Security permission management details

One 、 Authorization process

After the user logs in successfully, the user information will be saved in Authencation In the object ,Authencation There is one in the interface getAuthorities() Method returns the user's permission

Collection<? extends GrantedAuthority> getAuthorities();

The existing system can do permission management based on roles and can also use resources （ Permission string ） Do authority management , there GrantedAuthority Is it a role or a resource ？

• If Business is permission management based on role , The user -> role -> resources , Then the user's role is returned
• If the business is resource-based （ jurisdiction ） Do permission management , The user -> jurisdiction -> resources , What is returned is the user's permission
• If based on role + Permission management , The user -> role -> jurisdiction -> resources , What is returned is the user's permission

security The processing methods of roles and permissions are basically the same , The only difference is that many times it will automatically add a character ROLE_ Prefix , Permissions will not be added

 

Two 、 Rights management strategy

1、 be based on URL Do authority management （ Filter technology implementation ）

@Configuration
public class SecurityConfig extends WebSecurityConfig