diff --git a/boot-starter/boot-starter-security/boot-starter-security-browser/README.md b/boot-starter/boot-starter-security/boot-starter-security-browser/README.md index a0e3e7b..7e6757f 100644 --- a/boot-starter/boot-starter-security/boot-starter-security-browser/README.md +++ b/boot-starter/boot-starter-security/boot-starter-security-browser/README.md @@ -3,6 +3,7 @@ ##相关配置参数说明 - `ms.security.browser.html` 自定义登录页面的地址 - `ms.security.browser.loginType` 身份认证后响应类型`REDIRECT`页面形式响应 +- `ms.security.browser.rememberMeSeconds` 记住我的时间，单位是秒。默认的时间是3600秒 `JSON` json形式的响应 - 定义自己的根据用户名获取密码的bean,定义自己的bean的名字为`userServiceImpl`即可 - `/authentication/require`处理身份认证跳转的接口地址 \ No newline at end of file diff --git a/boot-starter/boot-starter-security/boot-starter-security-browser/src/main/java/com/micro/fast/security/browser/config/BrowserSecurityConfig.java b/boot-starter/boot-starter-security/boot-starter-security-browser/src/main/java/com/micro/fast/security/browser/config/BrowserSecurityConfig.java index 6bca44e..97b1118 100644 --- a/boot-starter/boot-starter-security/boot-starter-security-browser/src/main/java/com/micro/fast/security/browser/config/BrowserSecurityConfig.java +++ b/boot-starter/boot-starter-security/boot-starter-security-browser/src/main/java/com/micro/fast/security/browser/config/BrowserSecurityConfig.java @@ -4,15 +4,21 @@ import com.micro.fast.security.core.config.param.SecurityProperties; import com.micro.fast.security.core.filter.ValidateCodeFilter; import com.micro.fast.security.core.pojo.ValidateCode; import org.springframework.beans.factory.annotation.Autowired; +import org.springframework.beans.factory.annotation.Qualifier; import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Configuration; import org.springframework.security.config.annotation.web.builders.HttpSecurity; import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter; +import org.springframework.security.core.userdetails.UserDetailsService; import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder; import org.springframework.security.crypto.password.PasswordEncoder; import org.springframework.security.web.authentication.AuthenticationFailureHandler; import org.springframework.security.web.authentication.AuthenticationSuccessHandler; import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter; +import org.springframework.security.web.authentication.rememberme.JdbcTokenRepositoryImpl; +import org.springframework.security.web.authentication.rememberme.PersistentTokenRepository; + +import javax.sql.DataSource; /** * spring security browser端的配置类 @@ -42,7 +48,7 @@ public class BrowserSecurityConfig extends WebSecurityConfigurerAdapter { * 注入身份认证成功后续处理对象 */ @Autowired - private AuthenticationSuccessHandler msAuthenticationSuccessHandler; + private AuthenticationSuccessHandler msAuthenticationSuccessHandler; /** * 输入身份认证失败后后续处理对象 @@ -50,8 +56,19 @@ public class BrowserSecurityConfig extends WebSecurityConfigurerAdapter { @Autowired private AuthenticationFailureHandler msAuthenticationFailureHandler; + /** + * 需要注入数据源 + */ + @Autowired + @Qualifier("masterDataSource") + private DataSource dataSource; + + @Autowired + private UserDetailsService userDetailsService; + /** * 自定义身份认证配置 + * * @param http * @throws Exception */ @@ -63,26 +80,41 @@ public class BrowserSecurityConfig extends WebSecurityConfigurerAdapter { validateCodeFilter.setSecurityProperties(securityProperties); validateCodeFilter.afterPropertiesSet(); http - .addFilterBefore(validateCodeFilter, UsernamePasswordAuthenticationFilter.class)//添加自定义的验证码处理器，在用户密码校验过滤器之前 - .formLogin()//使用表单登录 - .loginPage("/authentication/require")//自定义登录页面 - .loginProcessingUrl("/user/login")//配置spring security登录接口的访问地址,用于在自定义的登录页面提交请求 - .successHandler(msAuthenticationSuccessHandler)//定义身份认证成功后处理对象 - .failureHandler(msAuthenticationFailureHandler)//定义身份认证失败后处理对象 - .and() - .authorizeRequests()//下面是权限配置 - .antMatchers("/user/login","/code/image","/authentication/require",securityProperties.getBrowser().getHtml()).permitAll()//当访问这个页面的时候不进行身份认证,对用户自定义的登录页也不进行权限认证 - .anyRequest()//任何请求 - .authenticated()//都需要身份认证 - .and() - .csrf().disable();//暂时关闭掉跨站请求攻击防护 + .addFilterBefore(validateCodeFilter, UsernamePasswordAuthenticationFilter.class)//添加自定义的验证码处理器，在用户密码校验过滤器之前 + .formLogin()//使用表单登录 + .loginPage("/authentication/require")//自定义登录页面 + .loginProcessingUrl("/user/login")//配置spring security登录接口的访问地址,用于在自定义的登录页面提交请求 + .successHandler(msAuthenticationSuccessHandler)//定义身份认证成功后处理对象 + .failureHandler(msAuthenticationFailureHandler)//定义身份认证失败后处理对象 + .and() + .rememberMe() + .tokenRepository(persistentTokenRepository())//设置token的存储方式 + .tokenValiditySeconds(securityProperties.getBrowser().getRememberMeSeconds())//设置过期秒数 + .userDetailsService(userDetailsService)//设置获取用户信息后登录的方式 + .and() + .authorizeRequests()//下面是权限配置 + .antMatchers("/user/login", "/code/image", "/authentication/require", securityProperties.getBrowser().getHtml()).permitAll()//当访问这个页面的时候不进行身份认证,对用户自定义的登录页也不进行权限认证 + .anyRequest()//任何请求 + .authenticated()//都需要身份认证 + .and() + .csrf().disable();//暂时关闭掉跨站请求攻击防护 } + /** * 定义身份认证红密码的加密解密类的bean * @return */ @Bean - public PasswordEncoder passwordEncoder(){ + public PasswordEncoder passwordEncoder() { return new BCryptPasswordEncoder(); } + + @Bean + public PersistentTokenRepository persistentTokenRepository() { + JdbcTokenRepositoryImpl jdbcTokenRepository = new JdbcTokenRepositoryImpl(); + jdbcTokenRepository.setDataSource(dataSource); + //启动的时候创建表 + jdbcTokenRepository.setCreateTableOnStartup(true); + return jdbcTokenRepository; + } } diff --git a/boot-starter/boot-starter-security/boot-starter-security-browser/src/main/java/com/micro/fast/security/browser/config/component/MsUserDetialsService.java b/boot-starter/boot-starter-security/boot-starter-security-browser/src/main/java/com/micro/fast/security/browser/config/component/MsUserDetialsService.java index 939c59b..dfb959f 100644 --- a/boot-starter/boot-starter-security/boot-starter-security-browser/src/main/java/com/micro/fast/security/browser/config/component/MsUserDetialsService.java +++ b/boot-starter/boot-starter-security/boot-starter-security-browser/src/main/java/com/micro/fast/security/browser/config/component/MsUserDetialsService.java @@ -4,12 +4,11 @@ import com.micro.fast.security.browser.service.UserService; import org.slf4j.Logger; import org.slf4j.LoggerFactory; import org.springframework.beans.factory.annotation.Autowired; -import org.springframework.security.core.authority.AuthorityUtils; +import org.springframework.beans.factory.annotation.Qualifier; import org.springframework.security.core.userdetails.User; import org.springframework.security.core.userdetails.UserDetails; import org.springframework.security.core.userdetails.UserDetailsService; import org.springframework.security.core.userdetails.UsernameNotFoundException; -import org.springframework.security.crypto.password.PasswordEncoder; import org.springframework.stereotype.Component; /** @@ -20,10 +19,9 @@ public class MsUserDetialsService implements UserDetailsService { private static final Logger log = LoggerFactory.getLogger(MsUserDetialsService.class); - @Autowired - private PasswordEncoder passwordEncoder; -// @Resource(name = "userServiceImpl") + @Autowired + @Qualifier("userServiceImpl") private UserService userService; /** @@ -35,11 +33,10 @@ public class MsUserDetialsService implements UserDetailsService { @Override public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException { log.info("根据username:{}获取密码",username); - //从数据库中根据用户名获取用户的详细身份认证信息 - /*User userByUsername = userService.getUserByUsername(username); - return userByUsername;*/ - //从数据库中去查找用户的密码 admin 是从数据库中查询出来的用户的密 - return new User(username,passwordEncoder.encode("admin"), AuthorityUtils.commaSeparatedStringToAuthorityList("admin")); + User userByUsername = userService.getUserByUsername(username); + return userByUsername; + /*从数据库中去查找用户的密码 admin 是从数据库中查询出来的用户的密 + return new User(username,passwordEncoder.encode("admin"), AuthorityUtils.commaSeparatedStringToAuthorityList("admin"));*/ } diff --git a/boot-starter/boot-starter-security/boot-starter-security-core/src/main/java/com/micro/fast/security/core/config/param/BrowserProperties.java b/boot-starter/boot-starter-security/boot-starter-security-core/src/main/java/com/micro/fast/security/core/config/param/BrowserProperties.java index 38d707f..b725c71 100644 --- a/boot-starter/boot-starter-security/boot-starter-security-core/src/main/java/com/micro/fast/security/core/config/param/BrowserProperties.java +++ b/boot-starter/boot-starter-security/boot-starter-security-core/src/main/java/com/micro/fast/security/core/config/param/BrowserProperties.java @@ -21,6 +21,19 @@ public class BrowserProperties { */ private LoginType loginType = LoginType.JSON; + /** + * 记住我的秒数，默认3600秒 + */ + private int rememberMeSeconds = 3600; + + public int getRememberMeSeconds() { + return rememberMeSeconds; + } + + public void setRememberMeSeconds(int rememberMeSeconds) { + this.rememberMeSeconds = rememberMeSeconds; + } + public String getHtml() { return html; } diff --git a/boot-starter/boot-starter-security/boot-starter-security-demo/src/main/resources/static/signIn.html b/boot-starter/boot-starter-security/boot-starter-security-demo/src/main/resources/static/signIn.html index 540a805..84bb7c5 100644 --- a/boot-starter/boot-starter-security/boot-starter-security-demo/src/main/resources/static/signIn.html +++ b/boot-starter/boot-starter-security/boot-starter-security-demo/src/main/resources/static/signIn.html @@ -10,6 +10,8 @@ + +