init
This commit is contained in:
ran.shang
@@ -0,0 +1,270 @@
|
||||
package com.senmesh.security.config;
|
||||
|
||||
import com.senmesh.security.ucard.UcardAuthenticationFilter;
|
||||
import com.senmesh.security.ucard.UcardAuthenticationProvider;
|
||||
import org.apache.commons.lang3.ArrayUtils;
|
||||
import org.apache.commons.lang3.BooleanUtils;
|
||||
import org.apache.commons.lang3.StringUtils;
|
||||
import org.springframework.beans.factory.annotation.Autowired;
|
||||
import org.springframework.security.access.AccessDecisionManager;
|
||||
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
|
||||
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
|
||||
import org.springframework.security.config.annotation.web.builders.WebSecurity;
|
||||
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
|
||||
import org.springframework.security.config.http.SessionCreationPolicy;
|
||||
import org.springframework.security.oauth2.client.registration.ClientRegistrationRepository;
|
||||
import org.springframework.security.oauth2.client.web.OAuth2AuthorizationRequestRedirectFilter;
|
||||
import org.springframework.security.web.access.intercept.FilterInvocationSecurityMetadataSource;
|
||||
import org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter;
|
||||
import org.springframework.security.web.authentication.AnonymousAuthenticationFilter;
|
||||
import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
|
||||
import org.springframework.stereotype.Component;
|
||||
|
||||
import com.senmesh.security.access.intercept.FilterSecurityInterceptor;
|
||||
import com.senmesh.security.handle.MyAuthenctiationFailureHandler;
|
||||
import com.senmesh.security.handle.MyLoginSuccessHandler;
|
||||
import com.senmesh.security.handle.MyLoginUrlAuthenticationEntryPoint;
|
||||
import com.senmesh.security.handle.MyLogoutSuccessHandler;
|
||||
import com.senmesh.security.jwt.JwtAuthenticationTokenFilter;
|
||||
import com.senmesh.security.mobile.MobileAuthenticationFilter;
|
||||
import com.senmesh.security.mobile.MobileAuthenticationProvider;
|
||||
import com.senmesh.security.social.service.StandardAuthorizationCodeTokenResponseClient;
|
||||
import com.senmesh.security.social.service.StandardOAuth2UserService;
|
||||
import com.senmesh.security.social.service.StandardOauth2AuthorizationRequestResolver;
|
||||
import com.senmesh.security.ssb.SsbAuthenticationFilter;
|
||||
import com.senmesh.security.ssb.SsbAuthenticationProvider;
|
||||
import com.senmesh.security.temptoken.TokenAuthenticationFilter;
|
||||
import com.senmesh.security.temptoken.TokenAuthenticationProvider;
|
||||
import com.senmesh.security.upassword.UpasswordAuthenticationFilter;
|
||||
import com.senmesh.security.upassword.UpasswordAuthenticationProvider;
|
||||
import com.senmesh.swagger.config.SwaggerConfig;
|
||||
import com.senmesh.usercenter.user.login.service.UserLoginService;
|
||||
import com.senmesh.usercenter.websocket.util.WebSocketUtils;
|
||||
|
||||
import lombok.extern.slf4j.Slf4j;
|
||||
|
||||
/**
|
||||
* security配置
|
||||
*
|
||||
* @author on 2019-11-05
|
||||
*/
|
||||
@Slf4j
|
||||
@Component
|
||||
public class WebSecurityConfigurer extends WebSecurityConfigurerAdapter {
|
||||
|
||||
@Autowired
|
||||
private SecurityProperties securityProperties;
|
||||
|
||||
@Autowired
|
||||
private MyLogoutSuccessHandler myLogoutSuccessHandler;
|
||||
|
||||
@Autowired
|
||||
private MyLoginSuccessHandler myLoginSuccessHandler;
|
||||
|
||||
@Autowired
|
||||
private MyAuthenctiationFailureHandler myAuthenctiationFailureHandler;
|
||||
|
||||
@Autowired
|
||||
private FilterInvocationSecurityMetadataSource securityMetadataSource;
|
||||
|
||||
@Autowired
|
||||
private AccessDecisionManager accessDecisionManager;
|
||||
|
||||
