spring Security4 和 oauth2整合注解+xml混合使用（验证码等额外数据验证）

喜欢ヅ旅行 2022-06-04 05:57 160阅读 0赞

## spring Security4 和 oauth2整合（验证码等额外数据验证） ##

上一篇写的自定义用户名密码验证，这里写验证码的验证，或者其他信息的验证。

git地址：[https://gitee.com/ffch/OauthUmp][https_gitee.com_ffch_OauthUmp]

[spring Security4 和 oauth2整合 注解+xml混合使用（基础运行篇）][spring Security4 _ oauth2_ _xml]  
[spring Security4 和 oauth2整合 注解+xml混合使用（进阶篇）][spring Security4 _ oauth2_ _xml 1]  
[spring Security4 和 oauth2整合 注解+xml混合使用（授权码篇）][spring Security4 _ oauth2_ _xml 2]  
[spring Security4 和 oauth2整合 注解+xml混合使用（注意事项篇）][spring Security4 _ oauth2_ _xml 3]  
[spring Security4 和 oauth2整合 注解+xml混合使用（替换6位的授权码）][spring Security4 _ oauth2_ _xml_6]  
[spring Security4 和 oauth2整合 注解+xml混合使用（替换用户名密码认证）][spring Security4 _ oauth2_ _xml 4]  
[spring Security4 和 oauth2整合 注解+xml混合使用（验证码等额外数据验证）][spring Security4 _ oauth2_ _xml 5]

### 验证码等额外数据获取逻辑 ###

新增OauthAddUserDetails继承WebAuthenticationDetails，这里从request里拿到额外的参数。对比验证码，我们需要有一个接口去更新验证码，更新完放到session里，只有这个地方可以拿到request，所以我就在这里把session里的验证码也拿出来。

package com.ump.oauth.detail;
    
    import java.util.Collection;
    
    import javax.servlet.http.HttpServletRequest;
    
    import org.springframework.security.core.GrantedAuthority;
    import org.springframework.security.core.authority.AuthorityUtils;
    import org.springframework.security.core.userdetails.UserDetails;
    import org.springframework.security.web.authentication.WebAuthenticationDetails;
    
    import com.ump.domain.AppUser;
    
    public class OauthAddUserDetails extends WebAuthenticationDetails{
    	 /**
         * 
         */
        private static final long serialVersionUID = 6975601077710753878L;
        private final String token;
        private final String sessionToken;
    
        public OauthAddUserDetails(HttpServletRequest request) {
            super(request);
            token = request.getParameter("imgtoken");
            sessionToken = (String) request.getSession().getAttribute("imgtoken");
        }
    
        public String getToken() {
            return token;
        }
    
        public String getSessionToken() {
    		return sessionToken;
    	}
    
    	@Override
        public String toString() {
            StringBuilder sb = new StringBuilder();
            sb.append(super.toString()).append("; Token: ").append(this.getToken());
            return sb.toString();
        }
    
    }

### 增加AuthenticationDetailsSource ###

AuthenticationDetailsSource是需要配置在spring security里的WebSecurityConfigurerAdapter子类里。

package com.ump.oauth.part;
    
    import javax.servlet.http.HttpServletRequest;
    
    import org.springframework.security.authentication.AuthenticationDetailsSource;
    import org.springframework.security.web.authentication.WebAuthenticationDetails;
    import org.springframework.stereotype.Component;
    
    import com.ump.oauth.detail.OauthAddUserDetails;
    
    @Component("oauthAuthenticationDetailsSource")
    public class OauthAuthenticationDetailsSource implements AuthenticationDetailsSource<HttpServletRequest, WebAuthenticationDetails> {
    
        @Override
        public WebAuthenticationDetails buildDetails(HttpServletRequest context) {
            return new OauthAddUserDetails(context);
        }
    
    
    }

### AuthenticationProvider的认证逻辑增加验证码处理 ###

对比验证码，这里我们做验证码的对比工作。部分代码是上一篇讲到的，按照自己逻辑删减即可。

package com.ump.oauth.part;
    
    import java.util.Collection;
    
    import org.springframework.beans.factory.annotation.Autowired;
    import org.springframework.security.authentication.AuthenticationProvider;
    import org.springframework.security.authentication.BadCredentialsException;
    import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
    import org.springframework.security.core.Authentication;
    import org.springframework.security.core.AuthenticationException;
    import org.springframework.security.core.GrantedAuthority;
    import org.springframework.stereotype.Component;
    
    import com.ump.oauth.detail.OauthAddUserDetails;
    import com.ump.oauth.detail.OauthUserDetails;
    
    @Component
    public class OauthAuthenticationProvider implements AuthenticationProvider {
    	@Autowired
    	private OauthUserDetailsService oauthUserDetailsService;
    
    	/**
    	 * 自定义验证方式
    	 */
    	@Override
    	public Authentication authenticate(Authentication authentication) throws AuthenticationException {
    		//验证码等校验
    		OauthAddUserDetails details = (OauthAddUserDetails) authentication.getDetails();
    
    		System.out.println(details.getToken() + "+++++++++++++++++" + details.getSessionToken());
    		if (!details.getToken().equalsIgnoreCase(details.getSessionToken())) {
    			throw new BadCredentialsException("验证码错误。");
    		}
    		
    		//用户名密码校验
    		OauthUserDetails oauthUserDetails = (OauthUserDetails) oauthUserDetailsService
    				.loadUserByUsername(authentication.getName());
    		System.out.println(authentication.getName() + "+++++++++++++++++" + authentication.getCredentials());
    		if (!oauthUserDetails.getUserName().equals(authentication.getName())
    				|| !oauthUserDetails.getPassword().equals(authentication.getCredentials())) {
    			throw new BadCredentialsException("用户名或密码错误。");
    		}
    		Collection<? extends GrantedAuthority> authorities = oauthUserDetails.getAuthorities();
    		return new UsernamePasswordAuthenticationToken(oauthUserDetails.getUsername(), oauthUserDetails.getPassword(),
    				authorities);
    	}
    
