java - 获取特定用户的所有权限

我有一个User实体，每个存在的用户应具有1个或多个特定角色/权限。例如admin user，依此类推。
所以我创建了一个包含2个字段（authorities和username）的authority表
在我的application-context-securtiy.xml中，

<jdbc-user-service id="userService" data-source-ref="dataSource"
    users-by-username-query="
        select nickname, password, true from users where nickname=?"
    authorities-by-username-query= "select username, authority AS authorities
    from authorities where username=?"
/>

效果很好。

现在，我正在尝试创建一个列出所有用户及其角色/权限的jsp文件，但是我无法执行user.getAuthorites()之类的操作并将其打印在jsp中。

我已经尝试过实现UserDetailsService，但是我不知道如何连接User和UserDetailsS​​ervice。

希望你能给我一些建议。

编辑：
jsp的一部分，我想如何使用它：

<tbody>
<c:forEach var="user" varStatus="stats" items="${users}">
    <tr>
        <td>
            <c:out value="${user.nickname}" />
            <c:forEach var="role" varStatus="status_" items="${user.getAuthorities()}">
                <c:out value="${role}" />
            </c:forEach>
        </td>
        <td>test</td>
        <td>options</td>
    </tr>
</c:forEach>
</tbody>

我如何将数据从控制器发送到视图：

@RequestMapping(value = "/manageUsers", method = RequestMethod.GET)
public String startManageUsers(ModelMap model, Principal principal) {
    List<User> list = userService.getUsers();
    model.addAttribute("users", list);
    return "showUsers";
}

最佳答案

我认为最好的方法是实现UserDetailsS​​ervice和UserDetails。

UserDetailsS​​ervice的示例实现。

@Service
@Transactional
public class UserLoginService implements UserDetailsService {

    @Autowired
    private UserService userService;

    @Override
    public UserDetails loadUserByUsername(String userId) throws UsernameNotFoundException {
        UserEntity userEntity = this.userService.getUserByUserId(userId);
        if (userEntity == null) {
            throw new UsernameNotFoundException("User not found");
        }

        UserLoginBean bean = new UserLoginBean(userEntity.getId(), userEntity.getUserId(), userEntity.getPassword(), userEntity.getEnabled());
        bean.setFullname(userEntity.getFullname());
        bean.setUserEntity(userEntity);

        Set<GrantedAuthority> roles = new HashSet<GrantedAuthority>();
        roles.add( new SimpleGrantedAuthority( userEntity.getRole() ) );
        bean.setAuthorities(roles);

        return bean;
    }

}

UserDetails的示例实现。

public class UserLoginBean implements UserDetails {

    private static final long serialVersionUID = 1L;

    private Long id;
    private String fullname;
    private String username;
    private String password;
    private boolean locked;
    private Set<GrantedAuthority> authorities = null;

    private UserEntity userEntity;

    public UserLoginBean(Long id, String username, String password, boolean locked ) {
        this.id = id;
        this.username = username;
        this.password = password;
        this.locked = locked;
    }

    public boolean isAccountNonExpired() {
        return true;
    }

    public boolean isAccountNonLocked() {
        return locked;
    }

    public boolean isCredentialsNonExpired() {
        return true;
    }

    public boolean isEnabled() {
        return true;
    }

    public Set<GrantedAuthority> getAuthorities() {
        return authorities;
    }

    public void setAuthorities( Set<GrantedAuthority> authorities ) {
        if ( this.authorities == null ) {
            this.authorities = authorities;
        }
    }

    // setters, getters
    }

最后一件事是将Spring Security配置为UserLoginService作为身份验证提供程序。

例：

<security:authentication-manager alias="authenticationManager">
      <security:authentication-provider user-service-ref="userLoginService">
      <security:password-encoder ref="userPasswordEncoder"/>
      </security:authentication-provider>
    </security:authentication-manager>

    <bean

    <bean id="userLoginService" class="com.stackoverflow.UserLoginService" />

在jsp页面中，您需要添加：

<%@ taglib prefix="a" uri="http://www.springframework.org/security/tags"%>

<a:authentication property="principal" var="principal" />

现在，您可以访问UserLoginBean中的所有内容。

<c:if test="${not empty principal && principal != 'anonymousUser'}">
        <c:set var="fullname"><c:out value="${principal.fullname}" /></c:set>
    </c:if>