SpringSecurity个性化用户认证流程

⒈自定义登录页面

 package cn.coreqi.security.config;

 import org.springframework.context.annotation.Bean;

 import org.springframework.context.annotation.Configuration;

 import org.springframework.security.config.annotation.web.builders.HttpSecurity;

 import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;

 import org.springframework.security.crypto.password.NoOpPasswordEncoder;

 import org.springframework.security.crypto.password.PasswordEncoder;

 @Configuration

 public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

     @Bean

     public PasswordEncoder passwordEncoder(){

         return NoOpPasswordEncoder.getInstance();

     }

     @Override

     protected void configure(HttpSecurity http) throws Exception {

         //http.httpBasic()    //httpBasic登录 BasicAuthenticationFilter

         http.formLogin()    //表单登录 UsernamePasswordAuthenticationFilter

                 //.loginPage("/coreqi-signIn.html")  //指定登录页面

                 .loginPage("/authentication/require")

                 .loginProcessingUrl("/authentication/form") //指定表单提交的地址用于替换UsernamePasswordAuthenticationFilter默认的提交地址

                 .and()

                 .authorizeRequests()    //对授权请求进行配置

                 .antMatchers("/coreqi-signIn.html").permitAll() //指定登录页面不需要身份认证

                 .anyRequest().authenticated()  //任何请求都需要身份认证

                 .and().csrf().disable();    //禁用CSRF

             //FilterSecurityInterceptor 整个SpringSecurity过滤器链的最后一环

     }

 }

 package cn.coreqi.security.controller;

 import cn.coreqi.security.support.SimpleResponse;

 import org.slf4j.Logger;

 import org.slf4j.LoggerFactory;

 import org.springframework.http.HttpStatus;

 import org.springframework.security.web.DefaultRedirectStrategy;

 import org.springframework.security.web.RedirectStrategy;

 import org.springframework.security.web.savedrequest.HttpSessionRequestCache;

 import org.springframework.security.web.savedrequest.RequestCache;

 import org.springframework.security.web.savedrequest.SavedRequest;

 import org.springframework.util.StringUtils;

 import org.springframework.web.bind.annotation.GetMapping;

 import org.springframework.web.bind.annotation.ResponseStatus;

 import org.springframework.web.bind.annotation.RestController;

 import javax.servlet.http.HttpServletRequest;

 import javax.servlet.http.HttpServletResponse;

 import java.io.IOException;

 @RestController

 public class SecurityController {

     private Logger logger = LoggerFactory.getLogger(getClass());

     //拿到引发跳转的请求

     private RequestCache requestCache = new HttpSessionRequestCache();  //SpringSecurity执行身份认证跳转之前会将当前的请求缓存到HttpSessionRequestCache中

     //我们可以通过HttpSessionRequestCache把之前缓存的请求拿出来。

     private RedirectStrategy redirectStrategy = new DefaultRedirectStrategy();  //Spring用于跳转的工具

     /**

      * 当需要身份认证时，跳转到这里

      * @param request

      * @param response

      * @return

      */

     @GetMapping("/authentication/require")

     @ResponseStatus(code = HttpStatus.UNAUTHORIZED) //返回401状态码

     public SimpleResponse requireAuthentication(HttpServletRequest request, HttpServletResponse response) throws IOException {

         SavedRequest savedRequest = requestCache.getRequest(request,response);  //SavedRequest就是跳转前的请求

         if(savedRequest != null){   //如果请求缓存存在的话

             String target = savedRequest.getRedirectUrl();  //拿到引发跳转的请求URL

             logger.info("引发跳转的请求URL是：" + target);

             if(StringUtils.endsWithIgnoreCase(target,".html")){ //引发跳转的请求URL是否以html结尾

                 redirectStrategy.sendRedirect(request,response,"/coreqi-signIn.html"); //将请求跳转到指定的Url