    	@Override
    	public boolean supports(Class<?> arg0) {
    		return true;
    	}
    }

### 配置authenticationDetailsSource ###

只需要一个autowired和HttpSecurity一个.authenticationDetailsSource(authenticationDetailsSource)即可。我这里代码多，删减即可。

package com.ump.oauth.config;
    
    import javax.servlet.http.HttpServletRequest;
    
    import org.springframework.beans.factory.annotation.Autowired;
    import org.springframework.beans.factory.annotation.Qualifier;
    import org.springframework.context.annotation.Bean;
    import org.springframework.context.annotation.Configuration;
    import org.springframework.security.authentication.AuthenticationDetailsSource;
    import org.springframework.security.authentication.AuthenticationManager;
    import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
    import org.springframework.security.config.annotation.web.builders.HttpSecurity;
    import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
    import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
    import org.springframework.security.core.userdetails.UserDetailsService;
    import org.springframework.security.oauth2.provider.ClientDetailsService;
    import org.springframework.security.oauth2.provider.approval.ApprovalStore;
    import org.springframework.security.oauth2.provider.approval.TokenApprovalStore;
    import org.springframework.security.oauth2.provider.approval.TokenStoreUserApprovalHandler;
    import org.springframework.security.oauth2.provider.error.OAuth2AuthenticationEntryPoint;
    import org.springframework.security.oauth2.provider.request.DefaultOAuth2RequestFactory;
    import org.springframework.security.oauth2.provider.token.TokenStore;
    import org.springframework.security.oauth2.provider.token.store.InMemoryTokenStore;
    import org.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler;
    import org.springframework.security.web.authentication.WebAuthenticationDetails;
    
    import com.ump.oauth.part.OauthAuthenticationProvider;
    
    @Configuration
    @EnableWebSecurity
    public class OAuth2SecurityConfiguration extends WebSecurityConfigurerAdapter {
    
    	@Autowired
    	@Qualifier("myClientDetailsService")
    	private ClientDetailsService clientDetailsService;
    
    	@Autowired
        private OauthAuthenticationProvider oauthAuthenticationProvider; 
    	
    	@Autowired
    	@Qualifier("oauthAuthenticationDetailsSource")
    	private AuthenticationDetailsSource<HttpServletRequest, WebAuthenticationDetails> authenticationDetailsSource;
    
    	@Autowired
        public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
            auth.authenticationProvider(oauthAuthenticationProvider);
        }
    
        @Override
        public void configure(HttpSecurity http) throws Exception {
        	SimpleUrlAuthenticationFailureHandler hander = new SimpleUrlAuthenticationFailureHandler();
        	hander.setUseForward(true);
        	hander.setDefaultFailureUrl("/authlogin.jsp");
        	
    		http
    		.csrf().disable()
    	  	.authorizeRequests()
    	  	.antMatchers("/oauth/token")
    	  	.permitAll().and()
    	  	.formLogin().loginPage("/authlogin.jsp")
    	  	.usernameParameter("userName").passwordParameter("userPwd")
    	  	.authenticationDetailsSource(authenticationDetailsSource)
    //	  	.loginProcessingUrl("/login").failureUrl("/index1.jsp")
    	  	.loginProcessingUrl("/login").failureHandler(hander)
    	  	.and().logout().logoutUrl("/logout");
    		http.authorizeRequests().antMatchers("/user/**").authenticated();
        }
    
        @Override
        @Bean
        public AuthenticationManager authenticationManagerBean() throws Exception {
            return super.authenticationManagerBean();
        }
    
    	@Bean
    	@Autowired
    	public TokenStoreUserApprovalHandler userApprovalHandler(TokenStore tokenStore){
    		TokenStoreUserApprovalHandler handler = new TokenStoreUserApprovalHandler();
    		handler.setTokenStore(tokenStore);
    		handler.setRequestFactory(new DefaultOAuth2RequestFactory(clientDetailsService));
    		handler.setClientDetailsService(clientDetailsService);
    		return handler;
    	}
    	
    	@Bean
    	@Autowired
    	public ApprovalStore approvalStore(TokenStore tokenStore) throws Exception {
    		TokenApprovalStore store = new TokenApprovalStore();
    		store.setTokenStore(tokenStore);
    		return store;
    	}
    	
    }

这样就可以了，需要其他信息验证，我们就从request里面拿东西就是了。

[https_gitee.com_ffch_OauthUmp]: https://gitee.com/ffch/OauthUmp
[spring Security4 _ oauth2_ _xml]: http://blog.csdn.net/feiyangtianyao/article/details/78687161
[spring Security4 _ oauth2_ _xml 1]: http://blog.csdn.net/feiyangtianyao/article/details/78687403
[spring Security4 _ oauth2_ _xml 2]: http://blog.csdn.net/feiyangtianyao/article/details/78687569
[spring Security4 _ oauth2_ _xml 3]: http://blog.csdn.net/feiyangtianyao/article/details/78687700
[spring Security4 _ oauth2_ _xml_6]: http://blog.csdn.net/feiyangtianyao/article/details/78721818
[spring Security4 _ oauth2_ _xml 4]: http://blog.csdn.net/feiyangtianyao/article/details/78727949
[spring Security4 _ oauth2_ _xml 5]: http://blog.csdn.net/feiyangtianyao/article/details/78728147