Spring 安全中的动态 RBAC 配置

Question

我在 Restful Spring MVC 项目中使用 Spring Security 5.1.2。我使用了自定义过滤器、身份验证提供程序等。在我的项目中工作正常，我的安全配置文件如下：

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired
    private JwtAuthenticationProcessingFilter jwtAuthenticationProcessingFilter;
    @Autowired
    private JwtAuthenticationProvider jwtAuthenticationProvider;
    @Autowired
    private JwtAuthenticationEntryPoint jwtAuthenticationEntryPoint;
    @Autowired
    private JwtAccessDeniedHandler jwtAccessDeniedHandler;
    @Autowired
    private RolePermissionService rolePermissionService;

    @Bean
    @Override
    public AuthenticationManager authenticationManagerBean() throws Exception {
        return super.authenticationManagerBean();
    }

    @Override
    protected void configure(AuthenticationManagerBuilder auth) {
        auth.authenticationProvider(this.jwtAuthenticationProvider);
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {

        http.authorizeRequests().antMatchers(AuthenticationPatternType.SKIP_PATTERN.getPattern()).permitAll();
        try {
            List<PermissionRule> permissionRules = this.rolePermissionService.permissionRules();
            for (PermissionRule p : permissionRules)
                http.authorizeRequests().antMatchers(p.getPermission()).hasAnyRole(p.getRoles().toArray(new String[0]));
        } catch (SystemException ignored) {
        }
        http.authorizeRequests().antMatchers(AuthenticationPatternType.AUTH_PATTERN.getPattern()).authenticated();

        this.jwtAuthenticationProcessingFilter.init(authenticationManagerBean());
        http.addFilterBefore(this.jwtAuthenticationProcessingFilter, UsernamePasswordAuthenticationFilter.class);

        http.exceptionHandling()
                .authenticationEntryPoint(this.jwtAuthenticationEntryPoint)
                .accessDeniedHandler(this.jwtAccessDeniedHandler);

        http.sessionManagement()
                .sessionCreationPolicy(SessionCreationPolicy.STATELESS);

        http.csrf().disable();
    }
}

而我的 RolePermissionService Class 如下：

@Service
public class RolePermissionService {

    @Autowired
    private PermissionDao permissionDao;

    public List<PermissionRule> permissionRules() {
        List<PermissionEntity> permissionEntities = this.permissionDao.list();
        return permissionEntities.stream().map(PermissionRule::new)
            .collect(Collectors.toList());
    }
}

public class PermissionRule {
    private String permission;
    private List<String> roles;

    public PermissionRule(PermissionEntity permissionEntity) {
        this.permission = permissionEntity.getUrl();
        this.roles = permissionEntity.getRoles().stream().map(RoleEntity::getName)
                .collect(Collectors.toList());
    }

    // getters and setters
}

在这个项目中，我有 role(rid, name)、permission(pid, url) 和 rolePermission(pid, rid) tables 保存我的 RBAC 数据。如您所见，我正在从数据库 (RolePermissionService Class) 读取此数据并将此数据加载到上述配置文件中的 HttpSecurity 对象。

现在，假设有一个休息 Api 我想编辑 rolePermission table 或者假设有一个休息 Api 我想在其中添加角色及其权限运行次。

问：如何更新可以在运行时间动态编辑 RBAC 的安全配置？

Answer 1

请参考https://github.com/liubo-tech/spring-security-rbac

@PreAuthorize("hasAuthority(T(com.example.springsecurityrbac.config.PermissionContact).USER_VIEW)")

用于注释保护方法。使用数据库 table 映射来分配权限。请参考回购以获取更多信息

Spring 安全中的动态 RBAC 配置

Dynamic RBAC Configuration in Spring Security

spring

restful-authentication

spring-security

rbac

jwt