spring security 自定义认证登录

短命女 2023-02-20 06:43 178阅读 0赞

**

spring security 自定义认证登录

**
1.概要
1.1.简介
spring security是一种基于 Spring AOP 和 Servlet 过滤器的安全框架，以此来管理权限认证等。

1.2.spring security 自定义认证流程
1）认证过程

  1. 生成未认证的AuthenticationToken                 
  2.        ↑（获取信息）           （根据AuthenticationToken分配provider）                                    
  3.  AuthenticationFilter   ->     AuthenticationManager    ->    AuthenticationProvider
  4.                                                                       ↓（认证）
  5.                                                               UserDetails（一般查询数据库获取）
  6.                                                                       ↓（通过）
  7.                                                              生成认证成功的AuthenticationToken
  8.                                                                       ↓（存放）
  9.                                                                 SecurityContextHolder

2）将AuthenticationFilter加入到security过滤链（资源服务器中配置），如：

http.addFilterBefore(AuthenticationFilter, AbstractPreAuthenticatedProcessingFilter.class)
或者：

http.addFilterAfter(AuthenticationFilter, UsernamePasswordAuthenticationFilter.class)
2.以手机号短信登录为例
2.1.开发环境
SpringBoot
Spring security
Redis
2.2.核心代码分析
2.2.1.自定义登录认证流程
2.2.1.1.自定义认证登录Token

  1. /** * 手机登录Token * * @author ： CatalpaFlat */
  2. public class MobileLoginAuthenticationToken extends AbstractAuthenticationToken { 
  3.     private static final long serialVersionUID = SpringSecurityCoreVersion.SERIAL_VERSION_UID;
  4.     private static final Logger logger = LoggerFactory.getLogger(MobileLoginAuthenticationToken.class.getName());
  6.     private final Object principal;
  8.     public MobileLoginAuthenticationToken(String mobile) { 
  9.         super(null);
  10.         this.principal = mobile;
  11.         this.setAuthenticated(false);
  12.         logger.info("MobileLoginAuthenticationToken setAuthenticated ->false loading ...");
  13.     }
  15.     public MobileLoginAuthenticationToken(Object principal,
  16.                                           Collection<? extends GrantedAuthority> authorities) { 
  17.         super(authorities);
  18.         this.principal = principal;
  19.         // must use super, as we override
  20.         super.setAuthenticated(true);
  21.         logger.info("MobileLoginAuthenticationToken setAuthenticated ->true loading ...");
  22.     }
  24.     @Override
  25.     public void setAuthenticated(boolean authenticated) { 
  26.         if (authenticated) { 
  27.             throw new IllegalArgumentException(
  28.                     "Cannot set this token to trusted - use constructor which takes a GrantedAuthority list instead");
  29.         }
  30.         super.setAuthenticated(false);
  31.     }
  33.     @Override
  34.     public Object getCredentials() { 
  35.         return null;
  36.     }
  38.     @Override
  39.     public Object getPrincipal() { 
  40.         return this.principal;
  41.     }
  43.     @Override
  44.     public void eraseCredentials() { 
  45.         super.eraseCredentials();
  46.     }
  47. }

注：
setAuthenticated()：判断是否已认证

在过滤器时，会生成一个未认证的AuthenticationToken，此时调用的是自定义token的setAuthenticated()，此时设置为false -> 未认证
在提供者时，会生成一个已认证的AuthenticationToken，此时调用的是父类的setAuthenticated()，此时设置为true -> 已认证
2.2.1.1.自定义认证登录过滤器

  1. /** * 手机短信登录过滤器 * * @author ： CatalpaFlat */
  2. public class MobileLoginAuthenticationFilter extends AbstractAuthenticationProcessingFilter { 
  4.     private boolean postOnly = true;
  5.     private static final Logger logger = LoggerFactory.getLogger(MobileLoginAuthenticationFilter.class.getName());
  7.     @Getter
  8.     @Setter
  9.     private String mobileParameterName;
  11.     public MobileLoginAuthenticationFilter(String mobileLoginUrl, String mobileParameterName,
  12.                                            String httpMethod) { 
  13.         super(new AntPathRequestMatcher(mobileLoginUrl, httpMethod));
  14.         this.mobileParameterName = mobileParameterName;
  15.         logger.info("MobileLoginAuthenticationFilter loading ...");
  16.     }
  18.     @Override
  19.     public Authentication attemptAuthentication(HttpServletRequest request,
  20.                                                 HttpServletResponse response) throws AuthenticationException, IOException, ServletException { 
  22.         if (postOnly && !request.getMethod().equals(HttpMethod.POST.name())) { 
  23.             throw new AuthenticationServiceException("Authentication method not supported: " + request.getMethod());
  24.         }
  26.         //get mobile
  27.         String mobile = obtainMobile(request);
  29.         //assemble token
  30.         MobileLoginAuthenticationToken authRequest = new MobileLoginAuthenticationToken(mobile);
  32.         // Allow subclasses to set the "details" property
  33.         setDetails(request, authRequest);
  35.         return this.getAuthenticationManager().authenticate(authRequest);
  36.     }
  37.     /** * 设置身份认证的详情信息 */
  38.     private void setDetails(HttpServletRequest request, MobileLoginAuthenticationToken authRequest) { 
  39.         authRequest.setDetails(authenticationDetailsSource.buildDetails(request));
  40.     }
  41.     /** * 获取手机号 */
  42.     private String obtainMobile(HttpServletRequest request) { 
  43.         return request.getParameter(mobileParameterName);
  44.     }
  46.     public void setPostOnly(boolean postOnly) { 
  47.         this.postOnly = postOnly;
  48.     }
  49. }

