263 lines
9.9 KiB
Java
263 lines
9.9 KiB
Java
package com.senmesh.security.config;
|
||
|
||
import com.senmesh.security.ucard.UcardAuthenticationFilter;
|
||
import com.senmesh.security.ucard.UcardAuthenticationProvider;
|
||
import org.apache.commons.lang3.ArrayUtils;
|
||
import org.apache.commons.lang3.BooleanUtils;
|
||
import org.apache.commons.lang3.StringUtils;
|
||
import org.springframework.beans.factory.annotation.Autowired;
|
||
import org.springframework.security.access.AccessDecisionManager;
|
||
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
|
||
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
|
||
import org.springframework.security.config.annotation.web.builders.WebSecurity;
|
||
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
|
||
import org.springframework.security.config.http.SessionCreationPolicy;
|
||
import org.springframework.security.oauth2.client.registration.ClientRegistrationRepository;
|
||
import org.springframework.security.oauth2.client.web.OAuth2AuthorizationRequestRedirectFilter;
|
||
import org.springframework.security.web.access.intercept.FilterInvocationSecurityMetadataSource;
|
||
import org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter;
|
||
import org.springframework.security.web.authentication.AnonymousAuthenticationFilter;
|
||
import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
|
||
import org.springframework.stereotype.Component;
|
||
|
||
import com.senmesh.security.access.intercept.FilterSecurityInterceptor;
|
||
import com.senmesh.security.handle.MyAuthenctiationFailureHandler;
|
||
import com.senmesh.security.handle.MyLoginSuccessHandler;
|
||
import com.senmesh.security.handle.MyLoginUrlAuthenticationEntryPoint;
|
||
import com.senmesh.security.handle.MyLogoutSuccessHandler;
|
||
import com.senmesh.security.jwt.JwtAuthenticationTokenFilter;
|
||
import com.senmesh.security.mobile.MobileAuthenticationFilter;
|
||
import com.senmesh.security.mobile.MobileAuthenticationProvider;
|
||
import com.senmesh.security.social.service.StandardAuthorizationCodeTokenResponseClient;
|
||
import com.senmesh.security.social.service.StandardOAuth2UserService;
|
||
import com.senmesh.security.social.service.StandardOauth2AuthorizationRequestResolver;
|
||
import com.senmesh.security.temptoken.TokenAuthenticationFilter;
|
||
import com.senmesh.security.temptoken.TokenAuthenticationProvider;
|
||
import com.senmesh.security.upassword.UpasswordAuthenticationFilter;
|
||
import com.senmesh.security.upassword.UpasswordAuthenticationProvider;
|
||
import com.senmesh.swagger.config.SwaggerConfig;
|
||
import com.senmesh.usercenter.user.login.service.UserLoginService;
|
||
import com.senmesh.usercenter.websocket.util.WebSocketUtils;
|
||
|
||
import lombok.extern.slf4j.Slf4j;
|
||
|
||
/**
|
||
* security配置
|
||
*
|
||
* @author on 2019-11-05
|
||
*/
|
||
@Slf4j
|
||
@Component
|
||
public class WebSecurityConfigurer extends WebSecurityConfigurerAdapter {
|
||
|
||
@Autowired
|
||
private SecurityProperties securityProperties;
|
||
|
||
@Autowired
|
||
private MyLogoutSuccessHandler myLogoutSuccessHandler;
|
||
|
||
@Autowired
|
||
private MyLoginSuccessHandler myLoginSuccessHandler;
|
||
|
||
@Autowired
|
||
private MyAuthenctiationFailureHandler myAuthenctiationFailureHandler;
|
||
|
||
@Autowired
|
||
private FilterInvocationSecurityMetadataSource securityMetadataSource;
|
||
|
||
@Autowired
|
||