             }

         }

         return new SimpleResponse(401,"访问的服务需要身份认证，请引导用户到登陆页面",null);

     }

 }

⒉自定义登录成功处理

　　默认情况下SpringSecurity登录成功了将会跳转到之前引发登录的那个请求上去，如果我们需要自定义登录成功后的处理过程，只需要实现AuthenticationSuccessHandler接口。(SpringSecurity默认的成功处理器是SavedRequestAwareAuthenticationSuccessHandler)

 package cn.coreqi.security.authentication;

 import com.fasterxml.jackson.databind.ObjectMapper;

 import org.slf4j.Logger;

 import org.slf4j.LoggerFactory;

 import org.springframework.beans.factory.annotation.Autowired;

 import org.springframework.security.core.Authentication;

 import org.springframework.security.web.authentication.AuthenticationSuccessHandler;

 import org.springframework.stereotype.Component;

 import javax.servlet.ServletException;

 import javax.servlet.http.HttpServletRequest;

 import javax.servlet.http.HttpServletResponse;

 import java.io.IOException;

 @Component("coreqiAuthenticationSuccessHandler")

 public class CoreqiAuthenticationSuccessHandler implements AuthenticationSuccessHandler {

     private Logger logger = LoggerFactory.getLogger(getClass());

     @Autowired

     private ObjectMapper objectMapper;  //将对象转换为Json的工具类，SpringMVC在启动的时候会自动为我们注册ObjectMapper

     /**

      *

      * @param httpServletRequest    不知道

      * @param httpServletResponse   不知道

      * @param authentication   Authentication接口是SpringSecurity的一个核心接口，它的作用是封装我们的认证信息，包含认证请求中的一些信息，包括认证请求的ip，Session是什么，以及认证用户的信息等等。

      * @throws IOException

      * @throws ServletException

      */

     @Override

     public void onAuthenticationSuccess(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, Authentication authentication) throws IOException, ServletException {

         logger.info("登录成功");

         httpServletResponse.setContentType("application/json;charset=UTF-8");

         httpServletResponse.getWriter().write(objectMapper.writeValueAsString(authentication));

     }

 }

配置

 package cn.coreqi.security.config;

 import org.springframework.beans.factory.annotation.Autowired;

 import org.springframework.context.annotation.Bean;

 import org.springframework.context.annotation.Configuration;

 import org.springframework.security.config.annotation.web.builders.HttpSecurity;

 import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;

 import org.springframework.security.crypto.password.NoOpPasswordEncoder;

 import org.springframework.security.crypto.password.PasswordEncoder;

 import org.springframework.security.web.authentication.AuthenticationSuccessHandler;

 @Configuration

 public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

     @Autowired

     private AuthenticationSuccessHandler coreqiAuthenticationSuccessHandler;

     @Bean

     public PasswordEncoder passwordEncoder(){

         return NoOpPasswordEncoder.getInstance();

     }

     @Override

     protected void configure(HttpSecurity http) throws Exception {

         //http.httpBasic()    //httpBasic登录 BasicAuthenticationFilter

         http.formLogin()    //表单登录 UsernamePasswordAuthenticationFilter

                 //.loginPage("/coreqi-signIn.html")  //指定登录页面

                 .loginPage("/authentication/require")

                 .loginProcessingUrl("/authentication/form") //指定表单提交的地址用于替换UsernamePasswordAuthenticationFilter默认的提交地址

                 .successHandler(coreqiAuthenticationSuccessHandler) //登录成功以后要用我们自定义的登录成功处理器，不用Spring默认的。

                 .and()

