自定义身份认证触发后的逻辑，添加可配置的登录页

boot-starter/boot-starter-security/boot-starter-security-app/src/main/java/com/micro/fast/security/app/BootStarterSecurityAppApplication.java

@@ -1,12 +1,8 @@
 package com.micro.fast.security.app;
 
-import org.springframework.boot.SpringApplication;
 import org.springframework.boot.autoconfigure.SpringBootApplication;
 
 @SpringBootApplication
 public class BootStarterSecurityAppApplication {
 
-	public static void main(String[] args) {
-		SpringApplication.run(BootStarterSecurityAppApplication.class, args);
-	}
 }

boot-starter/boot-starter-security/boot-starter-security-browser/src/main/java/com/micro/fast/security/browser/BootStarterSecurityBrowserApplication.java

@@ -7,7 +7,4 @@ import org.springframework.context.annotation.Configuration;
 @Configuration
 @ComponentScan
 public class BootStarterSecurityBrowserApplication {
-	public static void main(String[] args) {
-		SpringApplication.run(BootStarterSecurityBrowserApplication.class, args);
-	}
 }

boot-starter/boot-starter-security/boot-starter-security-browser/src/main/java/com/micro/fast/security/browser/config/BrowserSecurityConfig.java

@@ -1,5 +1,7 @@
 package com.micro.fast.security.browser.config;
 
+import com.micro.fast.security.core.config.param.SecurityProperties;
+import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
@@ -17,6 +19,8 @@ import org.springframework.security.crypto.password.PasswordEncoder;
  */
 @Configuration
 public class BrowserSecurityConfig extends WebSecurityConfigurerAdapter {
+    @Autowired
+    private SecurityProperties securityProperties;
     /**
      * 配置校验方式
      * @param http
@@ -25,21 +29,23 @@ public class BrowserSecurityConfig extends WebSecurityConfigurerAdapter {
     @Override
     protected void configure(HttpSecurity http) throws Exception {
         http.formLogin()//使用表单登录
+                .loginPage("/authentication/require")//自定义登录页面
+                .loginProcessingUrl("/user/login")//配置spring security登录接口的访问地址,用于在自定义的登录页面提交请求
                 .and()
                 .authorizeRequests()//下面是权限配置
+                .antMatchers("/authentication/require",securityProperties.getBrowser().getHtml()).permitAll()//当访问这个页面的时候不进行权限校验,对用户自定义的登录页也不进行权限认证
                 .anyRequest()//任何请求
-                .authenticated();//都需要身份认证
+                .authenticated()//都需要身份认证
+                .and()
+                .csrf().disable();//暂时关闭掉跨站请求攻击防护
     }
 
     /**
-     * 定义密码的加密解密类
+     * 定义密码的加密解密类的bean
      * @return
      */
     @Bean
     public PasswordEncoder passwordEncoder(){
         return new BCryptPasswordEncoder();
     }
-
-
-
 }

boot-starter/boot-starter-security/boot-starter-security-browser/src/main/java/com/micro/fast/security/browser/controller/BrowserSecurityController.java

@@ -0,0 +1,65 @@
+package com.micro.fast.security.browser.controller;
+
+import com.micro.fast.security.core.config.param.BrowserProperties;
+import com.micro.fast.security.core.config.param.SecurityProperties;
+import org.apache.commons.lang3.StringUtils;
+import org.hibernate.validator.constraints.NotBlank;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.beans.factory.annotation.Value;
+import org.springframework.boot.context.properties.ConfigurationProperties;
+import org.springframework.http.HttpStatus;
+import org.springframework.security.web.DefaultRedirectStrategy;
+import org.springframework.security.web.RedirectStrategy;
+import org.springframework.security.web.savedrequest.HttpSessionRequestCache;
+import org.springframework.security.web.savedrequest.RequestCache;
+import org.springframework.security.web.savedrequest.SavedRequest;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.ResponseStatus;
+import org.springframework.web.bind.annotation.RestController;
+
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import javax.validation.Valid;
+import java.io.IOException;
+
+/**
+ * 自定义登录认证处理方式,当触发登录认证的时候跳转到这里
+ */
+@RestController
+public class BrowserSecurityController {
+
+    @Autowired
+    private SecurityProperties securityProperties;
+
+    private static  final Logger log = LoggerFactory.getLogger(BrowserSecurityController.class);
+    /**
+     * 用于获取引发权限认证的请求缓存
+     */
+    private RequestCache requestCache = new HttpSessionRequestCache();
+
+    private RedirectStrategy redirectStrategy = new DefaultRedirectStrategy();
+
+    @RequestMapping("/authentication/require")
+    @ResponseStatus(code = HttpStatus.UNAUTHORIZED)
+    public String requireAuthentication(HttpServletRequest request, HttpServletResponse response) throws IOException {
+        //根据当前请求获取上一次请求的地址
+        SavedRequest savedRequest = requestCache.getRequest(request, response);
+        //获取上一次请求的地址
+        if (savedRequest!=null){
+            String redirectUrl = savedRequest.getRedirectUrl();
+            if (StringUtils.isNotBlank(redirectUrl)){
+                log.info("引发跳转的请求是：{}",redirectUrl);
+                //如果是由于访问触发的权限认证就重定向到登录页面
+                if (StringUtils.endsWithIgnoreCase(redirectUrl,".html")){
+                        //进行请求的重定向重定向到用户定义登录页面
+                        redirectStrategy.sendRedirect(request,response,securityProperties.getBrowser().getHtml());
+                }
+            }
+        }
+        //如果是异步请求的话就放回404状态码和提示信息
+        return new String("访问的服务需要身份认证，需要引导用户到身份认证页面");
+    }
+}
+

boot-starter/boot-starter-security/boot-starter-security-browser/src/main/java/com/micro/fast/security/browser/service/MsUserDetialsService.java

