diff --git a/boot-starter/boot-starter-security/boot-starter-security-app/src/main/java/com/micro/fast/security/app/BootStarterSecurityAppApplication.java b/boot-starter/boot-starter-security/boot-starter-security-app/src/main/java/com/micro/fast/security/app/BootStarterSecurityAppApplication.java index f4853ef..abf2de6 100644 --- a/boot-starter/boot-starter-security/boot-starter-security-app/src/main/java/com/micro/fast/security/app/BootStarterSecurityAppApplication.java +++ b/boot-starter/boot-starter-security/boot-starter-security-app/src/main/java/com/micro/fast/security/app/BootStarterSecurityAppApplication.java @@ -1,12 +1,8 @@ package com.micro.fast.security.app; -import org.springframework.boot.SpringApplication; import org.springframework.boot.autoconfigure.SpringBootApplication; @SpringBootApplication public class BootStarterSecurityAppApplication { - public static void main(String[] args) { - SpringApplication.run(BootStarterSecurityAppApplication.class, args); - } } diff --git a/boot-starter/boot-starter-security/boot-starter-security-browser/src/main/java/com/micro/fast/security/browser/BootStarterSecurityBrowserApplication.java b/boot-starter/boot-starter-security/boot-starter-security-browser/src/main/java/com/micro/fast/security/browser/BootStarterSecurityBrowserApplication.java index 9337413..e32ecc7 100644 --- a/boot-starter/boot-starter-security/boot-starter-security-browser/src/main/java/com/micro/fast/security/browser/BootStarterSecurityBrowserApplication.java +++ b/boot-starter/boot-starter-security/boot-starter-security-browser/src/main/java/com/micro/fast/security/browser/BootStarterSecurityBrowserApplication.java @@ -7,7 +7,4 @@ import org.springframework.context.annotation.Configuration; @Configuration @ComponentScan public class BootStarterSecurityBrowserApplication { - public static void main(String[] args) { - SpringApplication.run(BootStarterSecurityBrowserApplication.class, args); - } } diff --git a/boot-starter/boot-starter-security/boot-starter-security-browser/src/main/java/com/micro/fast/security/browser/config/BrowserSecurityConfig.java b/boot-starter/boot-starter-security/boot-starter-security-browser/src/main/java/com/micro/fast/security/browser/config/BrowserSecurityConfig.java index e332eb6..3167f21 100644 --- a/boot-starter/boot-starter-security/boot-starter-security-browser/src/main/java/com/micro/fast/security/browser/config/BrowserSecurityConfig.java +++ b/boot-starter/boot-starter-security/boot-starter-security-browser/src/main/java/com/micro/fast/security/browser/config/BrowserSecurityConfig.java @@ -1,5 +1,7 @@ package com.micro.fast.security.browser.config; +import com.micro.fast.security.core.config.param.SecurityProperties; +import org.springframework.beans.factory.annotation.Autowired; import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Configuration; import org.springframework.security.config.annotation.web.builders.HttpSecurity; @@ -17,6 +19,8 @@ import org.springframework.security.crypto.password.PasswordEncoder; */ @Configuration public class BrowserSecurityConfig extends WebSecurityConfigurerAdapter { + @Autowired + private SecurityProperties securityProperties; /** * 配置校验方式 * @param http @@ -25,21 +29,23 @@ public class BrowserSecurityConfig extends WebSecurityConfigurerAdapter { @Override protected void configure(HttpSecurity http) throws Exception { http.formLogin()//使用表单登录 + .loginPage("/authentication/require")//自定义登录页面 + .loginProcessingUrl("/user/login")//配置spring security登录接口的访问地址,用于在自定义的登录页面提交请求 .and() .authorizeRequests()//下面是权限配置 + .antMatchers("/authentication/require",securityProperties.getBrowser().getHtml()).permitAll()//当访问这个页面的时候不进行权限校验,对用户自定义的登录页也不进行权限认证 .anyRequest()//任何请求 - .authenticated();//都需要身份认证 + .authenticated()//都需要身份认证 + .and() + .csrf().disable();//暂时关闭掉跨站请求攻击防护 } /** - * 定义密码的加密解密类 + * 定义密码的加密解密类的bean * @return */ @Bean public PasswordEncoder passwordEncoder(){ return new BCryptPasswordEncoder(); } - - - } diff --git a/boot-starter/boot-starter-security/boot-starter-security-browser/src/main/java/com/micro/fast/security/browser/controller/BrowserSecurityController.java b/boot-starter/boot-starter-security/boot-starter-security-browser/src/main/java/com/micro/fast/security/browser/controller/BrowserSecurityController.java new file mode 100644 index 0000000..044e962 --- /dev/null +++ b/boot-starter/boot-starter-security/boot-starter-security-browser/src/main/java/com/micro/fast/security/browser/controller/BrowserSecurityController.java @@ -0,0 +1,65 @@ +package com.micro.fast.security.browser.controller; + +import com.micro.fast.security.core.config.param.BrowserProperties; +import