin,nobks");
}
@Override
public String getPassword() {
String pass=tUser.getPassword();
tUser.setPassword("禁止查看");
return pass;
}
@Override
public String getUsername() {
return tUser.getUsername();
}
/**
* 账户是否过期
* @return
*/
@Override
public boolean isAccountNonExpired() {
return true;
}
/**
* 账户是否锁定
* @return
*/
@Override
public boolean isAccountNonLocked() {
return true;
}
@Override
public boolean isCredentialsNonExpired() {
return true;
}
@Override
public boolean isEnabled() {
return true;
}
}
登录后未设置权限的接口正常，但是有权限的就是403
从上下文中拿出的用户信息如下：
