示例项目地址: https://git.code.tencent.com/xinzhang0618/oa2.git
参考文档:
springSecurity官方文档:
https://docs.spring.io/spring-security/site/docs/5.4.2/reference/html5/#servlet-hello-auto-configuration
springSecurity概念: https://www.jianshu.com/p/7b87ec108405
openssl生成RSA: https://blog.csdn.net/asd54090/article/details/103665966

基础回顾

SpringSecurity框架入门要先了解各种概念, 详情参考上面第二篇文档, 简单总结:
**

认证流程

  1. 请求经过xxxFilter
  2. filter抽取request封装成某一类型的token交于AuthenticationManager进行校验

  3. AuthenticationManager的ProviderManager实现, 根据token类型, 找到具体的xxxProvider进行校验, 核心伪代码如下

    1. public class ProviderManager implements AuthenticationManager, MessageSourceAware, InitializingBean {
    3.  public Authentication authenticate(Authentication authentication) throws AuthenticationException {
    4.      Iterator var8 = this.getProviders().iterator();
    5.      while(var8.hasNext()) {
    6.          AuthenticationProvider provider = (AuthenticationProvider)var8.next();
    7.          if (provider.supports(toTest)) {
    8.              result = provider.authenticate(authentication);
    9.              ...
    10.          }
    11.      }
    12.  }

  4. 只要有一个provider验证成功则认证成功

单体认证 - 图1

单体认证 - 图2

相关概念

这里只介绍与本文相关的, 具体参见官方文档

  • 过滤器

    • AbstractAuthenticationProcessingFilter, 所有过滤器的基过滤器
    • UsernamePasswordAuthenticationFilter, 继承上一个, 处理表单登录, 可以看到这里定死了登录方式POST, 路径/login, 如果需要更改这些, 则自定义的Filter直接继承上一个
    • BasicAuthenticationFilter, 处理Basic认证, 本文实现中重写了这个作为token过滤器, 实际上token过滤也可以直接使用spring的OncePerRequestFilter等

  • 校验器, AuthenticationManager定义了校验的顶层接口, 其中ProviderManager作为主要实现, 其中维护了providers列表, 负责对token找到对应的provider进行校验, 比如上图的DaoAuthenticationProvider支持UsernamePasswordAuthenticationToken(及其子类型)的校验

    • 自定义校验器需要实现AuthenticationProvider接口

  • token, springSecurity在过滤器中会将用户信息封装成各个类型的token

    • 自定义的token需要实现AbstractAuthenticationToken接口

  • 其他

    • SecurityContextHolder, 持有SecurityContext上下文信息
    • Authentication, 鉴权对象, 包含principal当事人即当前用户, credentials凭证一般指密码, authorities用户权限

实现思路

做认证主要是登录, 访问刷新, token过期, 登出

  1. 登录, 校验用户名密码, 生成token存redis;
  2. 访问刷新, redis的token续期
  3. token过期, redis的token过期
  4. 登出, 清除redis的token

配置解析

整个配置跟业务关联非常低, 不同项目基本可以直接移植

依赖以及配置文件

  1.   <!--springSecurity-->
  2.         <dependency>
  3.             <groupId>org.springframework.boot</groupId>
  4.             <artifactId>spring-boot-starter-security</artifactId>
  5.         </dependency>

这里前后端密码传递使用Openssl生成的秘钥对进行加解密的, 数据库存储的密码是md5加密的, 后端只需要存私钥, 公钥存前端

  1. 前端用户登陆时, 使用公钥对密码加密给到后端
  2. 后端拿私钥解密后, 再md5加密与数据库密码比对

image.png

私钥的读取

WebMvcConfig
这里有个坑, 特别注意读取的string不能有—xx—或换行符, 常见的FileUtils都会拼接换行符
还有就是这个Bean没有配置在WebSecurityConfig中, 是由于bean加载的顺序问题

