diff --git a/boot-starter/boot-starter-security/boot-starter-security-browser/README.md b/boot-starter/boot-starter-security/boot-starter-security-browser/README.md index e69de29..ddf8b6a 100644 --- a/boot-starter/boot-starter-security/boot-starter-security-browser/README.md +++ b/boot-starter/boot-starter-security/boot-starter-security-browser/README.md @@ -0,0 +1,6 @@ +#欢迎查看spring security browser权限认证框架说明 + +##相关配置参数说明 +- `ms.security.browser.html` 自定义登录页面的地址 +- `ms.security.browser.loginType` 身份认证后响应类型`REDIRECT`页面形式响应 +`JSON` json形式的响应 \ No newline at end of file diff --git a/boot-starter/boot-starter-security/boot-starter-security-browser/src/main/java/com/micro/fast/security/browser/BootStarterSecurityBrowserApplication.java b/boot-starter/boot-starter-security/boot-starter-security-browser/src/main/java/com/micro/fast/security/browser/BootStarterSecurityBrowserApplication.java index e32ecc7..25e68c3 100644 --- a/boot-starter/boot-starter-security/boot-starter-security-browser/src/main/java/com/micro/fast/security/browser/BootStarterSecurityBrowserApplication.java +++ b/boot-starter/boot-starter-security/boot-starter-security-browser/src/main/java/com/micro/fast/security/browser/BootStarterSecurityBrowserApplication.java @@ -1,6 +1,5 @@ package com.micro.fast.security.browser; -import org.springframework.boot.SpringApplication; import org.springframework.context.annotation.ComponentScan; import org.springframework.context.annotation.Configuration; diff --git a/boot-starter/boot-starter-security/boot-starter-security-browser/src/main/java/com/micro/fast/security/browser/config/BrowserSecurityConfig.java b/boot-starter/boot-starter-security/boot-starter-security-browser/src/main/java/com/micro/fast/security/browser/config/BrowserSecurityConfig.java index 366e740..36fa5de 100644 --- a/boot-starter/boot-starter-security/boot-starter-security-browser/src/main/java/com/micro/fast/security/browser/config/BrowserSecurityConfig.java +++ b/boot-starter/boot-starter-security/boot-starter-security-browser/src/main/java/com/micro/fast/security/browser/config/BrowserSecurityConfig.java @@ -12,26 +12,36 @@ import org.springframework.security.web.authentication.AuthenticationFailureHand import org.springframework.security.web.authentication.AuthenticationSuccessHandler; /** - * 配置spring security使用表单登录 + * spring security browser端的配置类 + * spring security的默认用户名是user * spring security的核心原理就是一组过滤器链 - * 核心过滤顺序是每经过一个过滤器这个过滤器都会做一个标记UsernamePasswordAuthenticationFiler（可配置）-> BasicAuthenticationFilter(可配置) -> 最后一个过滤器是FilterSecurityInterceptor（不可配置）这个过滤器是根据配置判断这个请求能不能访问这个资源的 - *spring security的默认用户名是user - * 过滤器是ExceptionTranslationFilter（不可配置）是在FilterSecurityInterceptor之前的过滤器负责处理FilterSecurityInterceptor - * 抛出的异常。根据配置进行处理 + * 核心过滤顺序是:（每经过一个过滤器这个过滤器都会做一个标记） + * UsernamePasswordAuthenticationFiler（可配置）-> BasicAuthenticationFilter(可配置) ->ExceptionTranslationFilter（不可配置） + * (负责处理FilterSecurityInterceptor抛出的异常)->最后一个过滤器是FilterSecurityInterceptor（不可配置）这个过滤器是根据配置判断这个 + * 请求能不能访问这个资源的 */ @Configuration public class BrowserSecurityConfig extends WebSecurityConfigurerAdapter { + /** + * 注入身份认证框架配置参数对象 + */ @Autowired private SecurityProperties securityProperties; + /** + * 注入身份认证成功后续处理对象 + */ @Autowired private AuthenticationSuccessHandler msAuthenticationSuccessHandler; + /** + * 输入身份认证失败后后续处理对象 + */ @Autowired private AuthenticationFailureHandler msAuthenticationFailureHandler; /** - * 配置校验方式 + * 自定义身份认证配置 * @param http * @throws Exception */ @@ -40,18 +50,18 @@ public class BrowserSecurityConfig extends WebSecurityConfigurerAdapter { http.formLogin()//使用表单登录 .loginPage("/authentication/require")//自定义登录页面 .loginProcessingUrl("/user/login")//配置spring security登录接口的访问地址,用于在自定义的登录页面提交请求 - .successHandler(msAuthenticationSuccessHandler)//defined authenticationSuccessHandler - .failureHandler(msAuthenticationFailureHandler) + .successHandler(msAuthenticationSuccessHandler)//定义身份认证成功后处理对象 + .failureHandler(msAuthenticationFailureHandler)//定义身份认证失败后处理对象 .and() .authorizeRequests()//下面是权限配置 - .antMatchers("/authentication/require",securityProperties.getBrowser().getHtml()).permitAll()//当访问这个页面的时候不进行权限校验,对用户自定义的登录页也不进行权限认证 + .antMatchers("/authentication/require",securityProperties.getBrowser().getHtml()).permitAll()//当访问这个页面的时候不进行身份认证,对用户自定义的登录页也不进行权限认证 .anyRequest()//任何请求 .authenticated()//都需要身份认证 .and() .csrf().disable();//暂时关闭掉跨站请求攻击防护 } /** - * 定义密码的加密解密类的bean + * 定义身份认证红密码的加密解密类的bean * @return */ @Bean diff --git a/boot-starter/boot-starter-security/boot-starter-security-browser/src/main/java/com/micro/fast/security/browser/config/component/MsAuthenticationFailureHandler.java b/boot-starter/boot-starter-security/boot-starter-security-browser/src/main/java/com/micro/fast/security/browser/config/component/MsAuthenticationFailureHandler.java index e1c930c..aecb528 100644 --- a/boot-starter/boot-starter-security/boot-starter-security-browser/src/main/java/com/micro/fast/security/browser/config/component/MsAuthenticationFailureHandler.java +++ b/boot-starter/boot-starter-security/boot-starter-security-browser/src/main/java/com/micro/fast/security/browser/config/component/MsAuthenticationFailureHandler.java @@ -8,9 +8,7 @@ import org.slf4j.LoggerFactory; import org.springframework.beans.factory.annotation.Autowired; import org.springframework.http.HttpStatus; import org.springframework.security.core.AuthenticationException; -import org.springframework.security.web.authentication.AuthenticationFailureHandler; import org.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler; -import org.springframework.security.web.authentication.SimpleUrlAuthenticationSuccessHandler; import org.springframework.stereotype.Component; import javax.servlet.ServletException; @@ -19,15 +17,20 @@ import javax.servlet.http.HttpServletResponse; import java.io.IOException; /** - * Created by root on 12/5/17. * AuthenticationFailureHandler + * 身份认证失败的后续处理类 */ @Component("msAuthenticationFailureHandler") public class MsAuthenticationFailureHandler extends SimpleUrlAuthenticationFailureHandler { private static final Logger log = LoggerFactory.getLogger(MsAuthenticationFailureHandler.class); + /** + * object <=> json 处理对象 + */ @Autowired private ObjectMapper objectMapper; - + /** + * 安全框架配置参数对象 + */ @Autowired private SecurityProperties securityProperties; @@ -37,7 +40,7 @@ public class MsAuthenticationFailureHandler extends SimpleUrlAuthenticationFailu , HttpServletResponse httpServletResponse , AuthenticationException e) throws IOException, ServletException { - + //根据配置参数判断身份认证失败后的返回类型进行响应 if (LoginType.JSON.equals(securityProperties.getBrowser().getLoginType())){ log.info("failure"); httpServletResponse.setStatus(HttpStatus.INTERNAL_SERVER_ERROR.value()); diff --git a/boot-starter/boot-starter-security/boot-starter-security-browser/src/main/java/com/micro/fast/security/browser/config/component/MsAuthenticationSuccessHandler.java b/boot-starter/boot-starter-security/boot-starter-security-browser/src/main/java/com/micro/fast/security/browser/config/component/MsAuthenticationSuccessHandler.java index 87dad5d..8f47607 100644 --- a/boot-starter/boot-starter-security/boot-starter-security-browser/src/main/java/com/micro/fast/security/browser/config/component/MsAuthenticationSuccessHandler.java +++ b/boot-starter/boot-starter-security/boot-starter-security-browser/src/main/java/com/micro/fast/security/browser/config/component/MsAuthenticationSuccessHandler.java @@ -24,13 +24,17 @@ public class MsAuthenticationSuccessHandler extends SavedRequestAwareAuthenticat private static final Logger log = LoggerFactory.getLogger(MsAuthenticationSuccessHandler.class); + /** + * 安全框架配置参数对象 + */ @Autowired private SecurityProperties securityProperties; /** - * sping mvc authenticationSuccess + * object <=> json 处理对象 */ @Autowired private ObjectMapper objectMapper; + /** * 登录成功后的处理方法 * @param httpServletRequest @@ -45,7 +49,7 @@ public class MsAuthenticationSuccessHandler extends