private AccessDecisionManager accessDecisionManager;
|
||
|
||
@Autowired(required = false)
|
||
private UpasswordAuthenticationProvider upasswordAuthenticationProvider;
|
||
|
||
@Autowired(required = false)
|
||
private MobileAuthenticationProvider mobileAuthenticationProvider;
|
||
|
||
@Autowired(required = false)
|
||
private TokenAuthenticationProvider tokenAuthenticationProvider;
|
||
|
||
@Autowired(required = false)
|
||
private UcardAuthenticationProvider ucardAuthenticationProvider;
|
||
|
||
@Autowired(required = false)
|
||
private SwaggerConfig swaggerConfig;
|
||
|
||
@Autowired(required = false)
|
||
private UserLoginService userLoginService;
|
||
|
||
@Autowired(required = false)
|
||
private ClientRegistrationRepository standardClientRegistrationRepository;
|
||
|
||
@Override
|
||
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
|
||
// 添加cas认证提供者
|
||
auth.authenticationProvider(upasswordAuthenticationProvider)
|
||
.authenticationProvider(mobileAuthenticationProvider)
|
||
.authenticationProvider(tokenAuthenticationProvider)
|
||
.authenticationProvider(ucardAuthenticationProvider);
|
||
;
|
||
}
|
||
|
||
@Override
|
||
public void configure(WebSecurity web) throws Exception {
|
||
String[] ignoringArray = securityProperties.getIgnoringArray();
|
||
// swagger 接口文档，不设置访问权限
|
||
if (swaggerConfig != null && swaggerConfig.isSwaggerEnable() && StringUtils.isNotBlank(SwaggerConfig.ACCESS_PREFIX)) {
|
||
ignoringArray = ArrayUtils.addAll(ignoringArray, SwaggerConfig.ACCESS_PREFIX.split(","));
|
||
}
|
||
// websocket
|
||
if (StringUtils.isNotBlank(WebSocketUtils.getPath())) {
|
||
ignoringArray = ArrayUtils.add(ignoringArray, WebSocketUtils.getPath());
|
||
}
|
||
// 忽略的资源，直接跳过spring security权限校验
|
||
web.ignoring()
|
||
.antMatchers(ignoringArray)/*.antMatchers(securityProperties.getAnonymousArray())*/;
|
||
}
|
||
|
||
@Override
|
||
protected void configure(HttpSecurity http) throws Exception {
|
||
log.info("------WebSecurityConfigurer configure");
|
||
http
|
||
.logout()
|
||
.logoutSuccessHandler(myLogoutSuccessHandler).and()
|
||
// 自定义认证失败处理器
|
||
.exceptionHandling().authenticationEntryPoint(
|
||
new MyLoginUrlAuthenticationEntryPoint(securityProperties.getLoginPage()))
|
||
.and();
|
||
|
||
if (BooleanUtils.isTrue(securityProperties.getOauth2().getEnable())) {
|
||
// oauth2
|
||
http.oauth2Login()
|
||
.authorizationEndpoint()
|
||
.authorizationRequestResolver(
|
||
new StandardOauth2AuthorizationRequestResolver(
|
||
this.standardClientRegistrationRepository,
|
||
OAuth2AuthorizationRequestRedirectFilter.DEFAULT_AUTHORIZATION_REQUEST_BASE_URI))
|
||
.and()
|
||
.tokenEndpoint()
|
||
.accessTokenResponseClient(new StandardAuthorizationCodeTokenResponseClient())
|
||
.and()
|
||
.userInfoEndpoint().userService(new StandardOAuth2UserService()).and()
|
||
.failureHandler(myAuthenctiationFailureHandler)
|
||
.successHandler(myLoginSuccessHandler).and();
|
||
}
|
||
http.addFilterAfter(upasswordAuthenticationFilter(),
|
||
UsernamePasswordAuthenticationFilter.class);
|
||
http.addFilterAfter(mobileAuthenticationFilter(), UpasswordAuthenticationFilter.class);
|
||
http.addFilterAfter(tokenAuthenticationFilter(), UpasswordAuthenticationFilter.class);
|
||
http.addFilterAfter(ucardAuthenticationFilter(), UpasswordAuthenticationFilter.class);
|
||
|
||
|
||
// 禁用CSRF
|
||
// http.csrf().disable();
|
||
http.csrf(c -> c.ignoringAntMatchers("/login")) // 登录接口免 CSRF
|
||