  1. @Configuration
  2. public class WebMvcConfig implements WebMvcConfigurer {
  4.     @Value("classpath:rsa_private_key.pem")
  5.     private Resource privateKey;
  7.     /**
  8.      * 此处有坑, 注意读取的时候--XX--不能要, 且不能有换行符
  9.      */
  10.     @Bean
  11.     public PrivateKey loginPrivateKey() throws IOException, InvalidKeySpecException, NoSuchAlgorithmException {
  12.         try (InputStream inputStream = privateKey.getInputStream()) {
  13.             final List<String> lines = IOUtils.readLines(inputStream, StandardCharsets.UTF_8.name());
  14.             StringBuilder builder = new StringBuilder();
  15.             for (String line : lines) {
  16.                 if (!line.startsWith("--")) {
  17.                     builder.append(line);
  18.                 }
  19.             }
  20.             return SecurityUtils.getPrivateKey(builder.toString());
  21.         }
  22.     }
  23. }

web访问控制

WebSecurityConfig

  1. 注册filer以及provider
  2. 允许跨域
  3. 禁止csrf
  4. 禁止SpringSecurity默认的session策略, 因为我们用的自定义的token, 不用它的 ```java package top.xinzhang0618.oa.security;

import org.springframework.beans.factory.annotation.Autowired; import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Configuration; import org.springframework.http.HttpMethod; import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder; import org.springframework.security.config.annotation.web.builders.HttpSecurity; import org.springframework.security.config.annotation.web.builders.WebSecurity; import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity; import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter; import org.springframework.security.config.http.SessionCreationPolicy; import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter; import org.springframework.web.cors.CorsConfiguration; import org.springframework.web.cors.UrlBasedCorsConfigurationSource; import org.springframework.web.filter.CorsFilter; import top.xinzhang0618.oa.WebConstants;

@Configuration @EnableWebSecurity public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

  1. @Autowired
  2. private UsernamePasswordProvider usernamePasswordProvider;
  3. @Autowired
  4. private UserTokenProvider userTokenProvider;
  6. @Override
  7. protected void configure(HttpSecurity http) throws Exception {
  8.     http.csrf().disable().cors().and()
  9.             .authorizeRequests()
  10.             .antMatchers(HttpMethod.OPTIONS).permitAll()
  11.             .antMatchers(HttpMethod.POST, WebConstants.LOGIN_URL, WebConstants.LOGOUT_URL).permitAll()
  12.             .anyRequest().authenticated()
  13.             .and()
  14.             .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS)
  15.             .and()
  16.             .addFilterBefore(new UsernamePasswordFilter(WebConstants.LOGIN_URL, authenticationManager()),
  17.                     UsernamePasswordAuthenticationFilter.class)
  18.             .addFilterBefore(new UserTokenFilter(authenticationManager()),
  19.                     UsernamePasswordAuthenticationFilter.class);
  20. }
  22. @Bean
  23. public CorsFilter corsFilter() {
  24.     UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
  25.     CorsConfiguration corsConfiguration = new CorsConfiguration();
  26.     corsConfiguration.addAllowedOrigin("*");
  27.     corsConfiguration.addAllowedHeader("*");
  28.     corsConfiguration.addAllowedMethod("*");
  29.     corsConfiguration.setAllowCredentials(true);
  30.     source.registerCorsConfiguration("/**", corsConfiguration);
  31.     return new CorsFilter(source);
  32. }
  34. @Override
  35. public void configure(WebSecurity web) throws Exception {
  36.     super.configure(web);
  37. }
  39. @Override
  40. public void configure(AuthenticationManagerBuilder auth) {
  41.     auth.authenticationProvider(usernamePasswordProvider);
  42.     auth.authenticationProvider(userTokenProvider);
  43. }

}

  2. <a name="BsVvq"></a>
  3. ### 用户名密码认证
  4. 这里我们使用的自定义的校验方案, 也可以使用SpringSecurity的默认实现, 要实现UserService接口等等巴拉巴拉<br />一套校验方案包括, 自定义token, 自定义filter, 自定义provider<br />userToken
  5. ```java
  6. package top.xinzhang0618.oa.security;
  8. import org.springframework.security.authentication.AbstractAuthenticationToken;
  10. public class UserToken extends AbstractAuthenticationToken {
  12.   private String token;
  14.   public UserToken(String token, boolean authenticated) {
  15.     super(null);
  16.     this.setAuthenticated(authenticated);
  17.     this.token = token;
  18.   }
  20.   @Override
  21.   public Object getCredentials() {
  22.     return null;
  23.   }
  25.   @Override
  26.   public Object getPrincipal() {
  27.     return token;
  28.   }
  30.   public String getToken() {
  31.     return token;
  32.   }
  33. }