@Autowired(required = false)
|
||||
private UpasswordAuthenticationProvider upasswordAuthenticationProvider;
|
||||
|
||||
@Autowired(required = false)
|
||||
private MobileAuthenticationProvider mobileAuthenticationProvider;
|
||||
|
||||
@Autowired(required = false)
|
||||
private TokenAuthenticationProvider tokenAuthenticationProvider;
|
||||
@Autowired
|
||||
private SsbAuthenticationProvider ssbAuthenticationProvider;
|
||||
|
||||
@Autowired(required = false)
|
||||
private UcardAuthenticationProvider ucardAuthenticationProvider;
|
||||
|
||||
@Autowired
|
||||
private SwaggerConfig swaggerConfig;
|
||||
|
||||
@Autowired(required = false)
|
||||
private UserLoginService userLoginService;
|
||||
|
||||
@Autowired(required = false)
|
||||
private ClientRegistrationRepository standardClientRegistrationRepository;
|
||||
|
||||
@Override
|
||||
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
|
||||
// 添加cas认证提供者
|
||||
auth.authenticationProvider(upasswordAuthenticationProvider)
|
||||
.authenticationProvider(mobileAuthenticationProvider)
|
||||
.authenticationProvider(tokenAuthenticationProvider)
|
||||
.authenticationProvider(ssbAuthenticationProvider)
|
||||
.authenticationProvider(ucardAuthenticationProvider);
|
||||
;
|
||||
}
|
||||
|
||||
@Override
|
||||
public void configure(WebSecurity web) throws Exception {
|
||||
String[] ignoringArray = securityProperties.getIgnoringArray();
|
||||
// swagger 接口文档，不设置访问权限
|
||||
if (swaggerConfig.isSwaggerEnable() && StringUtils.isNotBlank(SwaggerConfig.ACCESS_PREFIX)) {
|
||||
ignoringArray = ArrayUtils.addAll(ignoringArray, SwaggerConfig.ACCESS_PREFIX.split(","));
|
||||
}
|
||||
// websocket
|
||||
if (StringUtils.isNotBlank(WebSocketUtils.getPath())) {
|
||||
ignoringArray = ArrayUtils.add(ignoringArray, WebSocketUtils.getPath());
|
||||
}
|
||||
// 忽略的资源，直接跳过spring security权限校验
|
||||
web.ignoring()
|
||||
.antMatchers(ignoringArray)/*.antMatchers(securityProperties.getAnonymousArray())*/;
|
||||
}
|
||||
|
||||
@Override
|
||||
protected void configure(HttpSecurity http) throws Exception {
|
||||
log.info("------WebSecurityConfigurer configure");
|
||||
http
|
||||
.logout()
|
||||
.logoutSuccessHandler(myLogoutSuccessHandler).and()
|
||||
// 自定义认证失败处理器
|
||||
.exceptionHandling().authenticationEntryPoint(
|
||||
new MyLoginUrlAuthenticationEntryPoint(securityProperties.getLoginPage()))
|
||||
.and();
|
||||
|
||||
if (BooleanUtils.isTrue(securityProperties.getOauth2().getEnable())) {
|
||||
// oauth2
|
||||
http.oauth2Login()
|
||||
.authorizationEndpoint()
|
||||
.authorizationRequestResolver(
|
||||
new StandardOauth2AuthorizationRequestResolver(
|
||||
this.standardClientRegistrationRepository,
|
||||
OAuth2AuthorizationRequestRedirectFilter.DEFAULT_AUTHORIZATION_REQUEST_BASE_URI))
|
||||
.and()
|
||||
.tokenEndpoint()
|
||||
.accessTokenResponseClient(new StandardAuthorizationCodeTokenResponseClient())
|
||||
.and()
|
||||
.userInfoEndpoint().userService(new StandardOAuth2UserService()).and()
|
||||
.failureHandler(myAuthenctiationFailureHandler)
|
||||
.successHandler(myLoginSuccessHandler).and();
|
||||
}
|
||||
http.addFilterAfter(upasswordAuthenticationFilter(),
|
||||
UsernamePasswordAuthenticationFilter.class);
|
||||
http.addFilterAfter(mobileAuthenticationFilter(), UpasswordAuthenticationFilter.class);
|
||||
http.addFilterAfter(tokenAuthenticationFilter(), UpasswordAuthenticationFilter.class);
|
||||
http.addFilterAfter(ssbAuthenticationFilter(), UpasswordAuthenticationFilter.class);
|
||||
http.addFilterAfter(ucardAuthenticationFilter(), UpasswordAuthenticationFilter.class);
|
||||
|
||||
|
||||
// 禁用CSRF
|
||||
http.csrf().disable();
|
||||
http.headers().frameOptions().deny();
|
||||
http.headers().xssProtection().block(true);
|
||||
