完善注释
This commit is contained in:
lsy
@@ -0,0 +1,6 @@
|
||||
#欢迎查看spring security browser权限认证框架说明
|
||||
|
||||
##相关配置参数说明
|
||||
- `ms.security.browser.html` 自定义登录页面的地址
|
||||
- `ms.security.browser.loginType` 身份认证后响应类型`REDIRECT`页面形式响应
|
||||
`JSON` json形式的响应
|
||||
-1
@@ -1,6 +1,5 @@
|
||||
package com.micro.fast.security.browser;
|
||||
|
||||
import org.springframework.boot.SpringApplication;
|
||||
import org.springframework.context.annotation.ComponentScan;
|
||||
import org.springframework.context.annotation.Configuration;
|
||||
|
||||
|
||||
+20
-10
@@ -12,26 +12,36 @@ import org.springframework.security.web.authentication.AuthenticationFailureHand
|
||||
import org.springframework.security.web.authentication.AuthenticationSuccessHandler;
|
||||
|
||||
/**
|
||||
* 配置spring security使用表单登录
|
||||
* spring security browser端的配置类
|
||||
* spring security的默认用户名是user
|
||||
* spring security的核心原理就是一组过滤器链
|
||||
* 核心过滤顺序是每经过一个过滤器这个过滤器都会做一个标记UsernamePasswordAuthenticationFiler（可配置）-> BasicAuthenticationFilter(可配置) -> 最后一个过滤器是FilterSecurityInterceptor（不可配置）这个过滤器是根据配置判断这个请求能不能访问这个资源的
|
||||
*spring security的默认用户名是user
|
||||
* 过滤器是ExceptionTranslationFilter（不可配置）是在FilterSecurityInterceptor之前的过滤器负责处理FilterSecurityInterceptor
|
||||
* 抛出的异常。根据配置进行处理
|
||||
* 核心过滤顺序是:（每经过一个过滤器这个过滤器都会做一个标记）
|
||||
* UsernamePasswordAuthenticationFiler（可配置）-> BasicAuthenticationFilter(可配置) ->ExceptionTranslationFilter（不可配置）
|
||||
* (负责处理FilterSecurityInterceptor抛出的异常)->最后一个过滤器是FilterSecurityInterceptor（不可配置）这个过滤器是根据配置判断这个
|
||||
* 请求能不能访问这个资源的
|
||||
*/
|
||||
@Configuration
|
||||
public class BrowserSecurityConfig extends WebSecurityConfigurerAdapter {
|
||||
/**
|
||||
* 注入身份认证框架配置参数对象
|
||||
*/
|
||||
@Autowired
|
||||
private SecurityProperties securityProperties;
|
||||
|
||||
/**
|
||||
* 注入身份认证成功后续处理对象
|
||||
*/
|
||||
@Autowired
|
||||
private AuthenticationSuccessHandler msAuthenticationSuccessHandler;
|
||||
|
||||
/**
|
||||
* 输入身份认证失败后后续处理对象
|
||||
*/
|
||||
@Autowired
|
||||
private AuthenticationFailureHandler msAuthenticationFailureHandler;
|
||||
|
||||
/**
|
||||
* 配置校验方式
|
||||
* 自定义身份认证配置
|
||||
* @param http
|
||||
* @throws Exception
|
||||
*/
|
||||
@@ -40,18 +50,18 @@ public class BrowserSecurityConfig extends WebSecurityConfigurerAdapter {
|
||||
http.formLogin()//使用表单登录
|
||||
.loginPage("/authentication/require")//自定义登录页面
|
||||
.loginProcessingUrl("/user/login")//配置spring security登录接口的访问地址,用于在自定义的登录页面提交请求
|
||||
.successHandler(msAuthenticationSuccessHandler)//defined authenticationSuccessHandler
|
||||
.failureHandler(msAuthenticationFailureHandler)
|
||||
.successHandler(msAuthenticationSuccessHandler)//定义身份认证成功后处理对象
|
||||
.failureHandler(msAuthenticationFailureHandler)//定义身份认证失败后处理对象
|
||||
.and()
|
||||
.authorizeRequests()//下面是权限配置
|
||||
.antMatchers("/authentication/require",securityProperties.getBrowser().getHtml()).permitAll()//当访问这个页面的时候不进行权限校验,对用户自定义的登录页也不进行权限认证
|
||||
.antMatchers("/authentication/require",securityProperties.getBrowser().getHtml()).permitAll()//当访问这个页面的时候不进行身份认证,对用户自定义的登录页也不进行权限认证
|
||||
.anyRequest()//任何请求
|
||||
.authenticated()//都需要身份认证
|
||||
.and()
|
||||
.csrf().disable();//暂时关闭掉跨站请求攻击防护
|
||||
}
|
||||
/**
|
||||
* 定义密码的加密解密类的bean
|
||||
* 定义身份认证红密码的加密解密类的bean
|
||||
* @return
|
||||
*/
|
||||
@Bean
|
||||
|
||||
+8
-5
@@ -8,9 +8,7 @@ import org.slf4j.LoggerFactory;
|
||||
import org.springframework.beans.factory.annotation.Autowired;
|
||||
import org.springframework.http.HttpStatus;
|
||||
import org.springframework.security.core.AuthenticationException;
|
||||
import org.springframework.security.web.authentication.AuthenticationFailureHandler;
|
||||
import org.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler;
|
||||
import org.springframework.security.web.authentication.SimpleUrlAuthenticationSuccessHandler;
|
||||
import org.springframework.stereotype.Component;
|
||||
|
||||
import javax.servlet.ServletException;
|
||||
@@ -19,15 +17,20 @@ import javax.servlet.http.HttpServletResponse;
|
||||
import java.io.IOException;
|
||||
|
||||
/**
|
||||
* Created by root on 12/5/17.