UsernamePasswordFilter

  1. package top.xinzhang0618.oa.security;
  3. import com.alibaba.fastjson.JSON;
  4. import org.springframework.security.authentication.AuthenticationManager;
  5. import org.springframework.security.authentication.BadCredentialsException;
  6. import org.springframework.security.core.Authentication;
  7. import org.springframework.security.core.AuthenticationException;
  8. import org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter;
  9. import top.xinzhang0618.oa.WebConstants;
  10. import top.xinzhang0618.oa.config.response.RestResponse;
  11. import top.xinzhang0618.oa.domain.User;
  12. import top.xinzhang0618.oa.util.StringUtils;
  14. import javax.servlet.FilterChain;
  15. import javax.servlet.ServletException;
  16. import javax.servlet.http.HttpServletRequest;
  17. import javax.servlet.http.HttpServletResponse;
  18. import java.io.IOException;
  20. public class UsernamePasswordFilter extends AbstractAuthenticationProcessingFilter {
  22.     private final AuthenticationManager authenticationManager;
  24.     public UsernamePasswordFilter(String defaultFilterProcessesUrl, AuthenticationManager authenticationManager) {
  25.         super(defaultFilterProcessesUrl);
  26.         this.authenticationManager = authenticationManager;
  27.     }
  29.     @Override
  30.     public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response)
  31.             throws AuthenticationException, IOException, ServletException {
  32.         User user = JSON.parseObject(request.getInputStream(), User.class);
  33.         if (user == null || StringUtils.isEmpty(user.getUserName()) || StringUtils.isEmpty(user.getPassword())) {
  34.             throw new BadCredentialsException("用户名或密码为空！");
  35.         }
  36.         TenantToken authenticationToken = new TenantToken(user.getUserName(), user.getPassword(), user.getTenantId());
  37.         return authenticationManager.authenticate(authenticationToken);
  38.     }
  40.     @Override
  41.     protected void successfulAuthentication(HttpServletRequest request, HttpServletResponse response, FilterChain chain,
  42.                                             Authentication authResult) throws IOException, ServletException {
  43.         UserLoginInfo loginInfo = (UserLoginInfo) authResult.getDetails();
  44.         response.setContentType(WebConstants.CONTENT_TYPE);
  45.         response.getWriter().write(JSON.toJSONString(RestResponse.success(loginInfo)));
  46.     }
  48.     @Override
  49.     protected void unsuccessfulAuthentication(HttpServletRequest request, HttpServletResponse response,
  50.                                               AuthenticationException failed) throws IOException, ServletException {
  51.         response.sendError(HttpServletResponse.SC_UNAUTHORIZED, failed.getMessage());
  52.     }
  53. }