http.headers().contentTypeOptions();
|
||||
|
||||
// 拦截器
|
||||
FilterSecurityInterceptor securityInterceptor = createFilterSecurityInterceptor();
|
||||
http.addFilterAfter(securityInterceptor,
|
||||
org.springframework.security.web.access.intercept.FilterSecurityInterceptor.class);
|
||||
|
||||
http.setSharedObject(FilterSecurityInterceptor.class, securityInterceptor);
|
||||
|
||||
// 启用jwt
|
||||
if (Boolean.TRUE.equals(securityProperties.getJwt().getEnable())) {
|
||||
JwtAuthenticationTokenFilter jwtAuthenticationTokenFilter =
|
||||
createJwtAuthenticationTokenFilter();
|
||||
http.addFilterAfter(jwtAuthenticationTokenFilter,
|
||||
AnonymousAuthenticationFilter.class);
|
||||
// 禁用session
|
||||
http.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
private JwtAuthenticationTokenFilter createJwtAuthenticationTokenFilter() {
|
||||
return new JwtAuthenticationTokenFilter(securityProperties);
|
||||
}
|
||||
|
||||
/**
|
||||
* 拦截器
|
||||
*
|
||||
* @return
|
||||
* @throws Exception
|
||||
* @author sr on 2019-11-28
|
||||
*/
|
||||
private FilterSecurityInterceptor createFilterSecurityInterceptor() throws Exception {
|
||||
FilterSecurityInterceptor securityInterceptor = new FilterSecurityInterceptor();
|
||||
securityInterceptor.setSecurityMetadataSource(securityMetadataSource);
|
||||
securityInterceptor.setAccessDecisionManager(accessDecisionManager);
|
||||
// httpSecurity中shareobject共用的authenticationBuilder
|
||||
securityInterceptor.setAuthenticationManager(this.authenticationManagerBean());
|
||||
securityInterceptor.setUserLoginService(userLoginService);
|
||||
securityInterceptor.afterPropertiesSet();
|
||||
return securityInterceptor;
|
||||
}
|
||||
|
||||
/**
|
||||
* 手机号登录请求过滤器
|
||||
*
|
||||
* @param authenticationManager
|
||||
* @return
|
||||
* @throws Exception
|
||||
* @author sr on 2020-06-04
|
||||
*/
|
||||
private MobileAuthenticationFilter mobileAuthenticationFilter() throws Exception {
|
||||
MobileAuthenticationFilter filter = new MobileAuthenticationFilter();
|
||||
addHandler(filter);
|
||||
return filter;
|
||||
}
|
||||
|
||||
private void addHandler(AbstractAuthenticationProcessingFilter filter) throws Exception {
|
||||
filter.setAuthenticationManager(this.authenticationManagerBean());
|
||||
filter.setAuthenticationSuccessHandler(myLoginSuccessHandler);
|
||||
filter.setAuthenticationFailureHandler(myAuthenctiationFailureHandler);
|
||||
}
|
||||
|
||||
/**
|
||||
* 账号密码
|
||||
*
|
||||
* @return
|
||||
* @throws Exception
|
||||
* @author sr on 2021-06-22
|
||||
*/
|
||||
private UpasswordAuthenticationFilter upasswordAuthenticationFilter() throws Exception {
|
||||
UpasswordAuthenticationFilter filter = new UpasswordAuthenticationFilter();
|
||||
addHandler(filter);
|
||||
return filter;
|
||||
}
|
||||
|
||||
/**
|
||||
* 临时token
|
||||
*
|
||||
* @return
|
||||
* @throws Exception
|
||||
* @author sr on 2021-06-22
|
||||
*/
|
||||
private TokenAuthenticationFilter tokenAuthenticationFilter() throws Exception {
|
||||
TokenAuthenticationFilter filter = new TokenAuthenticationFilter();
|
||||
addHandler(filter);
|
||||
return filter;
|
||||
}
|
||||
|
||||
private SsbAuthenticationFilter ssbAuthenticationFilter() throws Exception {
|
||||
SsbAuthenticationFilter filter = new SsbAuthenticationFilter();
|
||||
addHandler(filter);
|
||||
return filter;
|
||||
}
|
||||
|
||||
/**
|
||||
* 身份证登录
|
||||
* @return
|
||||
* @throws Exception
|
||||
* @author sr on 2024-09-23
|
||||
*/
|
||||
private UcardAuthenticationFilter ucardAuthenticationFilter() throws Exception {
|
||||
UcardAuthenticationFilter filter = new UcardAuthenticationFilter();
|
||||
addHandler(filter);
|
||||
return filter;
|
||||
}
|
||||
|
||||
|
||||
}
|
||||
Reference in New Issue
Block a user