;
|
||
http.headers().frameOptions().deny();
|
||
http.headers().xssProtection().block(true);
|
||
http.headers().contentTypeOptions();
|
||
|
||
// 拦截器
|
||
FilterSecurityInterceptor securityInterceptor = createFilterSecurityInterceptor();
|
||
http.addFilterAfter(securityInterceptor,
|
||
org.springframework.security.web.access.intercept.FilterSecurityInterceptor.class);
|
||
|
||
http.setSharedObject(FilterSecurityInterceptor.class, securityInterceptor);
|
||
|
||
// 启用jwt
|
||
if (Boolean.TRUE.equals(securityProperties.getJwt().getEnable())) {
|
||
JwtAuthenticationTokenFilter jwtAuthenticationTokenFilter =
|
||
createJwtAuthenticationTokenFilter();
|
||
http.addFilterAfter(jwtAuthenticationTokenFilter,
|
||
AnonymousAuthenticationFilter.class);
|
||
// 禁用session
|
||
http.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);
|
||
}
|
||
|
||
}
|
||
|
||
private JwtAuthenticationTokenFilter createJwtAuthenticationTokenFilter() {
|
||
return new JwtAuthenticationTokenFilter(securityProperties);
|
||
}
|
||
|
||
/**
|
||
* 拦截器
|
||
*
|
||
* @return
|
||
* @throws Exception
|
||
* @author sr on 2019-11-28
|
||
*/
|
||
private FilterSecurityInterceptor createFilterSecurityInterceptor() throws Exception {
|
||
FilterSecurityInterceptor securityInterceptor = new FilterSecurityInterceptor();
|
||
securityInterceptor.setSecurityMetadataSource(securityMetadataSource);
|
||
securityInterceptor.setAccessDecisionManager(accessDecisionManager);
|
||
// httpSecurity中shareobject共用的authenticationBuilder
|
||
securityInterceptor.setAuthenticationManager(this.authenticationManagerBean());
|
||
securityInterceptor.setUserLoginService(userLoginService);
|
||
securityInterceptor.afterPropertiesSet();
|
||
return securityInterceptor;
|
||
}
|
||
|
||
/**
|
||
* 手机号登录请求过滤器
|
||
*
|
||
* @param
|
||
* @return
|
||
* @throws Exception
|
||
* @author sr on 2020-06-04
|
||
*/
|
||
private MobileAuthenticationFilter mobileAuthenticationFilter() throws Exception {
|
||
MobileAuthenticationFilter filter = new MobileAuthenticationFilter();
|
||
addHandler(filter);
|
||
return filter;
|
||
}
|
||
|
||
private void addHandler(AbstractAuthenticationProcessingFilter filter) throws Exception {
|
||
filter.setAuthenticationManager(this.authenticationManagerBean());
|
||
filter.setAuthenticationSuccessHandler(myLoginSuccessHandler);
|
||
filter.setAuthenticationFailureHandler(myAuthenctiationFailureHandler);
|
||
}
|
||
|
||
/**
|
||
* 账号密码
|
||
*
|
||
* @return
|
||
* @throws Exception
|
||
* @author sr on 2021-06-22
|
||
*/
|
||
private UpasswordAuthenticationFilter upasswordAuthenticationFilter() throws Exception {
|
||
UpasswordAuthenticationFilter filter = new UpasswordAuthenticationFilter();
|
||
addHandler(filter);
|
||
return filter;
|
||
}
|
||
|
||
/**
|
||
* 临时token
|
||
*
|
||
* @return
|
||
* @throws Exception
|
||
* @author sr on 2021-06-22
|
||
*/
|
||
private TokenAuthenticationFilter tokenAuthenticationFilter() throws Exception {
|
||
TokenAuthenticationFilter filter = new TokenAuthenticationFilter();
|
||
addHandler(filter);
|
||
return filter;
|
||
}
|
||
|
||
|
||
|
||
/**
|
||
* 身份证登录
|
||
* @return
|
||
* @throws Exception
|
||
* @author sr on 2024-09-23
|
||
*/
|
||
private UcardAuthenticationFilter ucardAuthenticationFilter() throws Exception {
|
||
UcardAuthenticationFilter filter = new UcardAuthenticationFilter();
|
||
addHandler(filter);
|
||
return filter;
|
||
}
|
||
|
||
|
||
}
|