官网链接

认证原理分析

:::tips Spring Security所解决的问题就是安全访问控制，而安全访问控制功能其实就是对所有进入系统的请求进行拦截，校验每个请求是否能够访问它所期望的资源。根据前边知识的学习，可以通过Filter或AOP等技术来实现，Spring Security对Web资源的保护是靠Filter实现的，所以从这个Filter来入手，逐步深入Spring Security原理。 当初始化Spring Security时，会创建一个名为 SpringSecurityFilterChain的Servlet过滤器，类型为 org.springframework.security.web.FilterChainProxy，它实现了javax.servlet.Filter，因此外部的请求会经过此 类，下图是Spring Security过虑器链结构图 ::: image.png :::tips FilterChainProxy是一个代理，真正起作用的是FilterChainProxy中SecurityFilterChain所包含的各个Filter，同时 这些Filter作为Bean被Spring管理，它们是Spring Security核心，各有各的职责，但他们并不直接处理用户的认 证，也不直接处理用户的授权，而是把它们交给了认证管理器（AuthenticationManager）和决策管理器 （AccessDecisionManager）进行处理。 :::

使用步骤：

:::tips
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-security</artifactId>
</dependency> :::

自定义Security认证过滤器

  1. import com.fasterxml.jackson.databind.ObjectMapper;
  2. import org.springframework.http.MediaType;
  3. import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
  4. import org.springframework.security.core.Authentication;
  5. import org.springframework.security.core.AuthenticationException;
  6. import org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter;
  8. import javax.servlet.FilterChain;
  9. import javax.servlet.ServletException;
  10. import javax.servlet.ServletInputStream;
  11. import javax.servlet.http.HttpServletRequest;
  12. import javax.servlet.http.HttpServletResponse;
  13. import java.awt.*;
  14. import java.io.IOException;
  15. import java.util.HashMap;
  17. /**
  18.  * @author by itheima
  19.  * @Date 2022/1/21
  20.  * @Description
  21.  */
  22. public class MyUserNamePasswordAuthenticationFilter extends AbstractAuthenticationProcessingFilter {
  24.     /**
  25.      * 设置构造，传入自定义登录url地址
  26.      * @param defaultFilterProcessesUrl
  27.      */
  28.     public MyUserNamePasswordAuthenticationFilter(String defaultFilterProcessesUrl) {
  29.         super(defaultFilterProcessesUrl);
  30.     }
  32.     @Override
  33.     public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response) throws AuthenticationException, IOException, ServletException {
  34.         //从post请求流中获取登录信息
  35.         String username=null;
  36.         String password=null;
  37.         try {
  38.             //判断 是否是ajax登录
  39.             if (request.getContentType().equalsIgnoreCase(MediaType.APPLICATION_JSON_VALUE) || request.getContentType().equalsIgnoreCase(MediaType.APPLICATION_JSON_UTF8_VALUE)) {
  40.                 ServletInputStream in = request.getInputStream();
  41.                 HashMap<String,String> map = new ObjectMapper().readValue(in, HashMap.class);
  42.                 username=map.get("username");
  43.                 password=map.get("password");
  44.             }
  46.         } catch (IOException e) {
  47.             e.printStackTrace();
  48.         }
  49.         //生成认证token
  50.         UsernamePasswordAuthenticationToken token = new UsernamePasswordAuthenticationToken(username, password);
  51.         //交给认证管理器取认证token
  52.         return this.getAuthenticationManager().authenticate(token);
  53.     }
  55.     /**
  56.      * 认证成功处理方法
  57.      * @param request
  58.      * @param response
  59.      * @param chain
  60.      * @param authResult
  61.      * @throws IOException
  62.      * @throws ServletException
  63.      */
  64.     @Override
  65.     protected void successfulAuthentication(HttpServletRequest request,
  66.                                             HttpServletResponse response,
  67.                                             FilterChain chain,
  68.                                             Authentication authResult) throws IOException, ServletException {
  69.           //认证主体信息
  70.         UserDetails principal = (UserDetails) authResult.getPrincipal();
  71.         //组装响应前端的信息
  72.         String username = principal.getUsername();
  73.         String password = principal.getPassword();
  74.         Collection<? extends GrantedAuthority> authorities = principal.getAuthorities();
  75.         //构建JwtToken
  76.         String token = JwtTokenUtil.createToken(username, new Gson().toJson(authorities));
  77.         HashMap<String, String> info = new HashMap<>();
  78.         info.put("name",username);
  79.         info.put("token",token);
  80.         //设置响应格式
  81.         response.setContentType(MediaType.APPLICATION_JSON_VALUE);
  82.         response.getWriter().write(new Gson().toJson(info));
  83.     }
  85.     /**
  86.      * 认证失败处理方法
  87.      * @param request
  88.      * @param response
  89.      * @param failed
  90.      * @throws IOException
  91.      * @throws ServletException
  92.      */
  93.     @Override
  94.     protected void unsuccessfulAuthentication(HttpServletRequest request,
  95.                                               HttpServletResponse response,
  96.                                               AuthenticationException failed) throws IOException, ServletException {
  97.          String returnData="";
  98.         // 账号过期
  99.         if (failed instanceof AccountExpiredException) {
  100.             returnData="账号过期";
  101.         }
  102.         // 密码错误
  103.         else if (failed instanceof BadCredentialsException) {
  104.             returnData="密码错误";
  105.         }
  106.         // 密码过期
  107.         else if (failed instanceof CredentialsExpiredException) {
  108.             returnData="密码过期";
  109.         }
  110.         // 账号不可用
  111.         else if (failed instanceof DisabledException) {
  112.             returnData="账号不可用";
  113.         }
  114.         //账号锁定
  115.         else if (failed instanceof LockedException) {
  116.             returnData="账号锁定";
  117.         }
  118.         // 用户不存在
  119.         else if (failed instanceof InternalAuthenticationServiceException) {
  120.             returnData="用户不存在";
  121.         }
  122.         // 其他错误
  123.         else{
  124.             returnData="未知异常";
  125.         }
  126.         // 处理编码方式 防止中文乱码
  127.         response.setContentType(MediaType.APPLICATION_JSON_UTF8_VALUE);
  128.         // 将反馈塞到HttpServletResponse中返回给前台
  129.         R result = R.error(returnData);
  130.         response.getWriter().write(new Gson().toJson(result));
  131.     }
  132. }

