天天看点
返回

SpringSecurity中常用到的最要实现

SpringSecurity中最要的三个实现

  • ​​写在前面​​
  • ​​一、核心配置类 WebSecurityConfigurerAdapter​​
  • ​​二、用户/权限加载接口 UserDetailsService​​
  • ​​三、接入控制管理（AccessDecisionManager）​​
  • ​​四、请求拦截（OncePerRequestFilter）​​
  • ​​五、核心验证器（AuthenticationManager）​​
  • ​​5.1、AuthenticationManager​​
  • ​​5.2、ProviderManager​​
  • ​​5.3、AuthenticationProvider​​
  • ​​六、验证流程图，分析​​

写在前面

一、核心配置类 WebSecurityConfigurerAdapter 

@Configuration
@EnableWebSecurity
public class SecurityConfiguration extends WebSecurityConfigurerAdapter {
    @Autowired
    private UserDetailsService userDetailsService;
    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
        .csrf()
        .disable()
        .sessionManagement()
        .sessionCreationPolicy(SessionCreationPolicy.STATELESS)
        //.and()
            /*.formLogin()
            .successHandler(loginSuccessHandler())
            .failureHandler(authenticationFailureHandler())*/
        .and()
            .exceptionHandling()
            .accessDeniedHandler(accessDeniedHandler())
        .and()
            .logout()
            .logoutSuccessHandler(logoutSuccessHandler())
        .and()
            .userDetailsService(userDetailsService)
            //OPTIONS请求全部放行
            .authorizeRequests()
            .antMatchers(/*HttpMethod.OPTIONS,*/ "/**").permitAll()
            .antMatchers("/auth/login").permitAll()
            .antMatchers("/auth/logout").permitAll()
            .accessDecisionManager(accessDecisionManager());
      //使用自定义的 Token过滤器 验证请求的Token是否合法
        http.addFilterBefore(authenticationTokenFilterBean(), UsernamePasswordAuthenticationFilter.class);
        super.configure(http);
    }

    @Bean
    public JwtTokenFilter authenticationTokenFilterBean() {
        return new JwtTokenFilter();
    }
    @Bean
    public JwtTokenProvider jwtTokenProvider() {
        return new JwtTokenProvider();
    }

}

二、用户/权限加载接口 UserDetailsService 

@Component("userDetailsService")
public class UserDetailsServiceImpl implements UserDetailsService {
    @Autowired
    private UserService userService;
    @Override
    public UserDetails loadUserByUsername(String userCode) throws UsernameNotFoundException {
        UserInfo userInfo = userService.findByUserCode(userCode);
        if (userInfo == null) {
            throw new UsernameNotFoundException("-------UserDetailsService---------->" + userCode);
        }
        List<String> resources = userService.findAllResourcesByUserCode(userCode);

        Collection<GrantedAuthority> grantedAuthorities = new ArrayList<>();
        resources.forEach(code -> {
            GrantedAuthority simpleGrantedAuthority = new SimpleGrantedAuthority(code);
            grantedAuthorities.add(simpleGrantedAuthority);
        });
        return new User(userCode, userInfo.getPassword(), grantedAuthorities);
    }
}

三、接入控制管理（AccessDecisionManager） 

@Component("accessDecisionManager")
public class AuthAccessDecisionManager implements AccessDecisionManager {

    @Override
    public void decide(Authentication authentication, Object object, Collection<ConfigAttribute> configAttributes)
            throws AccessDeniedException, InsufficientAuthenticationException {
        // 鉴权验证
        if (!configAttributes.isEmpty()) {
            String authorize = null;
            for (ConfigAttribute configAttribute : configAttributes) {
                System.out.println("-------AccessDecisionManager--------------" + configAttribute.toString());
                authorize = configAttribute.toString();
                break;
            }
            if (Constants.NO_AUTHORIZE.equals(authorize)) {
                return;
            }
        }
        // 登陆验证
SecurityUtils.getCurrentUserLogin());
        if (Constants.ANONYMOUS_USER.equals(SecurityUtils.getCurrentUserLogin())) {
            throw new AccessDeniedException(" 没有权限访问！ ");
        }
        //验证权限
        if (object instanceof FilterInvocation) {
            FilterInvocation web = (FilterInvocation) object;
            String uri = web.getRequestUrl();
            System.out.println("-------AccessDecisionManager--------------" + uri);