注：attemptAuthentication()方法：

过滤指定的url、httpMethod
获取所需请求参数数据封装生成一个未认证的AuthenticationToken
传递给AuthenticationManager认证
2.2.1.1.自定义认证登录提供者

  1. /** * 手机短信登录认证提供者 * * @author ： CatalpaFlat */
  2. public class MobileLoginAuthenticationProvider implements AuthenticationProvider { 
  4.     private static final Logger logger = LoggerFactory.getLogger(MobileLoginAuthenticationProvider.class.getName());
  6.     @Getter
  7.     @Setter
  8.     private UserDetailsService customUserDetailsService;
  10.     public MobileLoginAuthenticationProvider() { 
  11.         logger.info("MobileLoginAuthenticationProvider loading ...");
  12.     }
  14.     /** * 认证 */
  15.     @Override
  16.     public Authentication authenticate(Authentication authentication) throws AuthenticationException { 
  17.         //获取过滤器封装的token信息
  18.         MobileLoginAuthenticationToken authenticationToken = (MobileLoginAuthenticationToken) authentication;
  19.         //获取用户信息（数据库认证）
  20.         UserDetails userDetails = customUserDetailsService.loadUserByUsername((String) authenticationToken.getPrincipal());
  21.         //不通过
  22.         if (userDetails == null) { 
  23.             throw new InternalAuthenticationServiceException("Unable to obtain user information");
  24.         }
  25.         //通过
  26.         MobileLoginAuthenticationToken authenticationResult = new MobileLoginAuthenticationToken(userDetails, userDetails.getAuthorities());
  28.         authenticationResult.setDetails(authenticationToken.getDetails());
  30.         return authenticationResult;
  31.     }
  33.     /** * 根据token类型，来判断使用哪个Provider */
  34.     @Override
  35.     public boolean supports(Class<?> authentication) { 
  36.         return MobileLoginAuthenticationToken.class.isAssignableFrom(authentication);
  37.     }
  38. }

注：authenticate()方法

获取过滤器封装的token信息
调取UserDetailsService获取用户信息（数据库认证）->判断通过与否
通过则封装一个新的AuthenticationToken，并返回
2.2.1.1.自定义认证登录认证配置

  1. @Configuration(SpringBeanNameConstant.DEFAULT_CUSTOM_MOBILE_LOGIN_AUTHENTICATION_SECURITY_CONFIG_BN)
  2. public class MobileLoginAuthenticationSecurityConfig extends SecurityConfigurerAdapter<DefaultSecurityFilterChain, HttpSecurity> { 
  3.     private static final Logger logger = LoggerFactory.getLogger(MobileLoginAuthenticationSecurityConfig.class.getName());
  4.     @Value("${login.mobile.url}")
  5.     private String defaultMobileLoginUrl;
  6.     @Value("${login.mobile.parameter}")
  7.     private String defaultMobileLoginParameter;
  8.     @Value("${login.mobile.httpMethod}")
  9.     private String defaultMobileLoginHttpMethod;
  11.     @Autowired
  12.     private CustomYmlConfig customYmlConfig;
  13.     @Autowired
  14.     private UserDetailsService customUserDetailsService;
  15.     @Autowired
  16.     private AuthenticationSuccessHandler customAuthenticationSuccessHandler;
  17.     @Autowired
  18.     private AuthenticationFailureHandler customAuthenticationFailureHandler;
  21.     public MobileLoginAuthenticationSecurityConfig() { 
  22.         logger.info("MobileLoginAuthenticationSecurityConfig loading ...");
  23.     }
  25.     @Override
  26.     public void configure(HttpSecurity http) throws Exception { 
  27.         MobilePOJO mobile = customYmlConfig.getLogins().getMobile();
  28.         String url = mobile.getUrl();
  29.         String parameter = mobile.getParameter().getMobile();
  30.         String httpMethod = mobile.getHttpMethod();
  32.         MobileLoginAuthenticationFilter mobileLoginAuthenticationFilter = new MobileLoginAuthenticationFilter(StringUtils.isBlank(url) ? defaultMobileLoginUrl : url,
  33.                 StringUtils.isBlank(parameter) ? defaultMobileLoginUrl : parameter, StringUtils.isBlank(httpMethod) ? defaultMobileLoginHttpMethod : httpMethod);
  35.         mobileLoginAuthenticationFilter.setAuthenticationManager(http.getSharedObject(AuthenticationManager.class));
  36.         mobileLoginAuthenticationFilter.setAuthenticationSuccessHandler(customAuthenticationSuccessHandler);
  37.         mobileLoginAuthenticationFilter.setAuthenticationFailureHandler(customAuthenticationFailureHandler);
  39.         MobileLoginAuthenticationProvider mobileLoginAuthenticationProvider = new MobileLoginAuthenticationProvider();
  40.         mobileLoginAuthenticationProvider.setCustomUserDetailsService(customUserDetailsService);
  42.         http.authenticationProvider(mobileLoginAuthenticationProvider)
  43.                 .addFilterAfter(mobileLoginAuthenticationFilter, UsernamePasswordAuthenticationFilter.class);
  44.     }
  45. }