定义获取用户详情服务bean

  1. import com.itheima.entity.TbUser;
  2. import com.itheima.mapper.TbUserMapper;
  3. import org.springframework.beans.factory.annotation.Autowired;
  4. import org.springframework.security.core.GrantedAuthority;
  5. import org.springframework.security.core.authority.AuthorityUtils;
  6. import org.springframework.security.core.userdetails.User;
  7. import org.springframework.security.core.userdetails.UserDetails;
  8. import org.springframework.security.core.userdetails.UserDetailsService;
  9. import org.springframework.security.core.userdetails.UsernameNotFoundException;
  10. import org.springframework.stereotype.Service;
  12. import java.util.List;
  14. /**
  15.  * @author by itheima
  16.  * @Date 2022/5/23
  17.  * @Description
  18.  */
  19. @Service("userDetailsService")
  20. public class MyUserDetailServiceImpl implements UserDetailsService {
  22.     @Autowired
  23.     private TbUserMapper tbUserMapper;
  24.     /**
  25.      * 使用security当用户认证时，会自动将用户的名称注入到该方法中
  26.      * 然后我们可以自己写逻辑取加载用户的信息，然后组装成UserDetails认证对象
  27.      * @param userName
  28.      * @return 用户的基础信息，包含密码和权限集合，security底层会自动比对前端输入的明文密码
  29.      * @throws UsernameNotFoundException
  30.      */
  31.     @Override
  32.     public UserDetails loadUserByUsername(String userName) throws UsernameNotFoundException {
  33.         //1.根据用户名称获取用户的账户信息
  34.         TbUser dbUser=tbUserMapper.findUserInfoByName(userName);
  35.         //判断该用户是否存在
  36.         if (dbUser==null) {
  37.             throw new UsernameNotFoundException("用户名输入错误！");
  38.         }
  39.         //2.组装UserDetails对象
  40.         //获取当前用户对应的权限集合（自动将以逗号间隔的权限字符串封装到权限集合中）
  41.         List<GrantedAuthority> list = AuthorityUtils.commaSeparatedStringToAuthorityList(dbUser.getRoles());
  42.         /*
  43.             参数1：账户
  44.             参数2：密码
  45.             参数3：权限集合
  46.          */
  47.         User user = new User(dbUser.getUsername(), dbUser.getPassword(), list);
  48.         return user;
  49.     }
  50. }

定义SecurityConfig类

  1.     /**
  2.      * 配置授权策略
  3.      * @param http
  4.      * @throws Exception
  5.      */
  6.     @Override
  7.     protected void configure(HttpSecurity http) throws Exception {
  8.         http
  9.                   //坑-过滤器要添加在默认过滤器之前，否则，登录失效
  10.                 .addFilterBefore(myUserNamePasswordAuthenticationFilter(), UsernamePasswordAuthenticationFilter.class)
  11.                 .csrf().disable();
  12.     }
  15.     @Bean
  16.     public MyUserNamePasswordAuthenticationFilter myUserNamePasswordAuthenticationFilter() throws Exception {
  17.           //设置默认登录路径
  18.         MyUserNamePasswordAuthenticationFilter myUserNamePasswordAuthenticationFilter =
  19.                 new MyUserNamePasswordAuthenticationFilter("/authentication/form");
  20.         myUserNamePasswordAuthenticationFilter.setAuthenticationManager(authenticationManagerBean());
  21.         return myUserNamePasswordAuthenticationFilter;
  22.     }