UsernamePasswordProvider

  1. package top.xinzhang0618.oa.security;
  3. import com.baomidou.mybatisplus.core.conditions.query.LambdaQueryWrapper;
  4. import org.springframework.beans.factory.annotation.Autowired;
  5. import org.springframework.security.authentication.AuthenticationProvider;
  6. import org.springframework.security.authentication.BadCredentialsException;
  7. import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
  8. import org.springframework.security.core.Authentication;
  9. import org.springframework.security.core.AuthenticationException;
  10. import org.springframework.security.core.userdetails.UsernameNotFoundException;
  11. import org.springframework.stereotype.Component;
  12. import top.xinzhang0618.oa.BizContext;
  13. import top.xinzhang0618.oa.domain.User;
  14. import top.xinzhang0618.oa.service.UserService;
  15. import top.xinzhang0618.oa.util.SecurityUtils;
  16. import top.xinzhang0618.oa.util.StringUtils;
  18. import javax.crypto.BadPaddingException;
  19. import javax.crypto.IllegalBlockSizeException;
  20. import javax.crypto.NoSuchPaddingException;
  21. import java.io.UnsupportedEncodingException;
  22. import java.security.InvalidKeyException;
  23. import java.security.NoSuchAlgorithmException;
  24. import java.security.PrivateKey;
  26. @Component
  27. public class UsernamePasswordProvider implements AuthenticationProvider {
  29.     @Autowired
  30.     private TokenManager tokenManager;
  31.     @Autowired
  32.     private UserService userService;
  33.     @Autowired
  34.     private PrivateKey privateKey;
  36.     @Override
  37.     public Authentication authenticate(Authentication authentication) throws AuthenticationException {
  38.         TenantToken tenantToken = (TenantToken) authentication;
  39.         if (StringUtils.isEmpty(tenantToken.getUserName())) {
  40.             throw new UsernameNotFoundException("用户名不能为空");
  41.         }
  42.         try {
  43.             // mybatisPlus的租户处理器会拼接tenant_id条件
  44.             BizContext.setTenantId(tenantToken.getTenantId());
  45.             String password = SecurityUtils.decryptRSA(tenantToken.getPassword(), privateKey);
  46.             User user = userService.get(new LambdaQueryWrapper<User>().eq(User::getUserName,
  47.                     tenantToken.getUserName()));
  48.             if (user == null) {
  49.                 throw new UsernameNotFoundException("未找到用户：" + tenantToken.getUserName());
  50.             }
  52.             if (!SecurityUtils.md5Hex(password).equals(user.getPassword())) {
  53.                 throw new BadCredentialsException("用户名或密码错误");
  54.             }
  55.             if (!user.isEnable()) {
  56.                 throw new BadCredentialsException("用户已禁用");
  57.             }
  59.             // 设置上下文
  60.             BizContext.setUserId(user.getUserId());
  61.             BizContext.setUserName(user.getUserName());
  63.             UserLoginInfo loginInfo = new UserLoginInfo(user);
  64.             tokenManager.generate(loginInfo);
  65.             UsernamePasswordAuthenticationToken result =
  66.                     new UsernamePasswordAuthenticationToken(authentication.getPrincipal(),
  67.                             authentication.getCredentials());
  68.             result.setDetails(loginInfo);
  69.             return result;
  70.         } catch (NoSuchAlgorithmException | IllegalBlockSizeException | InvalidKeyException
  71.                 | UnsupportedEncodingException | BadPaddingException | NoSuchPaddingException e) {
  72.             throw new BadCredentialsException("用户名和密码格式错误");
  73.         }
  74.     }
  76.     @Override
  77.     public boolean supports(Class<?> authentication) {
  78.         return authentication.equals(TenantToken.class);
  79.     }
  80. }

认证完成后返回给前端的实体
UserLoginInfo

  1. package top.xinzhang0618.oa.security;
  4. import top.xinzhang0618.oa.domain.User;
  6. public class UserLoginInfo {
  8.     private String token;
  9.     private Long userId;
  10.     private String nickname;
  11.     private String userName;
  12.     private String headUrl;
  13.     private Long tenantId;
  15.     public UserLoginInfo() {
  16.     }
  18.     public UserLoginInfo(User user) {
  19.         this.userId = user.getUserId();
  20.         this.nickname = user.getNickname();
  21.         this.userName = user.getUserName();
  22.         this.headUrl = user.getHeadUrl();
  23.         this.tenantId = user.getTenantId();
  24.     }
  26.     public String getToken() {
  27.         return token;
  28.     }
  30.     public void setToken(String token) {
  31.         this.token = token;
  32.     }
  34.     public Long getUserId() {
  35.         return userId;
  36.     }
  38.     public void setUserId(Long userId) {
  39.         this.userId = userId;
  40.     }
  42.     public String getNickname() {
  43.         return nickname;
  44.     }
  46.     public void setNickname(String nickname) {
  47.         this.nickname = nickname;
  48.     }
  50.     public String getHeadUrl() {
  51.         return headUrl;
  52.     }
  54.     public void setHeadUrl(String headUrl) {
  55.         this.headUrl = headUrl;
  56.     }
  58.     public Long getTenantId() {
  59.         return tenantId;
  60.     }
  62.     public void setTenantId(Long tenantId) {
  63.         this.tenantId = tenantId;
  64.     }
  66.     public String getUserName() {
  67.         return userName;
  68.     }
  70.     public void setUserName(String userName) {
  71.         this.userName = userName;
  72.     }
  73. }

