SpringSecurity实现用户名密码登录（Token）

传统的应用是将Session放在应用服务器上，而将生成的JSESSIONID放在用户浏览器的Cookie中，而这种模式在前后端分离中就会出现以下问题

　　　　1，开发繁琐。

　　　　2，安全性和客户体验差

　　　　3，有些前端技术不支持Cookie，如微信小程序

　　这种情况下，前后端之间使用Token（令牌）进行通信就完美的解决上面的问题。

⒈添加pom依赖

 1         <dependency>
 2             <groupId>org.springframework.boot</groupId>
 3             <artifactId>spring-boot-starter-security</artifactId>
 4         </dependency>
 5         <dependency>
 6             <groupId>org.springframework.boot</groupId>
 7             <artifactId>spring-boot-starter-web</artifactId>
 8         </dependency>
 9         <dependency>
10             <groupId>org.springframework.security.oauth</groupId>
11             <artifactId>spring-security-oauth2</artifactId>
12             <version>2.3.5.RELEASE</version>
13         </dependency>
14         <dependency>
15             <groupId>commons-collections</groupId>
16             <artifactId>commons-collections</artifactId>
17             <version>3.2.2</version>
18         </dependency>
19         <dependency>
20             <groupId>org.springframework.boot</groupId>
21             <artifactId>spring-boot-starter-test</artifactId>
22             <scope>test</scope>
23         </dependency>
24         <dependency>
25             <groupId>org.springframework.security</groupId>
26             <artifactId>spring-security-test</artifactId>
27             <scope>test</scope>
28         </dependency>