SavedRequestAwareAuthenticat , HttpServletResponse httpServletResponse , Authentication authentication ) throws IOException, ServletException { - + //根据配置参数判断身份认证成功后的返回类型进行响应 if (LoginType.JSON.equals(securityProperties.getBrowser().getLoginType())){ log.info("登录成功"); httpServletResponse.setContentType("application/json;charset=UTF-8"); diff --git a/boot-starter/boot-starter-security/boot-starter-security-browser/src/main/java/com/micro/fast/security/browser/controller/BrowserSecurityController.java b/boot-starter/boot-starter-security/boot-starter-security-browser/src/main/java/com/micro/fast/security/browser/controller/BrowserSecurityController.java index 044e962..3783ffe 100644 --- a/boot-starter/boot-starter-security/boot-starter-security-browser/src/main/java/com/micro/fast/security/browser/controller/BrowserSecurityController.java +++ b/boot-starter/boot-starter-security/boot-starter-security-browser/src/main/java/com/micro/fast/security/browser/controller/BrowserSecurityController.java @@ -1,14 +1,10 @@ package com.micro.fast.security.browser.controller; -import com.micro.fast.security.core.config.param.BrowserProperties; import com.micro.fast.security.core.config.param.SecurityProperties; import org.apache.commons.lang3.StringUtils; -import org.hibernate.validator.constraints.NotBlank; import org.slf4j.Logger; import org.slf4j.LoggerFactory; import org.springframework.beans.factory.annotation.Autowired; -import org.springframework.beans.factory.annotation.Value; -import org.springframework.boot.context.properties.ConfigurationProperties; import org.springframework.http.HttpStatus; import org.springframework.security.web.DefaultRedirectStrategy; import org.springframework.security.web.RedirectStrategy; @@ -21,7 +17,6 @@ import org.springframework.web.bind.annotation.RestController; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; -import javax.validation.Valid; import java.io.IOException; /** @@ -35,7 +30,7 @@ public class BrowserSecurityController { private static final Logger log = LoggerFactory.getLogger(BrowserSecurityController.class); /** - * 用于获取引发权限认证的请求缓存 + * 用于获取引发身份认证的请求缓存 */ private RequestCache requestCache = new HttpSessionRequestCache(); @@ -44,14 +39,14 @@ public class BrowserSecurityController { @RequestMapping("/authentication/require") @ResponseStatus(code = HttpStatus.UNAUTHORIZED) public String requireAuthentication(HttpServletRequest request, HttpServletResponse response) throws IOException { - //根据当前请求获取上一次请求的地址 + //根据当前请求获取上一次请求的缓存 SavedRequest savedRequest = requestCache.getRequest(request, response); //获取上一次请求的地址 if (savedRequest!=null){ String redirectUrl = savedRequest.getRedirectUrl(); if (StringUtils.isNotBlank(redirectUrl)){ log.info("引发跳转的请求是：{}",redirectUrl); - //如果是由于访问触发的权限认证就重定向到登录页面 + //如果是由于访问页面触发的权限认证就重定向到登录页面 if (StringUtils.endsWithIgnoreCase(redirectUrl,".html")){ //进行请求的重定向重定向到用户定义登录页面 redirectStrategy.sendRedirect(request,response,securityProperties.getBrowser().getHtml()); diff --git a/boot-starter/boot-starter-security/boot-starter-security-browser/src/main/java/com/micro/fast/security/browser/service/UserService.java b/boot-starter/boot-starter-security/boot-starter-security-browser/src/main/java/com/micro/fast/security/browser/service/UserService.java index 99dfac6..f733253 100644 --- a/boot-starter/boot-starter-security/boot-starter-security-browser/src/main/java/com/micro/fast/security/browser/service/UserService.java +++ b/boot-starter/boot-starter-security/boot-starter-security-browser/src/main/java/com/micro/fast/security/browser/service/UserService.java @@ -4,7 +4,7 @@ import org.springframework.security.core.userdetails.User; import org.springframework.stereotype.Service; /** - * 用于根据spring security传入的username获取用户的详细信息 + * 用于根据spring security传入的username获取用户的详细信息接口 */ public interface UserService { User getUserByUsername(String username); diff --git a/boot-starter/boot-starter-security/boot-starter-security-core/src/main/java/com/micro/fast/security/core/BootStarterSecurityCoreApplication.java