token管理器, 这里直接用uuid生成的token, 用jwt意义不大
TokenManager

  1. package top.xinzhang0618.oa.security;
  3. import org.springframework.beans.factory.annotation.Autowired;
  4. import org.springframework.data.redis.core.RedisTemplate;
  5. import org.springframework.stereotype.Component;
  6. import top.xinzhang0618.oa.WebConstants;
  8. import java.util.UUID;
  9. import java.util.concurrent.TimeUnit;
  11. @Component
  12. public class TokenManager {
  14.     @Autowired
  15.     private RedisTemplate<String, Object> redisTemplate;
  17.     public UserLoginInfo getUser(String token) {
  18.         return (UserLoginInfo) redisTemplate.opsForValue().get(buildKey(token));
  19.     }
  21.     /**
  22.      * 生成token
  23.      *
  24.      * @param loginInfo
  25.      * @return
  26.      */
  27.     public void generate(UserLoginInfo loginInfo) {
  28.         String token = UUID.randomUUID().toString();
  29.         loginInfo.setToken(token);
  30.         redisTemplate.opsForValue().set(buildKey(token), loginInfo, 30L, TimeUnit.MINUTES);
  31.     }
  33.     /**
  34.      * 移除token
  35.      *
  36.      * @param token
  37.      */
  38.     public void remove(String token) {
  39.         redisTemplate.delete(token);
  40.     }
  42.     /**
  43.      * token刷新
  44.      *
  45.      * @param token
  46.      */
  47.     public void refresh(String token) {
  48.         redisTemplate.expire(buildKey(token), 30, TimeUnit.MINUTES);
  49.     }
  51.     private String buildKey(String token) {
  52.         return WebConstants.TOKEN_PREFIX + token;
  53.     }
  54. }

token认证

一样的三件, token, filter, provider
TenantToken

  1. package top.xinzhang0618.oa.security;
  3. import org.springframework.security.authentication.AbstractAuthenticationToken;
  5. public class TenantToken extends AbstractAuthenticationToken {
  7.   private String userName;
  8.   private String password;
  9.   private Long tenantId;
  11.   public TenantToken(String userName, String password,
  12.                      Long tenantId) {
  13.     super(null);
  14.     this.userName = userName;
  15.     this.password = password;
  16.     this.tenantId = tenantId;
  17.   }
  20.   public String getUserName() {
  21.     return userName;
  22.   }
  24.   public String getPassword() {
  25.     return password;
  26.   }
  29.   public Long getTenantId() {
  30.     return tenantId;
  31.   }
  33.   @Override
  34.   public Object getCredentials() {
  35.     return password;
  36.   }
  38.   @Override
  39.   public Object getPrincipal() {
  40.     return userName;
  41.   }
  42. }