⒉编写AuthenticationSuccessHandler的实现

  1 package cn.coreqi.handler;
  2 
  3 import com.fasterxml.jackson.databind.ObjectMapper;
  4 import org.apache.commons.codec.binary.StringUtils;
  5 import org.apache.commons.collections.MapUtils;
  6 import org.slf4j.Logger;
  7 import org.slf4j.LoggerFactory;
  8 import org.springframework.beans.factory.annotation.Autowired;
  9 import org.springframework.security.authentication.BadCredentialsException;
 10 import org.springframework.security.core.Authentication;
 11 import org.springframework.security.oauth2.common.OAuth2AccessToken;
 12 import org.springframework.security.oauth2.common.exceptions.UnapprovedClientAuthenticationException;
 13 import org.springframework.security.oauth2.provider.*;
 14 import org.springframework.security.oauth2.provider.token.AuthorizationServerTokenServices;
 15 import org.springframework.security.web.authentication.AuthenticationSuccessHandler;
 16 import org.springframework.stereotype.Component;
 17 import javax.servlet.ServletException;
 18 import javax.servlet.http.HttpServletRequest;
 19 import javax.servlet.http.HttpServletResponse;
 20 import java.io.IOException;
 21 import java.util.Base64;
 22 
 23 @Component("coreqiAuthenticationSuccessHandler")
 24 public class CoreqiAuthenticationSuccessHandler implements AuthenticationSuccessHandler {
 25 
 26     private Logger logger = LoggerFactory.getLogger(getClass());
 27 
 28     @Autowired
 29     private ClientDetailsService clientDetailsService;
 30 
 31     @Autowired
 32     private AuthorizationServerTokenServices authorizationServerTokenServices;
 33 
 34     @Autowired
 35     private ObjectMapper objectMapper;  //将对象转换为Json的工具类，SpringMVC在启动的时候会自动为我们注册ObjectMapper
 36 
 37     /**
 38      * @param request    不知道
 39      * @param response   不知道
 40      * @param authentication   Authentication接口是SpringSecurity的一个核心接口，它的作用是封装我们的认证信息，包含认证请求中的一些信息，包括认证请求的ip，Session是什么，以及认证用户的信息等等。
 41      * @throws IOException
 42      * @throws ServletException
 43      */
 44     @Override
 45     public void onAuthenticationSuccess(HttpServletRequest request, HttpServletResponse response, Authentication authentication) throws IOException, ServletException {
 46         //1.从请求参数中拿到ClientId
 47         String header = request.getHeader("Authorization");
 48         if (header == null && !header.toLowerCase().startsWith("basic ")) {
 49             throw new UnapprovedClientAuthenticationException("请求头中无client信息！");
 50         }
 51         String[] tokens = this.extractAndDecodeHeader(header, request);
 52         assert tokens.length == 2;
 53 
 54         String clientId = tokens[0];
 55         String clientSecret = tokens[1];
 56 
 57         //2.通过ClientId拿到ClientDetails
 58         ClientDetails clientDetails = clientDetailsService.loadClientByClientId(clientId);
 59         if(clientDetails == null){
 60             throw new UnapprovedClientAuthenticationException("clientId对应的配置信息不存在：" + clientId);
 61         }else if(!StringUtils.equals(clientDetails.getClientSecret(),clientSecret)){
 62             throw new UnapprovedClientAuthenticationException("clientSecret不匹配：" + clientId);
 63         }
 64         //3.创建TokenRequest
 65         TokenRequest tokenRequest = new TokenRequest(MapUtils.EMPTY_MAP,clientId,clientDetails.getScope(),"custom");
 66 
 67         //4.构建OAuth2Request
 68         OAuth2Request oAuth2Request = tokenRequest.createOAuth2Request(clientDetails);
 69 
 70         //5.构建OAuth2Authentication
 71         OAuth2Authentication oAuth2Authentication = new OAuth2Authentication(oAuth2Request,authentication);
 72 
 73         //6.构建OAuth2AccessToken
 74         OAuth2AccessToken token = authorizationServerTokenServices.createAccessToken(oAuth2Authentication);
 75 
 76         //7.将生成的Token返回给请求
 77         response.setContentType("application/json;charset=UTF-8");
 78         response.getWriter().write(objectMapper.writeValueAsString(token));
 79     }
 80 
 81     /**
 82      * 从请求头中解析用户名密码
 83      * @param header
 84      * @param request
 85      * @return
 86      * @throws IOException
 87      */
 88     private String[] extractAndDecodeHeader(String header, HttpServletRequest request) throws IOException {
 89         byte[] base64Token = header.substring(6).getBytes("UTF-8");
 90 
 91         byte[] decoded;
 92         try {
 93             decoded = Base64.getDecoder().decode(base64Token);
 94         } catch (IllegalArgumentException var7) {
 95             throw new BadCredentialsException("Failed to decode basic authentication token");
 96         }
 97 
 98         String token = new String(decoded, "UTF-8");
 99         int delim = token.indexOf(":");
100         if (delim == -1) {
101             throw new BadCredentialsException("Invalid basic authentication token");
102         } else {
103             return new String[]{token.substring(0, delim), token.substring(delim + 1)};
104         }
105     }
106 
107 }

⒊配置Security

 1 package cn.coreqi.config;
 2 
 3 import org.springframework.context.annotation.Bean;
 4 import org.springframework.security.authentication.AuthenticationManager;
 5 import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
 6 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
 7 import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
 8 import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
 9 import org.springframework.security.crypto.password.NoOpPasswordEncoder;
10 import org.springframework.security.crypto.password.PasswordEncoder;
11 
12 @EnableWebSecurity
13 public class CoreqiWebSecurityConfig extends WebSecurityConfigurerAdapter {
14 
15     @Override
16     @Bean
17     public AuthenticationManager authenticationManagerBean() throws Exception {
18         return super.authenticationManagerBean();
19     }
20 
21     @Override
22     protected void configure(HttpSecurity http) throws Exception {
23         http.httpBasic()
24                 .and()
25                 .authorizeRequests()
26                 .antMatchers("/oauth/token","/login").permitAll()
27                 .anyRequest().authenticated()  //任何请求都需要身份认证
28                 .and().csrf().disable();    //禁用CSRF
29     }
30 
31     @Override
32     protected void configure(AuthenticationManagerBuilder auth) throws Exception {
33         auth.inMemoryAuthentication()
34                 .withUser("fanqi").password("admin").roles("admin");
35     }
36 
37     @Bean
38     public PasswordEncoder passwordEncoder()
39     {
40         return NoOpPasswordEncoder.getInstance();
41     }
42 }