|
||||
* AuthenticationFailureHandler
|
||||
* 身份认证失败的后续处理类
|
||||
*/
|
||||
@Component("msAuthenticationFailureHandler")
|
||||
public class MsAuthenticationFailureHandler extends SimpleUrlAuthenticationFailureHandler {
|
||||
private static final Logger log = LoggerFactory.getLogger(MsAuthenticationFailureHandler.class);
|
||||
/**
|
||||
* object <=> json 处理对象
|
||||
*/
|
||||
@Autowired
|
||||
private ObjectMapper objectMapper;
|
||||
|
||||
/**
|
||||
* 安全框架配置参数对象
|
||||
*/
|
||||
@Autowired
|
||||
private SecurityProperties securityProperties;
|
||||
|
||||
@@ -37,7 +40,7 @@ public class MsAuthenticationFailureHandler extends SimpleUrlAuthenticationFailu
|
||||
, HttpServletResponse httpServletResponse
|
||||
, AuthenticationException e)
|
||||
throws IOException, ServletException {
|
||||
|
||||
//根据配置参数判断身份认证失败后的返回类型进行响应
|
||||
if (LoginType.JSON.equals(securityProperties.getBrowser().getLoginType())){
|
||||
log.info("failure");
|
||||
httpServletResponse.setStatus(HttpStatus.INTERNAL_SERVER_ERROR.value());
|
||||
|
||||
+6
-2
@@ -24,13 +24,17 @@ public class MsAuthenticationSuccessHandler extends SavedRequestAwareAuthenticat
|
||||
|
||||
private static final Logger log = LoggerFactory.getLogger(MsAuthenticationSuccessHandler.class);
|
||||
|
||||
/**
|
||||
* 安全框架配置参数对象
|
||||
*/
|
||||
@Autowired
|
||||
private SecurityProperties securityProperties;
|
||||
/**
|
||||
* sping mvc authenticationSuccess
|
||||
* object <=> json 处理对象
|
||||
*/
|
||||
@Autowired
|
||||
private ObjectMapper objectMapper;
|
||||
|
||||
/**
|
||||
* 登录成功后的处理方法
|
||||
* @param httpServletRequest
|
||||
@@ -45,7 +49,7 @@ public class MsAuthenticationSuccessHandler extends SavedRequestAwareAuthenticat
|
||||
, HttpServletResponse httpServletResponse
|
||||
, Authentication authentication
|
||||
) throws IOException, ServletException {
|
||||
|
||||
//根据配置参数判断身份认证成功后的返回类型进行响应
|
||||
if (LoginType.JSON.equals(securityProperties.getBrowser().getLoginType())){
|
||||
log.info("登录成功");
|
||||
httpServletResponse.setContentType("application/json;charset=UTF-8");
|
||||
|
||||
+3
-8
@@ -1,14 +1,10 @@
|
||||
package com.micro.fast.security.browser.controller;
|
||||
|
||||
import com.micro.fast.security.core.config.param.BrowserProperties;
|
||||
import com.micro.fast.security.core.config.param.SecurityProperties;
|
||||
import org.apache.commons.lang3.StringUtils;
|
||||
import org.hibernate.validator.constraints.NotBlank;
|
||||
import org.slf4j.Logger;
|
||||
import org.slf4j.LoggerFactory;
|
||||
import org.springframework.beans.factory.annotation.Autowired;
|
||||
import org.springframework.beans.factory.annotation.Value;
|
||||
import org.springframework.boot.context.properties.ConfigurationProperties;
|
||||
import org.springframework.http.HttpStatus;
|
||||
import org.springframework.security.web.DefaultRedirectStrategy;
|
||||
import org.springframework.security.web.RedirectStrategy;
|
||||
@@ -21,7 +17,6 @@ import org.springframework.web.bind.annotation.RestController;
|
||||
|
||||
import javax.servlet.http.HttpServletRequest;
|
||||
import javax.servlet.http.HttpServletResponse;
|
||||
import javax.validation.Valid;
|
||||
import java.io.IOException;
|
||||
|
||||
/**
|
||||
@@ -35,7 +30,7 @@ public class BrowserSecurityController {
|
||||
|
||||
private static final Logger log = LoggerFactory.getLogger(BrowserSecurityController.class);
|
||||
/**
|
||||
* 用于获取引发权限认证的请求缓存
|
||||
* 用于获取引发身份认证的请求缓存
|