UserTokenFilter

  1. package top.xinzhang0618.oa.security;
  3. import org.springframework.security.authentication.AuthenticationManager;
  4. import org.springframework.security.authentication.BadCredentialsException;
  5. import org.springframework.security.core.Authentication;
  6. import org.springframework.security.core.AuthenticationException;
  7. import org.springframework.security.core.context.SecurityContextHolder;
  8. import org.springframework.security.web.authentication.www.BasicAuthenticationFilter;
  9. import top.xinzhang0618.oa.WebConstants;
  10. import top.xinzhang0618.oa.util.StringUtils;
  12. import javax.servlet.FilterChain;
  13. import javax.servlet.ServletException;
  14. import javax.servlet.http.HttpServletRequest;
  15. import javax.servlet.http.HttpServletResponse;
  16. import java.io.IOException;
  18. public class UserTokenFilter extends BasicAuthenticationFilter {
  20.   public UserTokenFilter(
  21.       AuthenticationManager authenticationManager) {
  22.     super(authenticationManager);
  23.   }
  26.   @Override
  27.   protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain chain)
  28.       throws IOException, ServletException {
  29.     String token = request.getHeader(WebConstants.TOKEN_HEADER);
  30.     if (!StringUtils.isEmpty(token)) {
  31.       UserToken userToken = new UserToken(token, false);
  32.       Authentication authenticate = getAuthenticationManager().authenticate(userToken);
  33.       if (authenticate.isAuthenticated()) {
  34.         SecurityContextHolder.getContext().setAuthentication(authenticate);
  35.         chain.doFilter(request, response);
  36.         return;
  37.       }
  38.     }
  39.     this.onUnsuccessfulAuthentication(request, response, new BadCredentialsException("非法请求"));
  40.   }
  42.   @Override
  43.   protected void onUnsuccessfulAuthentication(HttpServletRequest request, HttpServletResponse response,
  44.       AuthenticationException failed) throws IOException {
  45.     response.sendError(HttpServletResponse.SC_UNAUTHORIZED);
  46.   }
  47. }

UserTokenProvider

  1. package top.xinzhang0618.oa.security;
  3. import org.springframework.beans.factory.annotation.Autowired;
  4. import org.springframework.security.authentication.AuthenticationProvider;
  5. import org.springframework.security.core.Authentication;
  6. import org.springframework.security.core.AuthenticationException;
  7. import org.springframework.stereotype.Component;
  8. import top.xinzhang0618.oa.BizContext;
  10. @Component
  11. public class UserTokenProvider implements AuthenticationProvider {
  13.     @Autowired
  14.     private TokenManager tokenManager;
  16.     @Override
  17.     public Authentication authenticate(Authentication authentication) throws AuthenticationException {
  18.         UserToken userToken = (UserToken) authentication;
  19.         String token = userToken.getToken();
  20.         UserLoginInfo user = tokenManager.getUser(token);
  21.         if (user == null) {
  22.             return authentication;
  23.         }
  24.         tokenManager.refresh(token);
  25.         BizContext.setUserId(user.getUserId());
  26.         BizContext.setUserName(user.getUserName());
  27.         BizContext.setTenantId(user.getTenantId());
  28.         userToken.setAuthenticated(true);
  29.         return authentication;
  30.     }
  32.     @Override
  33.     public boolean supports(Class<?> aClass) {
  34.         return aClass.equals(UserToken.class);
  35.     }
  36. }

常量类
WebConstants

  1. package top.xinzhang0618.oa;
  3. /**
  4.  * @author buer
  5.  * @version 2018-01-17 14:53
  6.  */
  7. public final class WebConstants {
  9.   public static final String TOKEN_HEADER = "Authorization";
  10.   public static final String TOKEN_PREFIX = "LOGIN_TOKEN:";
  11.   public static final String CORS_REQUEST_METHOD = "OPTIONS";
  12.   public static final String LOGIN_URL = "/login";
  13.   public static final String LOGOUT_URL = "/logout";
  14.   public static final String CONTENT_TYPE = "application/json;charset=utf-8";
  15.   public static final String HEAD_CORS_ALLOW_ORIGIN = "Access-Control-Allow-Origin";
  16.   public static final String HEAD_CORS_ALLOW_METHODS = "Access-Control-Allow-Methods";
  17.   public static final String HEAD_CORS_ALLOW_HEADERS = "Access-Control-Allow-Headers";
  18.   public static final String HEAD_CORS_MAX_AGE = "Access-Control-Max-Age";
  19.   public static final String HEAD_CORS_ALLOW_ORIGIN_VALUE = "*";
  20.   public static final String HEAD_CORS_ALLOW_METHODS_VALUE = "*";
  21.   public static final String HEAD_CORS_ALLOW_HEADERS_VALUE = "Origin, X-Requested-With, Content-Type, Accept, " +
  22.           "Authorization, X-OA-ORGAN";
  23.   public static final String HEAD_CORS_MAX_AGE_VALUE = "3600";
  25. }