⒋配置OAuth2

 1 package cn.coreqi.config;
 2 
 3 import org.springframework.beans.factory.annotation.Autowired;
 4 import org.springframework.beans.factory.annotation.Qualifier;
 5 import org.springframework.context.annotation.Configuration;
 6 import org.springframework.security.authentication.AuthenticationManager;
 7 import org.springframework.security.config.annotation.authentication.configuration.AuthenticationConfiguration;
 8 import org.springframework.security.oauth2.config.annotation.configurers.ClientDetailsServiceConfigurer;
 9 import org.springframework.security.oauth2.config.annotation.web.configuration.AuthorizationServerConfigurerAdapter;
10 import org.springframework.security.oauth2.config.annotation.web.configuration.EnableAuthorizationServer;
11 import org.springframework.security.oauth2.config.annotation.web.configurers.AuthorizationServerEndpointsConfigurer;
12 
13 @Configuration
14 @EnableAuthorizationServer  //开启认证服务器
15 public class CoreqiAuthorizationServerConfig extends AuthorizationServerConfigurerAdapter {
16 
17     @Autowired
18     @Qualifier("authenticationManagerBean")
19     private AuthenticationManager authenticationManager;
20 
21     @Autowired
22     private AuthenticationConfiguration authenticationConfiguration;
23 
24     /**
25      * password模式需要提供一个AuthenticationManager到AuthorizationServerEndpointsConfigurer
26      * @param authorizationServerEndpointsConfigurer
27      * @throws Exception
28      */
29     @Override
30     public void configure(AuthorizationServerEndpointsConfigurer authorizationServerEndpointsConfigurer) throws Exception {
31         authorizationServerEndpointsConfigurer.authenticationManager(authenticationConfiguration.getAuthenticationManager());
32     }
33 
34     @Override
35     public void configure(ClientDetailsServiceConfigurer clientDetailsServiceConfigurer) throws Exception {
36         clientDetailsServiceConfigurer.inMemory()
37                 .withClient("coreqi")
38                 .secret("coreqiSecret")
39                 .redirectUris("https://www.baidu.com")
40                 .scopes("ALL")
41                 .authorities("COREQI_READ")
42                 .authorizedGrantTypes("authorization_code","password");
43     }
44 
45 }

⒌配置资源服务器

 1 package cn.coreqi.config;
 2 
 3 import cn.coreqi.handler.CoreqiAuthenticationSuccessHandler;
 4 import org.springframework.beans.factory.annotation.Autowired;
 5 import org.springframework.context.annotation.Configuration;
 6 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
 7 import org.springframework.security.oauth2.config.annotation.web.configuration.EnableResourceServer;
 8 import org.springframework.security.oauth2.config.annotation.web.configuration.ResourceServerConfigurerAdapter;
 9 import org.springframework.security.oauth2.config.annotation.web.configurers.ResourceServerSecurityConfigurer;
10 
11 @Configuration
12 @EnableResourceServer   //开启资源服务器
13 public class CoreqiResourceServerConfig extends ResourceServerConfigurerAdapter {
14 
15     @Autowired
16     private CoreqiAuthenticationSuccessHandler coreqiAuthenticationSuccessHandler;
17 
18     @Override
19     public void configure(HttpSecurity http) throws Exception {
20         http.formLogin()
21                 .successHandler(coreqiAuthenticationSuccessHandler)
22             .and()
23             .authorizeRequests()
24                 .antMatchers("/oauth/token","/login").permitAll()
25                 .anyRequest().authenticated()  //任何请求都需要身份认证
26             .and()
27             .csrf()
28                 .disable();    //禁用CSRF
29     }
30 
31 }

⒍测试