||||
*/
|
||||
private RequestCache requestCache = new HttpSessionRequestCache();
|
||||
|
||||
@@ -44,14 +39,14 @@ public class BrowserSecurityController {
|
||||
@RequestMapping("/authentication/require")
|
||||
@ResponseStatus(code = HttpStatus.UNAUTHORIZED)
|
||||
public String requireAuthentication(HttpServletRequest request, HttpServletResponse response) throws IOException {
|
||||
//根据当前请求获取上一次请求的地址
|
||||
//根据当前请求获取上一次请求的缓存
|
||||
SavedRequest savedRequest = requestCache.getRequest(request, response);
|
||||
//获取上一次请求的地址
|
||||
if (savedRequest!=null){
|
||||
String redirectUrl = savedRequest.getRedirectUrl();
|
||||
if (StringUtils.isNotBlank(redirectUrl)){
|
||||
log.info("引发跳转的请求是：{}",redirectUrl);
|
||||
//如果是由于访问触发的权限认证就重定向到登录页面
|
||||
//如果是由于访问页面触发的权限认证就重定向到登录页面
|
||||
if (StringUtils.endsWithIgnoreCase(redirectUrl,".html")){
|
||||
//进行请求的重定向重定向到用户定义登录页面
|
||||
redirectStrategy.sendRedirect(request,response,securityProperties.getBrowser().getHtml());
|
||||
|
||||
+1
-1
@@ -4,7 +4,7 @@ import org.springframework.security.core.userdetails.User;
|
||||
import org.springframework.stereotype.Service;
|
||||
|
||||
/**
|
||||
* 用于根据spring security传入的username获取用户的详细信息
|
||||
* 用于根据spring security传入的username获取用户的详细信息接口
|
||||
*/
|
||||
public interface UserService {
|
||||
User getUserByUsername(String username);
|
||||
|
||||
-1
@@ -1,7 +1,6 @@
|
||||
package com.micro.fast.security.core;
|
||||
|
||||
import com.micro.fast.security.core.config.param.SecurityProperties;
|
||||
import org.springframework.boot.SpringApplication;
|
||||
import org.springframework.boot.context.properties.EnableConfigurationProperties;
|
||||
import org.springframework.context.annotation.ComponentScan;
|
||||
import org.springframework.context.annotation.Configuration;
|
||||
|
||||
+8
-2
@@ -3,15 +3,21 @@ package com.micro.fast.security.core.config.param;
|
||||
import org.hibernate.validator.constraints.NotBlank;
|
||||
|
||||
/**
|
||||
* 浏览器身份认证参数
|
||||
* 浏览器身份认证配置参数
|
||||
* 配合SecurityProperties中的Valid注解进行参数合法性校验
|
||||
*/
|
||||
public class BrowserProperties {
|
||||
|
||||
/**
|
||||
* 用户自自定义的登录页面,不能为空
|
||||
*
|
||||
*/
|
||||
@NotBlank //配合SecurityProperties中的Valid注解进行参数的校验
|
||||
@NotBlank
|
||||
private String html;
|
||||
|
||||
/**
|
||||
* 进行身份认证后返回的类型
|
||||
*/
|
||||
private LoginType loginType = LoginType.JSON;
|
||||
|
||||
public String getHtml() {
|
||||
|
||||
+3
-2
@@ -1,8 +1,9 @@
|
||||
package com.micro.fast.security.core.config.param;
|
||||
|
||||
/**
|
||||
* Created by root on 12/5/17.
|
||||
* 用户进行身份认证后返回的类型
|
||||
*/
|
||||
public enum LoginType {
|
||||
REDIRECT,JSON;
|
||||
REDIRECT //以页面的形式返回身份认证结果，如果成功的话就返回触发身份认证的页面，如果失败的就返回错误页面
|
||||
,JSON; //以json形式返回结果
|
||||
}
|
||||
|
||||
+3
-2
@@ -5,14 +5,15 @@ import org.springframework.boot.context.properties.ConfigurationProperties;
|
||||
import javax.validation.Valid;
|
||||
|
||||
/**
|
||||
* 用于从application.yml配置文件中加载以ms.security为前缀的属性， ms spring security 配置参数
|
||||
* 用于从application.yml配置文件中加载以ms.security为前缀的配置属性， ms spring security 配置参数
|
||||
*/
|
||||
@ConfigurationProperties(prefix = "ms.security")
|
||||
public class SecurityProperties {
|
||||
/**
|
||||
* 浏览器身份认证配置
|
||||
* 对带有校验注解的对象进行属性校验
|
||||
*/
|
||||
@Valid//对带有校验注解的对象进行参数校验
|
||||
@Valid
|
||||
private BrowserProperties browser = new BrowserProperties();
|
||||
|
||||
public BrowserProperties getBrowser() {
|
||||
|
||||
Reference in New Issue
Block a user