            String urlCode = this.getUrlCode(uri);
            Collection<? extends GrantedAuthority> authorities = authentication.getAuthorities();

            List<? extends GrantedAuthority> collect = authorities.stream().collect(Collectors.toList());
            for (GrantedAuthority grantedAuthority : collect) {
                String authority = grantedAuthority.getAuthority();
                if (authority.equals(urlCode)) {
                    return;
                }
            }
        }
        throw new AccessDeniedException(" 没有权限访问！ ");
    }


}

四、请求拦截（OncePerRequestFilter）

是封装在 org.springframework.web.filter 这个包下的，可用于拦截请求，验证请求头中的信息，或者初始基本信息

springSecurity中可用这个配置。如下的环境

SpringSecurity中常用到的最要实现

五、核心验证器（AuthenticationManager）

5.1、AuthenticationManager

该对象提供了认证方法的入口，接收一个Authentiaton对象作为参数;

public interface AuthenticationManager {
  Authentication authenticate(Authentication authentication)
      throws AuthenticationException;
}

5.2、ProviderManager

它是 AuthenticationManager 的一个实现类，提供了基本的认证逻辑和方法；它包含了一个 List 对象，通过 AuthenticationProvider 接口来扩展出不同的认证提供者(当Spring Security默认提供的实现类不能满足需求的时候可以扩展AuthenticationProvider 覆盖supports(Class<?> authentication) 方法)；

验证逻辑

AuthenticationManager 接收 Authentication 对象作为参数，并通过 authenticate(Authentication) 方法对其进行验证；AuthenticationProvider实现类用来支撑对 Authentication 对象的验证动作；UsernamePasswordAuthenticationToken实现了 Authentication主要是将用户输入的用户名和密码进行封装，并供给 AuthenticationManager 进行验证；验证完成以后将返回一个认证成功的 Authentication 对象；

Authentication

Authentication对象中的主要方法

public interface Authentication extends Principal, Serializable {
  //#1.权限结合，可使用AuthorityUtils.commaSeparatedStringToAuthorityList("admin,ROLE_ADMIN")返回字符串权限集合
  Collection<? extends GrantedAuthority> getAuthorities();
  
  //#2.用户名密码认证时可以理解为密码
  Object getCredentials();
  
  //#3.认证时包含的一些信息。
  Object getDetails();
  
  //#4.用户名密码认证时可理解时用户名
  Object getPrincipal();
  
  #5.是否被认证，认证为true  
  boolean isAuthenticated();
  
  #6.设置是否能被认证
  void setAuthenticated(boolean isAuthenticated) throws IllegalArgumentException;
  ...
  ...
  }

ProviderManager是AuthenticationManager的实现类，提供了基本认证实现逻辑和流程；

public Authentication authenticate(Authentication authentication)
      throws AuthenticationException {
    //#1.获取当前的Authentication的认证类型
    Class<? extends Authentication> toTest = authentication.getClass();
    AuthenticationException lastException = null;
    Authentication result = null;
    boolean debug = logger.isDebugEnabled();
    //#2.遍历所有的providers使用supports方法判断该provider是否支持当前的认证类型，不支持的话继续遍历
    for (AuthenticationProvider provider : getProviders()) {
      if (!provider.supports(toTest)) {
        continue;
      }

      if (debug) {
        logger.debug("Authentication attempt using "
            + provider.getClass().getName());
      }