自定义权限认证过滤

  1. import com.google.gson.Gson;
  2. import com.itheima.security.utils.JwtTokenUtil;
  3. import org.springframework.http.MediaType;
  4. import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
  5. import org.springframework.security.core.authority.AuthorityUtils;
  6. import org.springframework.security.core.context.SecurityContextHolder;
  7. import org.springframework.web.filter.OncePerRequestFilter;
  9. import javax.servlet.FilterChain;
  10. import javax.servlet.ServletException;
  11. import javax.servlet.http.HttpServletRequest;
  12. import javax.servlet.http.HttpServletResponse;
  13. import java.io.IOException;
  14. import java.util.HashMap;
  16. /**
  17.  * @author by itheima
  18.  * @Date 2022/1/23
  19.  * @Description 权限认证filter
  20.  */
  21. public class AuthenticationFilter extends OncePerRequestFilter {
  22.     @Override
  23.     protected void doFilterInternal(HttpServletRequest request,
  24.                                     HttpServletResponse response,
  25.                                     FilterChain filterChain) throws ServletException, IOException {
  26.         //1.从http请求头中获取token
  27.         String token = request.getHeader(JwtTokenUtil.TOKEN_HEADER);
  28.         if (token==null) {
  29.             //用户未登录,则放行，去登录拦截
  30.             filterChain.doFilter(request,response);
  31.             return;
  32.         }
  33.         //2.token存在则，安全校验
  34.         try {
  35.             String username = JwtTokenUtil.getUsername(token);
  36.             //获取以逗号间隔的权限拼接字符串
  37.             String userRole = JwtTokenUtil.getUserRole(token);
  38.             //组装token
  39.             UsernamePasswordAuthenticationToken authenticationToken = new UsernamePasswordAuthenticationToken(username, null, AuthorityUtils.commaSeparatedStringToAuthorityList(userRole));
  40.             //将生成的token存入上下文
  41.             SecurityContextHolder.getContext().setAuthentication(authenticationToken);
  42.             //放行资源
  43.             filterChain.doFilter(request,response);
  44.         } catch (Exception e) {
  45.             e.printStackTrace();
  46. //            throw new RuntimeException("token无效");
  47.             response.setContentType(MediaType.APPLICATION_JSON_VALUE);
  48.             HashMap<String, String> info = new HashMap<>();
  49.             info.put("status","0");
  50.             info.put("ex","无效的token凭证");
  51.             response.getWriter().write(new Gson().toJson(info));
  52.         }
  53.     }
  54. }

配置授权拒绝策略

image.png

自定义访问拒绝处理器

  2. import com.google.gson.Gson;
  3. import com.itheima.stock.vo.resp.R;
  4. import com.itheima.stock.vo.resp.ResponseCode;
  5. import org.springframework.http.MediaType;
  6. import org.springframework.security.access.AccessDeniedException;
  7. import org.springframework.security.web.access.AccessDeniedHandler;
  9. import javax.servlet.ServletException;
  10. import javax.servlet.http.HttpServletRequest;
  11. import javax.servlet.http.HttpServletResponse;
  12. import java.io.IOException;
  14. /**
  15.  * 认证用户无权限访问资源时处理器
  16.  */
  17. public class StockAccessDeniedHandler implements AccessDeniedHandler {
  19.     @Override
  20.     public void handle(HttpServletRequest request, HttpServletResponse response, AccessDeniedException accessDeniedException) throws IOException, ServletException {
  21.         //设置响应数据格式
  22.         response.setContentType(MediaType.APPLICATION_JSON_UTF8_VALUE);
  23.         //构建结果
  24.         R result = R.error(ResponseCode.NOT_PERMISSION.getCode(),ResponseCode.NOT_PERMISSION.getMessage());
  25.         //将对象序列化为json字符串响应前台
  26.         response.getWriter().write(new Gson().toJson(result));
  27.     }
  28. }

自定义匿名用户拒绝处理器

import com.google.gson.Gson;
import com.itheima.stock.vo.resp.R;
import com.itheima.stock.vo.resp.ResponseCode;
import org.springframework.http.MediaType;
import org.springframework.security.core.AuthenticationException;
import org.springframework.security.web.AuthenticationEntryPoint;

import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;

/**
 * 匿名用户(即未登录时访问资源为匿名访问)无权限处理器
 */
public class AccessAnonymousEntryPoint implements AuthenticationEntryPoint {

    /**
     * 当用户请求了一个受保护的资源，但是用户没有通过认证，那么抛出异常，
     * AuthenticationEntryPoint. Commence(..)就会被调用。
     * @param request
     * @param response
     * @param authException
     * @throws IOException
     * @throws ServletException
     */
    @Override
    public void commence(HttpServletRequest request, HttpServletResponse response, AuthenticationException authException) throws IOException, ServletException {
        //设置响应数据格式
        response.setContentType(MediaType.APPLICATION_JSON_UTF8_VALUE);
        //构建结果
        R result = R.error(ResponseCode.NOT_PERMISSION.getCode(),ResponseCode.NOT_PERMISSION.getMessage());
        //将对象序列化为json字符串响应前台
        response.getWriter().write(new Gson().toJson(result));
    }
}

整体流程小结

image.png
image.png