com.micro.fast.security.core.config.param.SecurityProperties; +import org.apache.commons.lang3.StringUtils; +import org.hibernate.validator.constraints.NotBlank; +import org.slf4j.Logger; +import org.slf4j.LoggerFactory; +import org.springframework.beans.factory.annotation.Autowired; +import org.springframework.beans.factory.annotation.Value; +import org.springframework.boot.context.properties.ConfigurationProperties; +import org.springframework.http.HttpStatus; +import org.springframework.security.web.DefaultRedirectStrategy; +import org.springframework.security.web.RedirectStrategy; +import org.springframework.security.web.savedrequest.HttpSessionRequestCache; +import org.springframework.security.web.savedrequest.RequestCache; +import org.springframework.security.web.savedrequest.SavedRequest; +import org.springframework.web.bind.annotation.RequestMapping; +import org.springframework.web.bind.annotation.ResponseStatus; +import org.springframework.web.bind.annotation.RestController; + +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; +import javax.validation.Valid; +import java.io.IOException; + +/** + * 自定义登录认证处理方式,当触发登录认证的时候跳转到这里 + */ +@RestController +public class BrowserSecurityController { + + @Autowired + private SecurityProperties securityProperties; + + private static final Logger log = LoggerFactory.getLogger(BrowserSecurityController.class); + /** + * 用于获取引发权限认证的请求缓存 + */ + private RequestCache requestCache = new HttpSessionRequestCache(); + + private RedirectStrategy redirectStrategy = new DefaultRedirectStrategy(); + + @RequestMapping("/authentication/require") + @ResponseStatus(code = HttpStatus.UNAUTHORIZED) + public String requireAuthentication(HttpServletRequest request, HttpServletResponse response) throws IOException { + //根据当前请求获取上一次请求的地址 + SavedRequest savedRequest = requestCache.getRequest(request, response); + //获取上一次请求的地址 + if (savedRequest!=null){ + String redirectUrl = savedRequest.getRedirectUrl(); + if (StringUtils.isNotBlank(redirectUrl)){ + log.info("引发跳转的请求是：{}",redirectUrl); + //如果是由于访问触发的权限认证就重定向到登录页面 + if (StringUtils.endsWithIgnoreCase(redirectUrl,".html")){ + //进行请求的重定向重定向到用户定义登录页面 + redirectStrategy.sendRedirect(request,response,securityProperties.getBrowser().getHtml()); + } + } + } + //如果是异步请求的话就放回404状态码和提示信息 + return new String("访问的服务需要身份认证，需要引导用户到身份认证页面"); + } +} + diff --git a/boot-starter/boot-starter-security/boot-starter-security-browser/src/main/java/com/micro/fast/security/browser/service/MsUserDetialsService.java b/boot-starter/boot-starter-security/boot-starter-security-browser/src/main/java/com/micro/fast/security/browser/service/MsUserDetialsService.java index c26434c..8d8df06 100644 --- a/boot-starter/boot-starter-security/boot-starter-security-browser/src/main/java/com/micro/fast/security/browser/service/MsUserDetialsService.java +++ b/boot-starter/boot-starter-security/boot-starter-security-browser/src/main/java/com/micro/fast/security/browser/service/MsUserDetialsService.java @@ -12,8 +12,7 @@ import org.springframework.security.crypto.password.PasswordEncoder; import org.springframework.stereotype.Component; /** - * Created by root on 12/4/17. - * + * 自定义根据用户名获取密码方法替换spring security的默认逻辑 */ @Component public class MsUserDetialsService implements UserDetailsService { @@ -22,6 +21,7 @@ public class MsUserDetialsService implements UserDetailsService { @Autowired private PasswordEncoder passwordEncoder; + /** * 处理用户的密码获取信息 * @param username UserDetails中包含用户的详细信息，在user中返回信息来进行详细的设定比如用户是否被锁定 diff --git a/boot-starter/boot-starter-security/boot-starter-security-core/src/main/java/com/micro/fast/security/core/BootStarterSecurityCoreApplication.java b/boot-starter/boot-starter-security/boot-starter-security-core/src/main/java/com/micro/fast/security/core/BootStarterSecurityCoreApplication.java index 6ee3780..f988e63 100644 --- a/boot-starter/boot-starter-security/boot-starter-security-core/src/main/java/com/micro/fast/security/core/BootStarterSecurityCoreApplication.java +++ b/boot-starter/boot-starter-security/boot-starter-security-core/src/main/java/com/micro/fast/security/core/BootStarterSecurityCoreApplication.java @@ -1,12 +1,14 @@ package com.micro.fast.security.core; +import com.micro.fast.security.core.config.param.SecurityProperties; import org.springframework.boot.SpringApplication; -import org.springframework.boot.autoconfigure.SpringBootApplication; +import org.springframework.boot.context.properties.EnableConfigurationProperties; +import org.springframework.context.annotation.ComponentScan; +import org.springframework.context.annotation.Configuration; -@SpringBootApplication +@Configuration +@ComponentScan +@EnableConfigurationProperties(SecurityProperties.class) public class BootStarterSecurityCoreApplication { - public static void main(String[] args) { - SpringApplication.run(BootStarterSecurityCoreApplication.class, args); - } } diff --git a/boot-starter/boot-starter-security/boot-starter-security-core/src/main/java/com/micro/fast/security/core/config/param/BrowserProperties.java b/boot-starter/boot-starter-security/boot-starter-security-core/src/main/java/com/micro/fast/security/core/config/param/BrowserProperties.java new file mode 100644 index 0000000..49da524 --- /dev/null +++ b/boot-starter/boot-starter-security/boot-starter-security-core/src/main/java/com/micro/fast/security/core/config/param/BrowserProperties.java @@ -0,0 +1,22 @@ +package com.micro.fast.security.core.config.param; + +import org.hibernate.validator.constraints.NotBlank; + +/** + * 浏览器身份认证参数 + */ +public class BrowserProperties { + /** + * 用户自自定义的登录页面,不能为空 + */ + @NotBlank //配合SecurityProperties中的Valid注解进行参数的校验 + private String html; + + public String getHtml() { + return html; + } + + public void setHtml(String html) { + this.html = html; + } +} diff --git a/boot-starter/boot-starter-security/boot-starter-security-core/src/main/java/com/micro/fast/security/core/config/param/SecurityProperties.java b/boot-starter/boot-starter-security/boot-starter-security-core/src/main/java/com/micro/fast/security/core/config/param/SecurityProperties.java new file mode 100644 index 0000000..be9ccc7 --- /dev/null +++ b/boot-starter/boot-starter-security/boot-starter-security-core/src/main/java/com/micro/fast/security/core/config/param/SecurityProperties.java @@ -0,0 +1,25 @@ +package com.micro.fast.security.core.config.param; + +import org.springframework.boot.context.properties.ConfigurationProperties; + +import javax.validation.Valid; + +/** + * 用于从application.yml配置文件中加载以ms.security为前缀的属性 + */ +@ConfigurationProperties(prefix = "ms.security") +public class SecurityProperties { + /** + * 浏览器身份认证配置 + */ + @Valid//对带有校验注解的对象进行参数校验 + private BrowserProperties browser = new BrowserProperties(); + + public BrowserProperties getBrowser() { + return browser; + } + + public void setBrowser(BrowserProperties browser) { + this.browser = browser; + } +} diff --git a/boot-starter/boot-starter-security/boot-starter-security-core/src/main/resources/META-INF/spring.factories b/boot-starter/boot-starter-security/boot-starter-security-core/src/main/resources/META-INF/spring.factories new file mode 100644 index 0000000..15ab382 --- /dev/null +++ b/boot-starter/boot-starter-security/boot-starter-security-core/src/main/resources/META-INF/spring.factories @@ -0,0 +1 @@ +org.springframework.boot.autoconfigure.EnableAutoConfiguration=com.micro.fast.security.core.BootStarterSecurityCoreApplication \ No newline at end of file diff --git a/boot-starter/boot-starter-security/boot-starter-security-demo/src/main/java/com/micro/fast/security/demo/pojo/User.java b/boot-starter/boot-starter-security/boot-starter-security-demo/src/main/java/com/micro/fast/security/demo/pojo/User.java index 0dcf63e..b368fa6 100644 --- a/boot-starter/boot-starter-security/boot-starter-security-demo/src/main/java/com/micro/fast/security/demo/pojo/User.java +++ b/boot-starter/boot-starter-security/boot-starter-security-demo/src/main/java/com/micro/fast/security/demo/pojo/User.java @@ -1,7 +1,6 @@ package com.micro.fast.security.demo.pojo; import com.fasterxml.jackson.annotation.JsonView; -import io.swagger.annotations.ApiModel; import io.swagger.annotations.ApiModelProperty; import org.hibernate.validator.constraints.*; diff --git a/boot-starter/boot-starter-security/boot-starter-security-demo/src/main/resources/application.yml b/boot-starter/boot-starter-security/boot-starter-security-demo/src/main/resources/application.yml index fc798c7..23d503a 100644 --- a/boot-starter/boot-starter-security/boot-starter-security-demo/src/main/resources/application.yml +++ b/boot-starter/boot-starter-security/boot-starter-security-demo/src/main/resources/application.yml @@ -12,5 +12,8 @@ spring: #security: # basic: # enabled: true - +ms: + security: + browser: + html: diff --git a/boot-starter/boot-starter-security/boot-starter-security-demo/src/main/resources/static/signIn.html b/boot-starter/boot-starter-security/boot-starter-security-demo/src/main/resources/static/signIn.html new file mode 100644 index 0000000..2ca6ad6 --- /dev/null +++ b/boot-starter/boot-starter-security/boot-starter-security-demo/src/main/resources/static/signIn.html @@ -0,0 +1,10 @@ + + + + + 登录 + + +

Demo登录页

+ + \ No newline at end of file