Spring Security构建Rest服务-0702-个性化用户认证流程2

登录成功后的处理AuthenticationSuccessHandler：

认证成功后，默认情况下spring security会继续访问之前访问的url，如果想自定义处理逻辑，用默认的就不行了。此时需要自定义登录成功后的处理，springsecurity提供了一个接口，AuthenticationSuccessHandler：

有三个参数，request，response，authentication（封装认证的信息，认证请求里的信息ip、session等）

public interface AuthenticationSuccessHandler {

    /**

     * Called when a user has been successfully authenticated.

     *

     * @param request the request which caused the successful authentication

     * @param response the response

     * @param authentication the <tt>Authentication</tt> object which was created during

     * the authentication process.

     */

    void onAuthenticationSuccess(HttpServletRequest request,

            HttpServletResponse response, Authentication authentication)

            throws IOException, ServletException;

}

这个接口只有一个方法，登录成功后就被调用。

1、自定义一个handler，实现这个接口：

package com.imooc.security.browser.authentication;

import java.io.IOException;

import javax.servlet.ServletException;

import javax.servlet.http.HttpServletRequest;

import javax.servlet.http.HttpServletResponse;

import org.slf4j.Logger;

import org.slf4j.LoggerFactory;

import org.springframework.beans.factory.annotation.Autowired;

import org.springframework.security.core.Authentication;

import org.springframework.security.web.authentication.AuthenticationSuccessHandler;

import org.springframework.stereotype.Component;

import com.fasterxml.jackson.databind.ObjectMapper;

/**

 * 认证成功后做的处理

 * ClassName: ImoocAuthenticationSuccessHandler

 * @Description:  认证成功后做的处理

 * @author lihaoyang

 * @date 2018年3月1日

 */

@Component("imoocAuthenticationSuccessHandler")

public class ImoocAuthenticationSuccessHandler implements AuthenticationSuccessHandler{

    private Logger logger = LoggerFactory.getLogger(getClass());

    //springmvc启动会自动注册一个ObjectMapper

    @Autowired

    private ObjectMapper objectMapper;

    @Override

    public void onAuthenticationSuccess(HttpServletRequest request, HttpServletResponse response,

            Authentication authentication) throws IOException, ServletException {

        logger.info("登录成功");

        //把authentication返回给响应

        response.setContentType("application/json;charset=UTF-8");

        response.getWriter().write(objectMapper.writeValueAsString(authentication));

    }

}

2、添加到配置类，让spring security执行自定义的处理器

package com.imooc.security.browser;

import org.springframework.beans.factory.annotation.Autowired;

import org.springframework.context.annotation.Bean;

import org.springframework.context.annotation.Configuration;

import org.springframework.security.config.annotation.web.builders.HttpSecurity;

import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;

import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;

import org.springframework.security.crypto.password.PasswordEncoder;

import org.springframework.security.web.authentication.AuthenticationSuccessHandler;

import com.imooc.security.core.properties.SecurityProperties;

@Configuration //这是一个配置

public class BrowserSecurityConfig extends WebSecurityConfigurerAdapter{

    //读取用户配置的登录页配置

    @Autowired

    private SecurityProperties securityProperties;

    //自定义的认证后的处理器

    @Autowired

    private AuthenticationSuccessHandler imoocAuthenticationSuccessHandler;

    //注意是org.springframework.security.crypto.password.PasswordEncoder

    @Bean

    public PasswordEncoder passwordencoder(){

        //BCryptPasswordEncoder implements PasswordEncoder

        return new BCryptPasswordEncoder();

    }

    //版本一：配置死的登录页

//    @Override

//    protected void configure(HttpSecurity http) throws Exception {

//        //实现需要认证的接口跳转表单登录,安全=认证+授权

//        //http.httpBasic() //这个就是默认的弹框认证

//        http.formLogin() //表单认证

//            .loginPage("/login.html") //登录页面

//            //登录过滤器UsernamePasswordAuthenticationFilter默认登录的url是"/login"，在这能改

//            .loginProcessingUrl("/authentication/form")

//            .and()

//            .authorizeRequests() //下边的都是授权的配置

//            .antMatchers("/login.html").permitAll() //放过登录页不过滤，否则报错

//            .anyRequest()        //任何请求

//            .authenticated()    //都需要身份认证

//            .and()

