<http pattern="/*.html" security="none"/>
  <http pattern="/css/**" security="none"/>
  <http pattern="/img/**" security="none"/>
  <http pattern="/js/**" security="none"/>
  <http pattern="/plugins/**" security="none"/>
  <http pattern="/seller/add.do" security="none"/>

  <!-- use-expressions:設(shè)置是否啟動SpEL表達式，默認值是true。 -->
  <http use-expressions="false">
    <!--
      配置SpringSecurity的攔截路徑（攔截規(guī)則）
      * pattern:配置攔截規(guī)則。  /* 代表的是根路徑下的所有資源（不包含子路徑） /**代表的是根路徑下所有的資源（包含子路徑）
      * access:設(shè)置角色 角色命名 ROLE_角色名稱 如： ROLE_USER
    -->
    <intercept-url pattern="/**" access="ROLE_SELLER"/>

    <!--
    開啟表單驗證
      username-parameter="username"
      password-parameter="password"
      login-page      :登錄頁面名稱 以 / 開始
      default-target-url  :登錄成功后跳轉(zhuǎn)的頁面
      login-processing-url:提交的路徑的設(shè)置 默認值"/login" 可以修改
    -->
    <form-login login-page="/shoplogin.html" default-target-url="/admin/index.html" always-use-default-target="true" authentication-failure-url="/shoplogin.html"/>

    <!-- 不使用csrf的校驗 -->
    <csrf disabled="true"/>

    <!-- 配置框架頁面不攔截 -->
    <headers>
      <frame-options policy="SAMEORIGIN"/>
    </headers>

    <!-- 注銷的配置 -->
    <logout logout-url="/logout" logout-success-url="/shoplogin.html" />
  </http>

  <!-- 配置認證管理器 -->
  <authentication-manager>
    <!-- 認證的提供者 -->
    <authentication-provider user-service-ref="userDetailService">
      <password-encoder ref="passwordEncoder"></password-encoder>
    </authentication-provider>
  </authentication-manager>
<!-- 配置自定義的認證類 -->
  <beans:bean id="userDetailService" class="com.qingmu2.core.service.UserDetailServiceImpl">
    <beans:property name="sellerService" ref="sellerService"></beans:property>
  </beans:bean>

<!--加密時候使用的算法是BCryptPasswordEncoder-->
  <beans:bean id="passwordEncoder" class="org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder"/>

package com.qingmu2.core.service;
import com.alibaba.dubbo.config.annotation.Reference;
import com.qingmu2.core.pojo.seller.Seller;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.authority.SimpleGrantedAuthority;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.core.userdetails.UsernameNotFoundException;

import java.util.ArrayList;
import java.util.HashMap;
import java.util.HashSet;
import java.util.List;

/**
 * 自定義的認證類
 * @Auther:qingmu
 * @Description:腳踏實地,只為出人頭地
 * @Date:Created in 8:33 2019/5/31
 */
public class UserDetailServiceImpl implements UserDetailsService {

  private SellerService sellerService;

  public UserDetailServiceImpl() {
  }
  @Override
  public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
    Seller seller = sellerService.findOne(username);
    if(null!=seller){
      //判斷一次商家是否被審核通過.
      if("1".equals(seller.getStatus())){
        //創(chuàng)建一個集合,用來存儲權(quán)限
        HashSet<GrantedAuthority> authorities = new HashSet<>();
        authorities.add(new SimpleGrantedAuthority("ROLE_SELLER"));
        //將這個用戶的信息返回給認證類
        return new User(username,seller.getPassword(),authorities);
      }
    }
    //沒有這個用戶,則返回null
    return null;
  }

  public UserDetailServiceImpl(SellerService sellerService) {
    this.sellerService = sellerService;
  }

  public SellerService getSellerService() {
    return sellerService;
  }

  public void setSellerService(SellerService sellerService) {
    this.sellerService = sellerService;
  }
}