@@ -12,8 +12,7 @@ import org.springframework.security.crypto.password.PasswordEncoder;
 import org.springframework.stereotype.Component;
 
 /**
- * Created by root on 12/4/17.
- *
+ * 自定义根据用户名获取密码方法替换spring security的默认逻辑
  */
 @Component
 public class MsUserDetialsService implements UserDetailsService {
@@ -22,6 +21,7 @@ public class MsUserDetialsService implements UserDetailsService {
 
     @Autowired
     private PasswordEncoder passwordEncoder;
+
     /**
      * 处理用户的密码获取信息
      * @param username UserDetails中包含用户的详细信息，在user中返回信息来进行详细的设定比如用户是否被锁定

boot-starter/boot-starter-security/boot-starter-security-core/src/main/java/com/micro/fast/security/core/BootStarterSecurityCoreApplication.java

@@ -1,12 +1,14 @@
 package com.micro.fast.security.core;
 
+import com.micro.fast.security.core.config.param.SecurityProperties;
 import org.springframework.boot.SpringApplication;
-import org.springframework.boot.autoconfigure.SpringBootApplication;
+import org.springframework.boot.context.properties.EnableConfigurationProperties;
+import org.springframework.context.annotation.ComponentScan;
+import org.springframework.context.annotation.Configuration;
 
-@SpringBootApplication
+@Configuration
+@ComponentScan
+@EnableConfigurationProperties(SecurityProperties.class)
 public class BootStarterSecurityCoreApplication {
 
-	public static void main(String[] args) {
-		SpringApplication.run(BootStarterSecurityCoreApplication.class, args);
-	}
 }

boot-starter/boot-starter-security/boot-starter-security-core/src/main/java/com/micro/fast/security/core/config/param/BrowserProperties.java

@@ -0,0 +1,22 @@
+package com.micro.fast.security.core.config.param;
+
+import org.hibernate.validator.constraints.NotBlank;
+
+/**
+ * 浏览器身份认证参数
+ */
+public class BrowserProperties {
+    /**
+     * 用户自自定义的登录页面,不能为空
+     */
+    @NotBlank //配合SecurityProperties中的Valid注解进行参数的校验
+    private String html;
+
+    public String getHtml() {
+        return html;
+    }
+
+    public void setHtml(String html) {
+        this.html = html;
+    }
+}

boot-starter/boot-starter-security/boot-starter-security-core/src/main/java/com/micro/fast/security/core/config/param/SecurityProperties.java

@@ -0,0 +1,25 @@
+package com.micro.fast.security.core.config.param;
+
+import org.springframework.boot.context.properties.ConfigurationProperties;
+
+import javax.validation.Valid;
+
+/**
+ * 用于从application.yml配置文件中加载以ms.security为前缀的属性
+ */
+@ConfigurationProperties(prefix = "ms.security")
+public class SecurityProperties {
+    /**
+     * 浏览器身份认证配置
+     */
+    @Valid//对带有校验注解的对象进行参数校验
+    private BrowserProperties browser = new BrowserProperties();
+
+    public BrowserProperties getBrowser() {
+        return browser;
+    }
+
+    public void setBrowser(BrowserProperties browser) {
+        this.browser = browser;
+    }
+}

boot-starter/boot-starter-security/boot-starter-security-core/src/main/resources/META-INF/spring.factories

@@ -0,0 +1 @@
+org.springframework.boot.autoconfigure.EnableAutoConfiguration=com.micro.fast.security.core.BootStarterSecurityCoreApplication

boot-starter/boot-starter-security/boot-starter-security-demo/src/main/java/com/micro/fast/security/demo/pojo/User.java

@@ -1,7 +1,6 @@
 package com.micro.fast.security.demo.pojo;
 
 import com.fasterxml.jackson.annotation.JsonView;
-import io.swagger.annotations.ApiModel;
 import io.swagger.annotations.ApiModelProperty;
 import org.hibernate.validator.constraints.*;
 

boot-starter/boot-starter-security/boot-starter-security-demo/src/main/resources/application.yml

@@ -12,5 +12,8 @@ spring:
 #security:
 #  basic:
 #    enabled: true
-
+ms:
+ security:
+  browser:
+   html:
 

boot-starter/boot-starter-security/boot-starter-security-demo/src/main/resources/static/signIn.html

@@ -0,0 +1,10 @@
+<!DOCTYPE html>
+<html>
+<head>
+    <meta charset="UTF-8">
+    <title>登录</title>
+</head>
+<body>
+<h2>Demo登录页</h2>
+</body>
+</html>