//            .csrf().disable() //关闭csrf防护

//            ;

//    }

    //版本二：可配置的登录页

    @Override

    protected void configure(HttpSecurity http) throws Exception {

        //实现需要认证的接口跳转表单登录,安全=认证+授权

        //http.httpBasic() //这个就是默认的弹框认证

        http.formLogin() //表单认证

            .loginPage("/authentication/require") //处理用户认证BrowserSecurityController

            //登录过滤器UsernamePasswordAuthenticationFilter默认登录的url是"/login"，在这能改

            .loginProcessingUrl("/authentication/form")

            .successHandler(imoocAuthenticationSuccessHandler)//自定义的认证后处理器

            .and()

            .authorizeRequests() //下边的都是授权的配置

            // /authentication/require：处理登录，securityProperties.getBrowser().getLoginPage():用户配置的登录页

            .antMatchers("/authentication/require",securityProperties.getBrowser().getLoginPage()).permitAll() //放过登录页不过滤，否则报错

            .anyRequest()        //任何请求

            .authenticated()    //都需要身份认证

            .and()

            .csrf().disable() //关闭csrf防护

            ;

    }

}

启动springboot，访问localhost:8080/index.html ,跳转到登录页：

登录，响应了自定义的处理器，返回了Authentication的json：其中粉色部分是自定义的登录处理MyUserDetailService类的loadUserByUsername方法返回值User类对应的json ，而且spring security还会自动把密码置为null

{

    "authorities": [{

        "authority": "admin"

    }],

    "details": {

        "remoteAddress": "0:0:0:0:0:0:0:1",

        "sessionId": "DBDC15FA0FFEFD35B011431454B4F466"

    },

    "authenticated": true,

    "principal": {

        "password": null,

        "username": "user",

        "authorities": [{

            "authority": "admin"

        }],

        "accountNonExpired": true,

        "accountNonLocked": true,

        "credentialsNonExpired": true,

        "enabled": true

    },

    "credentials": null,

    "name": "user"

}

MyUserDetailService：

package com.imooc.security.browser;

import org.slf4j.Logger;

import org.slf4j.LoggerFactory;

import org.springframework.beans.factory.annotation.Autowired;

import org.springframework.security.core.authority.AuthorityUtils;

import org.springframework.security.core.userdetails.User;

import org.springframework.security.core.userdetails.UserDetails;

import org.springframework.security.core.userdetails.UserDetailsService;

import org.springframework.security.core.userdetails.UsernameNotFoundException;

import org.springframework.security.crypto.password.PasswordEncoder;

import org.springframework.stereotype.Component;

/**

 * UserDetailsService是SpringSecurity的一个接口，

 * 只有一个方法：根据用户名获取用户详情

 * ClassName: MyUserDetailService

 * @Description: TODO

 * @author lihaoyang

 * @date 2018年2月28日

 */

@Component

public class MyUserDetailService implements UserDetailsService{

    private Logger logger = LoggerFactory.getLogger(getClass());

    @Autowired

    private PasswordEncoder passwordEncoder;

    /**

     * UserDetails接口，实际可以自己实现这个接口，返回自己的实现类

     */

    @Override

    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {

        logger.info("登录用户名："+username);

        //根据用户名查询用户信息

        //User：springsecurity 对 UserDetails的一个实现

        //为了演示在这里用passwordEncoder加密一下密码，实际中在注册时就加密，此处直接拿出密码

        String password = passwordEncoder.encode("123456");

        System.err.println("加密后密码：  "+password);

        //参数：用户名|密码|是否启用|账户是否过期|密码是否过期|账户是否锁定|权限集合

        return new User(username,password,true,true,true,true,AuthorityUtils.commaSeparatedStringToAuthorityList("admin"));

    }

}

登录失败的处理AuthenticationFailureHandler：

和登录成功的处理一样

package com.imooc.security.browser.authentication;

import java.io.IOException;

import javax.servlet.ServletException;

import javax.servlet.http.HttpServletRequest;

import javax.servlet.http.HttpServletResponse;

import org.slf4j.Logger;

import org.slf4j.LoggerFactory;

import org.springframework.beans.factory.annotation.Autowired;

import org.springframework.http.HttpStatus;

import org.springframework.security.core.AuthenticationException;

import org.springframework.security.web.authentication.AuthenticationFailureHandler;

import org.springframework.stereotype.Component;

import com.fasterxml.jackson.databind.ObjectMapper;