      try {
        #3.支持的话调用provider的authenticat方法认证
        result = provider.authenticate(authentication);

        if (result != null) {
          #4.认证通过的话重新生成Authentication对应的Token
          copyDetails(authentication, result);
          break;
        }
      }
      catch (AccountStatusException e) {
        prepareException(e, authentication);
        // SEC-546: Avoid polling additional providers if auth failure is due to
        // invalid account status
        throw e;
      }
      catch (InternalAuthenticationServiceException e) {
        prepareException(e, authentication);
        throw e;
      }
      catch (AuthenticationException e) {
        lastException = e;
      }
    }

    if (result == null && parent != null) {
      // Allow the parent to try.
      try {
        #5.如果#1 没有验证通过，则使用父类型AuthenticationManager进行验证
        result = parent.authenticate(authentication);
      }
      catch (ProviderNotFoundException e) {
        // ignore as we will throw below if no other exception occurred prior to
        // calling parent and the parent
        // may throw ProviderNotFound even though a provider in the child already
        // handled the request
      }
      catch (AuthenticationException e) {
        lastException = e;
      }
    }
    #6. 是否擦出敏感信息
    if (result != null) {
      if (eraseCredentialsAfterAuthentication
          && (result instanceof CredentialsContainer)) {
        // Authentication is complete. Remove credentials and other secret data
        // from authentication
        ((CredentialsContainer) result).eraseCredentials();
      }

      eventPublisher.publishAuthenticationSuccess(result);
      return result;
    }

    // Parent was null, or didn't authenticate (or throw an exception).

    if (lastException == null) {
      lastException = new ProviderNotFoundException(messages.getMessage(
          "ProviderManager.providerNotFound",
          new Object[] { toTest.getName() },
          "No AuthenticationProvider found for {0}"));
    }

    prepareException(lastException, authentication);

    throw lastException;
  }

  • 1.遍历所有的 Providers，然后依次执行该 Provider 的验证方法

    如果某一个 Provider 验证成功，则跳出循环不再执行后续的验证；

    如果验证成功，会将返回的 result 既 Authentication 对象进一步封装为 Authentication Token； 比如 UsernamePasswordAuthenticationToken、RememberMeAuthenticationToken 等；这些 Authentication Token 也都继承自 Authentication 对象；

  • 2.如果 #1 没有任何一个 Provider 验证成功，则试图使用其 parent Authentication Manager 进行验证；
  • 3.是否需要擦除密码等敏感信息；

5.3、AuthenticationProvider

ProviderManager 通过 AuthenticationProvider 扩展出更多的验证提供的方式；而 AuthenticationProvider 本身也就是一个接口，从类图中我们可以看出它的实现类AbstractUserDetailsAuthenticationProvider 和AbstractUserDetailsAuthenticationProvider的子类DaoAuthenticationProvider 。DaoAuthenticationProvider 是Spring Security中一个核心的Provider,对所有的数据库提供了基本方法和入口。

DaoAuthenticationProvider

DaoAuthenticationProvider主要做了以下事情

对用户身份尽心加密操作；

#1.可直接返回BCryptPasswordEncoder，也可以自己实现该接口使用自己的加密算法核心方法String encode(CharSequence rawPassword);和boolean matches(CharSequence rawPassword, String encodedPassword);

private PasswordEncoder passwordEncoder;

实现了 AbstractUserDetailsAuthenticationProvider 两个抽象方法，

获取用户信息的扩展点

protected final UserDetails retrieveUser(String username,

UsernamePasswordAuthenticationToken authentication)

throws AuthenticationException {

UserDetails loadedUser;

try {

loadedUser = this.getUserDetailsService().loadUserByUsername(username);

}

主要是通过注入UserDetailsService接口对象，并调用其接口方法 loadUserByUsername(String username) 获取得到相关的用户信息。UserDetailsService接口非常重要。