b/boot-starter/boot-starter-security/boot-starter-security-core/src/main/java/com/micro/fast/security/core/BootStarterSecurityCoreApplication.java index f988e63..0e69f86 100644 --- a/boot-starter/boot-starter-security/boot-starter-security-core/src/main/java/com/micro/fast/security/core/BootStarterSecurityCoreApplication.java +++ b/boot-starter/boot-starter-security/boot-starter-security-core/src/main/java/com/micro/fast/security/core/BootStarterSecurityCoreApplication.java @@ -1,7 +1,6 @@ package com.micro.fast.security.core; import com.micro.fast.security.core.config.param.SecurityProperties; -import org.springframework.boot.SpringApplication; import org.springframework.boot.context.properties.EnableConfigurationProperties; import org.springframework.context.annotation.ComponentScan; import org.springframework.context.annotation.Configuration; diff --git a/boot-starter/boot-starter-security/boot-starter-security-core/src/main/java/com/micro/fast/security/core/config/param/BrowserProperties.java b/boot-starter/boot-starter-security/boot-starter-security-core/src/main/java/com/micro/fast/security/core/config/param/BrowserProperties.java index 039aadc..33e4c0a 100644 --- a/boot-starter/boot-starter-security/boot-starter-security-core/src/main/java/com/micro/fast/security/core/config/param/BrowserProperties.java +++ b/boot-starter/boot-starter-security/boot-starter-security-core/src/main/java/com/micro/fast/security/core/config/param/BrowserProperties.java @@ -3,15 +3,21 @@ package com.micro.fast.security.core.config.param; import org.hibernate.validator.constraints.NotBlank; /** - * 浏览器身份认证参数 + * 浏览器身份认证配置参数 + * 配合SecurityProperties中的Valid注解进行参数合法性校验 */ public class BrowserProperties { + /** * 用户自自定义的登录页面,不能为空 + * */ - @NotBlank //配合SecurityProperties中的Valid注解进行参数的校验 + @NotBlank private String html; + /** + * 进行身份认证后返回的类型 + */ private LoginType loginType = LoginType.JSON; public String getHtml() { diff --git a/boot-starter/boot-starter-security/boot-starter-security-core/src/main/java/com/micro/fast/security/core/config/param/LoginType.java b/boot-starter/boot-starter-security/boot-starter-security-core/src/main/java/com/micro/fast/security/core/config/param/LoginType.java index 7769f7e..54a8700 100644 --- a/boot-starter/boot-starter-security/boot-starter-security-core/src/main/java/com/micro/fast/security/core/config/param/LoginType.java +++ b/boot-starter/boot-starter-security/boot-starter-security-core/src/main/java/com/micro/fast/security/core/config/param/LoginType.java @@ -1,8 +1,9 @@ package com.micro.fast.security.core.config.param; /** - * Created by root on 12/5/17. + * 用户进行身份认证后返回的类型 */ public enum LoginType { - REDIRECT,JSON; + REDIRECT //以页面的形式返回身份认证结果，如果成功的话就返回触发身份认证的页面，如果失败的就返回错误页面 + ,JSON; //以json形式返回结果 } diff --git a/boot-starter/boot-starter-security/boot-starter-security-core/src/main/java/com/micro/fast/security/core/config/param/SecurityProperties.java b/boot-starter/boot-starter-security/boot-starter-security-core/src/main/java/com/micro/fast/security/core/config/param/SecurityProperties.java index 5fca676..ee4b71e 100644 --- a/boot-starter/boot-starter-security/boot-starter-security-core/src/main/java/com/micro/fast/security/core/config/param/SecurityProperties.java +++ b/boot-starter/boot-starter-security/boot-starter-security-core/src/main/java/com/micro/fast/security/core/config/param/SecurityProperties.java @@ -5,14 +5,15 @@ import org.springframework.boot.context.properties.ConfigurationProperties; import javax.validation.Valid; /** - * 用于从application.yml配置文件中加载以ms.security为前缀的属性， ms spring security 配置参数 + * 用于从application.yml配置文件中加载以ms.security为前缀的配置属性， ms spring security 配置参数 */ @ConfigurationProperties(prefix = "ms.security") public class SecurityProperties { /** * 浏览器身份认证配置 + * 对带有校验注解的对象进行属性校验 */ - @Valid//对带有校验注解的对象进行参数校验 + @Valid private BrowserProperties browser = new BrowserProperties(); public BrowserProperties getBrowser() {