/**

 * 登录失败后的处理

 * ClassName: ImoocAuthenticationFailureHandler

 * @Description: 登录失败后的处理

 * @author lihaoyang

 * @date 2018年3月1日

 */

@Component("imoocAuthenticationFailureHandler")

public class ImoocAuthenticationFailureHandler implements AuthenticationFailureHandler {

    private Logger logger = LoggerFactory.getLogger(getClass());

    //springmvc启动会自动注册一个ObjectMapper

    @Autowired

    private ObjectMapper objectMapper;

    @Override

    public void onAuthenticationFailure(HttpServletRequest request, HttpServletResponse response,

            AuthenticationException exception) throws IOException, ServletException {

        logger.info("登录失败");

        //把authentication返回给响应

        //状态码500，服务器内部错误

        response.setStatus(HttpStatus.INTERNAL_SERVER_ERROR.value());

        response.setContentType("application/json;charset=UTF-8");

        response.getWriter().write(objectMapper.writeValueAsString(exception));

    }

}

在java配置类里注入，然后配置一下就行了

启动springboot，访问登录页http://localhost:8080/demo-login.html，填写错误的密码：

响应500，坏的凭证。和一些堆栈信息

到目前为止，自定义登录处理逻辑已经做完了，此时做的效果都是返回的json，如果系统里是登录成功后跳转页面的，这样还不够通用，需要做成返回json和重定向两种都适应的。

要的效果是，能够在application.properties里做登录类型的配置。如：

需要在配置类 SecurityProperties 里加上这个loginType，新建枚举类：

package com.imooc.security.core.properties;

/**

 * 登录类型枚举

 * ClassName: LoginType

 * @Description: 登录类型

 * @author lihaoyang

 * @date 2018年3月1日

 */

public enum LoginType {

    /**

     * 返回json

     */

    JSON,

    /**

     * 重定向

     */

    REDIRECT

}

BrowserProperties ：

package com.imooc.security.core.properties;

/**

 * 浏览器配置项

 * ClassName: BrowserProperties

 * @Description: 浏览器配置项

 * @author lihaoyang

 * @date 2018年2月28日

 */

public class BrowserProperties {

    //用户未配置默认登录页

    private String loginPage = "/login.html"; 

    private LoginType loginType = LoginType.JSON ;

    public String getLoginPage() {

        return loginPage;

    }

    public void setLoginPage(String loginPage) {

        this.loginPage = loginPage;

    }

    public LoginType getLoginType() {

        return loginType;

    }

    public void setLoginType(LoginType loginType) {

        this.loginType = loginType;

    }

}

动态配置登录类型

改造登录处理器：

登录成功处理器改造为：

继承一个spring默认的实现类 extends SavedRequestAwareAuthenticationSuccessHandler ，引入配置类，就能读取properties配置文件，进行判断了：

package com.imooc.security.browser.authentication;

import java.io.IOException;

import javax.servlet.ServletException;

import javax.servlet.http.HttpServletRequest;

import javax.servlet.http.HttpServletResponse;

import org.slf4j.Logger;

import org.slf4j.LoggerFactory;

import org.springframework.beans.factory.annotation.Autowired;

import org.springframework.security.core.Authentication;

import org.springframework.security.web.authentication.AuthenticationSuccessHandler;

import org.springframework.security.web.authentication.SavedRequestAwareAuthenticationSuccessHandler;

import org.springframework.security.web.authentication.SimpleUrlAuthenticationSuccessHandler;

import org.springframework.stereotype.Component;

import com.fasterxml.jackson.databind.ObjectMapper;

import com.imooc.security.core.properties.BrowserProperties;

import com.imooc.security.core.properties.LoginType;

import com.imooc.security.core.properties.SecurityProperties;