注：configure()方法

实例化AuthenticationFilter和AuthenticationProvider
将AuthenticationFilter和AuthenticationProvider添加到spring security中。
2.2.2.基于redis自定义验证码校验
2.2.2.1.基于redis自定义验证码过滤器

  1. /** * 验证码过滤器 * * @author ： CatalpaFlat */
  2. @Component(SpringBeanNameConstant.DEFAULT_VALIDATE_CODE_FILTER_BN)
  3. public class ValidateCodeFilter extends OncePerRequestFilter implements InitializingBean { 
  5.     private static final Logger logger = LoggerFactory.getLogger(ValidateCodeFilter.class.getName());
  7.     @Autowired
  8.     private CustomYmlConfig customYmlConfig;
  10.     @Autowired
  11.     private RedisTemplate<Object, Object> redisTemplate;
  13.     /** * 验证请求url与配置的url是否匹配的工具类 */
  14.     private AntPathMatcher pathMatcher = new AntPathMatcher();
  16.     public ValidateCodeFilter() { 
  17.         logger.info("Loading ValidateCodeFilter...");
  18.     }
  20.     @Override
  21.     protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response,
  22.                                     FilterChain filterChain) throws ServletException, IOException { 
  23.         String url = customYmlConfig.getLogins().getMobile().getUrl();
  24.         if (pathMatcher.match(url, request.getRequestURI())) { 
  25.             String deviceId = request.getHeader("deviceId");
  26.             if (StringUtils.isBlank(deviceId)) { 
  27.                 throw new CustomException(HttpStatus.NOT_ACCEPTABLE.value(), "Not deviceId in the head of the request");
  28.             }
  29.             String codeParamName = customYmlConfig.getLogins().getMobile().getParameter().getCode();
  30.             String code = request.getParameter(codeParamName);
  31.             if (StringUtils.isBlank(code)) { 
  32.                 throw new CustomException(HttpStatus.NOT_ACCEPTABLE.value(), "Not code in the parameters of the request");
  33.             }
  34.             String key = SystemConstant.DEFAULT_MOBILE_KEY_PIX + deviceId;
  35.             SmsCodePO smsCodePo = (SmsCodePO) redisTemplate.opsForValue().get(key);
  36.             if (smsCodePo.isExpried()){ 
  37.                 throw new CustomException(HttpStatus.BAD_REQUEST.value(), "The verification code has expired");
  38.             }
  39.             String smsCode = smsCodePo.getCode();
  40.             if (StringUtils.isBlank(smsCode)) { 
  41.                 throw new CustomException(HttpStatus.BAD_REQUEST.value(), "Verification code does not exist");
  42.             }
  43.             if (StringUtils.equals(code, smsCode)) { 
  44.                 redisTemplate.delete(key);
  45.                 //let it go
  46.                 filterChain.doFilter(request, response);
  47.             } else { 
  48.                 throw new CustomException(HttpStatus.BAD_REQUEST.value(), "Validation code is incorrect");
  49.             }
  50.         }else { 
  51.             //let it go
  52.             filterChain.doFilter(request, response);
  53.         }
  54.     }
  55. }

注：doFilterInternal()

自定义验证码过滤校验
2.2.2.2.将自定义验证码过滤器添加到spring security过滤器链

  1. http.addFilterBefore(validateCodeFilter, AbstractPreAuthenticatedProcessingFilter.class)

注：添加到认证预处理过滤器前

3.测试效果
发送验证码
在这里插入图片描述
假装发送
在这里插入图片描述
校验并登陆
在这里插入图片描述
校验并认证
在这里插入图片描述
最后附上源码地址：https://gitee.com/CatalpaFlat/springSecurity.git

作者：CatalpaFlat
链接：https://www.jianshu.com/p/7f913e0681fc
来源：简书
著作权归作者所有。商业转载请联系作者获得授权，非商业转载请注明出处。

发表评论

表情：
评论列表 （有 0 条评论，178人围观）

还没有评论，来说两句吧...

相关阅读