如何根據用戶角色對用戶進行身份驗證？

Question

我需要幫助來驗證用戶，我的數據庫有一個名爲rol的人稱爲rol的表，rol可以是admin或employee，我希望當用戶登錄時管理下一個jsp顯示（main.jsp）和何時rol = employee顯示（main-act.jsp），我追加我的代碼以查詢用戶身份驗證以及登錄：

1. 我該怎麼做？
2. 我如何得到我的價值？

public class mysqlquery extends Conexion{ 
Connection con = null; 

public boolean autenticacion(String name, String password){ 
    PreparedStatement pst = null; 
    //PreparedStatement pst1=null; 
    ResultSet rs = null; 
    //ResultSet rs1 = null; 
    try { 
     String query= "select * from person where name= ? and pass = ?"; 
     pst = getConexion().prepareCall(consulta); 
     pst.setString(1, user); 
     pst.setString(2, password); 
     rs = pst.executeQuery(); 
     if(rs.absolute(1)){ 
      return true; 
     } 
    } catch (Exception e) { 
     System.err.println("error: "+e); 
    } 
    return false; 
} 


public class login extends HttpServlet { 

/** 
* Processes requests for both HTTP <code>GET</code> and <code>POST</code> 
* methods. 
* 
* @param request servlet request 
* @param response servlet response 
* @throws ServletException if a servlet-specific error occurs 
* @throws IOException if an I/O error occurs 
*/ 
protected void processRequest(HttpServletRequest request, HttpServletResponse response) 
     throws ServletException, IOException { 
    response.setContentType("text/html;charset=UTF-8"); 
    String name= request.getParameter("name"); 
    String password= request.getParameter("pass"); 
    mysqlquery co = new mysqlquery(); 
    if(co.autenticacion(name, password)){ 
     HttpSession objsesion = request.getSession(true); 
     objsesion.setAttribute("name", name); 
     //objsesion.setAttribute("rol", rol); 
     response.sendRedirect("main.jsp"); 
    }else { 
     response.sendRedirect("index.jsp"); 
    } 
} 

Answer 1

你可以叫的UserRole你的mysql查詢類添加一個字段和存儲來自數據庫的autenticacion方法調用中檢索到的角色的價值，就像這樣：

public class mysqlquery extends Conexion{ 
Connection con = null; 
private String userRole; 

public String getUserRole() { return userRole; } 

    public boolean autenticacion(String name, String password){ 
     PreparedStatement pst = null; 
     //PreparedStatement pst1=null; 
     ResultSet rs = null; 
     //ResultSet rs1 = null; 
     try { 
      String query= "select * from person where name= ? and pass = ?"; 
      pst = getConexion().prepareCall(consulta); 
      pst.setString(1, user); 
      pst.setString(2, password); 
      rs = pst.executeQuery(); 
      if(rs.absolute(1)){ 
       userRole = rs.getString("role"); 
       return true; 
      } 
     } catch (Exception e) { 
      System.err.println("error: "+e); 
     } 
     return false; 
    } 

而在Servlet中，像這樣修改：

protected void processRequest(HttpServletRequest request, HttpServletResponse response) 
     throws ServletException, IOException { 
    response.setContentType("text/html;charset=UTF-8"); 
    String name= request.getParameter("name"); 
    String password= request.getParameter("pass"); 
    mysqlquery co = new mysqlquery(); 
    boolean canAuthenticate = co.autenticacion(name, password); 
    if(canAuthenticate && co.getUserRole().equals("admin")){ 
     //go to admin page 
    } else if (canAuthenticate && co.getUserRole().equals("employee")) { 
     //go to employee page 
    } else { 
     response.sendRedirect("index.jsp"); 
    } 
} 

通過這種方式，您可以決定用戶是否可以通過身份驗證（擁有正確的用戶名和密碼）並根據其角色將其重定向到頁面上。