实现 additionalAuthenticationChecks 的验证方法(主要验证密码)；

AbstractUserDetailsAuthenticationProvider

AbstractUserDetailsAuthenticationProvider为DaoAuthenticationProvider提供了基本的认证方法；

public Authentication authenticate(Authentication authentication)

throws AuthenticationException {

Assert.isInstanceOf(UsernamePasswordAuthenticationToken.class, authentication,

messages.getMessage(

“AbstractUserDetailsAuthenticationProvider.onlySupports”,

“Only UsernamePasswordAuthenticationToken is supported”));

// Determine username
  String username = (authentication.getPrincipal() == null) ? "NONE_PROVIDED"
      : authentication.getName();

  boolean cacheWasUsed = true;
  UserDetails user = this.userCache.getUserFromCache(username);

  if (user == null) {
    cacheWasUsed = false;

    try {
      #1.获取用户信息由子类实现即DaoAuthenticationProvider
      user = retrieveUser(username,
          (UsernamePasswordAuthenticationToken) authentication);
    }
    catch (UsernameNotFoundException notFound) {
      logger.debug("User '" + username + "' not found");

      if (hideUserNotFoundExceptions) {
        throw new BadCredentialsException(messages.getMessage(
            "AbstractUserDetailsAuthenticationProvider.badCredentials",
            "Bad credentials"));
      }
      else {
        throw notFound;
      }
    }

    Assert.notNull(user,
        "retrieveUser returned null - a violation of the interface contract");
  }

  try {
    #2.前检查由DefaultPreAuthenticationChecks类实现（主要判断当前用户是否锁定，过期，冻结User接口）
    preAuthenticationChecks.check(user);
    #3.子类实现
    additionalAuthenticationChecks(user,
        (UsernamePasswordAuthenticationToken) authentication);
  }
  catch (AuthenticationException exception) {
    if (cacheWasUsed) {
      // There was a problem, so try again after checking
      // we're using latest data (i.e. not from the cache)
      cacheWasUsed = false;
      user = retrieveUser(username,
          (UsernamePasswordAuthenticationToken) authentication);
      preAuthenticationChecks.check(user);
      additionalAuthenticationChecks(user,
          (UsernamePasswordAuthenticationToken) authentication);
    }
    else {
      throw exception;
    }
  }
  #4.检测用户密码是否过期对应#2 的User接口
  postAuthenticationChecks.check(user);

  if (!cacheWasUsed) {
    this.userCache.putUserInCache(user);
  }

  Object principalToReturn = user;

  if (forcePrincipalAsString) {
    principalToReturn = user.getUsername();
  }

  return createSuccessAuthentication(principalToReturn, authentication, user);
}

AbstractUserDetailsAuthenticationProvider主要实现了AuthenticationProvider的接口方法 authenticate 并提供了相关的验证逻辑；

获取用户返回UserDetails AbstractUserDetailsAuthenticationProvider定义了一个抽象的方法

protected abstract UserDetails retrieveUser(String username,

UsernamePasswordAuthenticationToken authentication)

throws AuthenticationException;

三步验证工作

preAuthenticationChecks

additionalAuthenticationChecks（抽象方法，子类实现）

postAuthenticationChecks

将已通过验证的用户信息封装成 UsernamePasswordAuthenticationToken 对象并返回；该对象封装了用户的身份信息，以及相应的权限信息，相关源码如下，

protected Authentication createSuccessAuthentication(Object principal,

UsernamePasswordAuthenticationToken result = new UsernamePasswordAuthenticationToken(

principal, authentication.getCredentials(),

authoritiesMapper.mapAuthorities(user.getAuthorities()));

result.setDetails(authentication.getDetails());

return result;

六、验证流程图，分析

java spring spring boot ide 用户名
上一篇: python中用于释放类占用的资源的方法是_Python中用于释放类占用资源的方法是
下一篇: java类是公共的应当声明,java 类是公共的，应在名为.java 的文件中声明

继续阅读