Spring Security中的动态RBAC配置

Question

我在Restful Spring MVC项目中使用Spring Security 5.1.2。我使用过自定义过滤器，身份验证提供程序等。在我的项目工作正常，我的安全配置文件如下：

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired
    private JwtAuthenticationProcessingFilter jwtAuthenticationProcessingFilter;
    @Autowired
    private JwtAuthenticationProvider jwtAuthenticationProvider;
    @Autowired
    private JwtAuthenticationEntryPoint jwtAuthenticationEntryPoint;
    @Autowired
    private JwtAccessDeniedHandler jwtAccessDeniedHandler;
    @Autowired
    private RolePermissionService rolePermissionService;

    @Bean
    @Override
    public AuthenticationManager authenticationManagerBean() throws Exception {
        return super.authenticationManagerBean();
    }

    @Override
    protected void configure(AuthenticationManagerBuilder auth) {
        auth.authenticationProvider(this.jwtAuthenticationProvider);
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {

        http.authorizeRequests().antMatchers(AuthenticationPatternType.SKIP_PATTERN.getPattern()).permitAll();
        try {
            List<PermissionRule> permissionRules = this.rolePermissionService.permissionRules();
            for (PermissionRule p : permissionRules)
                http.authorizeRequests().antMatchers(p.getPermission()).hasAnyRole(p.getRoles().toArray(new String[0]));
        } catch (SystemException ignored) {
        }
        http.authorizeRequests().antMatchers(AuthenticationPatternType.AUTH_PATTERN.getPattern()).authenticated();

        this.jwtAuthenticationProcessingFilter.init(authenticationManagerBean());
        http.addFilterBefore(this.jwtAuthenticationProcessingFilter, UsernamePasswordAuthenticationFilter.class);

        http.exceptionHandling()
                .authenticationEntryPoint(this.jwtAuthenticationEntryPoint)
                .accessDeniedHandler(this.jwtAccessDeniedHandler);

        http.sessionManagement()
                .sessionCreationPolicy(SessionCreationPolicy.STATELESS);

        http.csrf().disable();
    }
}

我的RolePermissionService类如下：

@Service
public class RolePermissionService {

    @Autowired
    private PermissionDao permissionDao;

    public List<PermissionRule> permissionRules() {
        List<PermissionEntity> permissionEntities = this.permissionDao.list();
        return permissionEntities.stream().map(PermissionRule::new)
            .collect(Collectors.toList());
    }
}

public class PermissionRule {
    private String permission;
    private List<String> roles;

    public PermissionRule(PermissionEntity permissionEntity) {
        this.permission = permissionEntity.getUrl();
        this.roles = permissionEntity.getRoles().stream().map(RoleEntity::getName)
                .collect(Collectors.toList());
    }

    // getters and setters
}

在这个项目中，我有角色（rid，name），permission（pid，url）和rolePermission（pid，rid）表来保存我的RBAC数据。如您所见，我正在从数据库（RolePermissionService类）读取此数据，并将此数据加载到上面配置文件中的HttpSecurity对象。

现在，假设有一个休息Api，我想编辑rolePermission表或假设有一个休息Api，我想在运行时添加一个角色及其权限。

问：如何更新安全配置，我可以在运行时动态编辑RBAC？

Answer 1

请参考https://github.com/liubo-tech/spring-security-rbac

@PreAuthorize("hasAuthority(T(com.example.springsecurityrbac.config.PermissionContact).USER_VIEW)")

用于注释安全方法。使用数据库表映射来分配权限。请参阅回购以获取更多信息