/**

 * 认证成功后做的处理

 * ClassName: ImoocAuthenticationSuccessHandler

 * @Description:  认证成功后做的处理

 * @author lihaoyang

 * @date 2018年3月1日

 */

@Component("imoocAuthenticationSuccessHandler")

public class ImoocAuthenticationSuccessHandler

        //spring默认的登录成功处理器，实现了AuthenticationSuccessHandler接口，适配登录后 重定向和返回json两种用这个实现

        extends SavedRequestAwareAuthenticationSuccessHandler

        //返回json用这个实现

        /*implements AuthenticationSuccessHandler*/{

    private Logger logger = LoggerFactory.getLogger(getClass());

    //springmvc启动会自动注册一个ObjectMapper

    @Autowired

    private ObjectMapper objectMapper;

    @Autowired

    private SecurityProperties securityProperties;

    @Override

    public void onAuthenticationSuccess(HttpServletRequest request, HttpServletResponse response,

            Authentication authentication) throws IOException, ServletException {

        logger.info("登录成功");

        /**

         * 判断配置的登录类型，做不同处理

         */

        if(LoginType.JSON.equals(securityProperties.getBrowser().getLoginType())){

            //响应json

            //把authentication返回给响应

            response.setContentType("application/json;charset=UTF-8");

            response.getWriter().write(objectMapper.writeValueAsString(authentication));

        }else{

            //调用父类的方法，默认就是重定向

            super.onAuthenticationSuccess(request, response, authentication);

        }

    }

}

登录失败的处理改造为：

package com.imooc.security.browser.authentication;

import java.io.IOException;

import javax.servlet.ServletException;

import javax.servlet.http.HttpServletRequest;

import javax.servlet.http.HttpServletResponse;

import org.slf4j.Logger;

import org.slf4j.LoggerFactory;

import org.springframework.beans.factory.annotation.Autowired;

import org.springframework.http.HttpStatus;

import org.springframework.security.core.AuthenticationException;

import org.springframework.security.web.authentication.AuthenticationFailureHandler;

import org.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler;

import org.springframework.stereotype.Component;

import com.fasterxml.jackson.databind.ObjectMapper;

import com.imooc.security.core.properties.BrowserProperties;

import com.imooc.security.core.properties.LoginType;

import com.imooc.security.core.properties.SecurityProperties;

/**

 * 登录失败后的处理

 * ClassName: ImoocAuthenticationFailureHandler

 * @Description: 登录失败后的处理

 * @author lihaoyang

 * @date 2018年3月1日

 */

@Component("imoocAuthenticationFailureHandler")

public class ImoocAuthenticationFailureHandler

        extends SimpleUrlAuthenticationFailureHandler

        /*implements AuthenticationFailureHandler*/ {

    private Logger logger = LoggerFactory.getLogger(getClass());

    //springmvc启动会自动注册一个ObjectMapper

    @Autowired

    private ObjectMapper objectMapper;

    @Autowired

    private SecurityProperties securityProperties;

    @Override

    public void onAuthenticationFailure(HttpServletRequest request, HttpServletResponse response,

            AuthenticationException exception) throws IOException, ServletException {

        logger.info("登录失败");

        if(LoginType.JSON.equals(securityProperties.getBrowser().getLoginType())){

            //把authentication返回给响应

            //状态码500，服务器内部错误

            response.setStatus(HttpStatus.INTERNAL_SERVER_ERROR.value());

            response.setContentType("application/json;charset=UTF-8");

            response.getWriter().write(objectMapper.writeValueAsString(exception));

        }else{

            super.onAuthenticationFailure(request, response, exception);

        }

    }

}

这样，在application.properties 里配置 imooc.security.browser.loginType = REDIRECT 或 imooc.security.browser.loginType = JSON 就可以动态控制登录成功后改返回json还是重定向了。

在demo项目新建一个index.html：

<body>
<h2>Index Page</h2> <br>
</body>

配置登录类型为REDIRECT，访问 localhost:8080/index.html 让登录

登录成功后，重定向到了index.html

设置为JSON登录：

#登录类型
imooc.security.browser.loginType = JSON

再访问localhost:8080/index.html ：

响应我们自己处理的登录逻辑。

完整代码放在了github ：https://github.com/lhy1234/spring-security

巴特西

Spring Security构建Rest服务-0702-个性化用户认证流程2

最新文章

热门文章