                 .authorizeRequests()    //对授权请求进行配置

                 .antMatchers("/coreqi-signIn.html").permitAll() //指定登录页面不需要身份认证

                 .anyRequest().authenticated()  //任何请求都需要身份认证

                 .and().csrf().disable();    //禁用CSRF

             //FilterSecurityInterceptor 整个SpringSecurity过滤器链的最后一环

     }

 }

⒊自定义登录失败处理

只需要实现AuthenticationSuccessHandler接口即可。（默认为SimpleUrlAuthenticationFailureHandler）

 package cn.coreqi.security.authentication;

 import com.fasterxml.jackson.databind.ObjectMapper;

 import org.slf4j.Logger;

 import org.slf4j.LoggerFactory;

 import org.springframework.beans.factory.annotation.Autowired;

 import org.springframework.http.HttpStatus;

 import org.springframework.security.core.AuthenticationException;

 import org.springframework.security.web.authentication.AuthenticationFailureHandler;

 import org.springframework.stereotype.Component;

 import javax.servlet.ServletException;

 import javax.servlet.http.HttpServletRequest;

 import javax.servlet.http.HttpServletResponse;

 import java.io.IOException;

 @Component("coreqiAuthenticationFailureHandler")

 public class CoreqiAuthenticationFailureHandler implements AuthenticationFailureHandler {

     private Logger logger = LoggerFactory.getLogger(getClass());

     @Autowired

     private ObjectMapper objectMapper;  //将对象转换为Json的工具类，SpringMVC在启动的时候会自动为我们注册ObjectMapper

     /**

      *

      * @param httpServletRequest    不知道

      * @param httpServletResponse   不知道

      * @param e AuthenticationException对象包含了在认证过程中发生的错误产生的异常

      * @throws IOException

      * @throws ServletException

      */

     @Override

     public void onAuthenticationFailure(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, AuthenticationException e) throws IOException, ServletException {

         logger.info("登录失败");

         httpServletResponse.setStatus(HttpStatus.INTERNAL_SERVER_ERROR.value());    //500状态码

         httpServletResponse.setContentType("application/json;charset=UTF-8");

         httpServletResponse.getWriter().write(objectMapper.writeValueAsString(e));

     }

 }

配置

 package cn.coreqi.security.config;

 import org.springframework.beans.factory.annotation.Autowired;

 import org.springframework.context.annotation.Bean;

 import org.springframework.context.annotation.Configuration;

 import org.springframework.security.config.annotation.web.builders.HttpSecurity;

 import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;

 import org.springframework.security.crypto.password.NoOpPasswordEncoder;

 import org.springframework.security.crypto.password.PasswordEncoder;

 import org.springframework.security.web.authentication.AuthenticationFailureHandler;

 import org.springframework.security.web.authentication.AuthenticationSuccessHandler;

 @Configuration

 public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

     @Autowired

     private AuthenticationSuccessHandler coreqiAuthenticationSuccessHandler;

     @Autowired

     private AuthenticationFailureHandler coreqiAuthenticationFailureHandler;

     @Bean

     public PasswordEncoder passwordEncoder(){

         return NoOpPasswordEncoder.getInstance();

     }

     @Override

     protected void configure(HttpSecurity http) throws Exception {

         //http.httpBasic()    //httpBasic登录 BasicAuthenticationFilter

         http.formLogin()    //表单登录 UsernamePasswordAuthenticationFilter

                 //.loginPage("/coreqi-signIn.html")  //指定登录页面

                 .loginPage("/authentication/require")

                 .loginProcessingUrl("/authentication/form") //指定表单提交的地址用于替换UsernamePasswordAuthenticationFilter默认的提交地址

                 .successHandler(coreqiAuthenticationSuccessHandler) //登录成功以后要用我们自定义的登录成功处理器，不用Spring默认的。

                 .failureHandler(coreqiAuthenticationFailureHandler) //自己体会把

                 .and()

                 .authorizeRequests()    //对授权请求进行配置

                 .antMatchers("/coreqi-signIn.html").permitAll() //指定登录页面不需要身份认证

                 .anyRequest().authenticated()  //任何请求都需要身份认证

                 .and().csrf().disable();    //禁用CSRF

             //FilterSecurityInterceptor 整个SpringSecurity过滤器链的最后一环

     }

 }