Spring Boot 安全性中的多种身份验证策略

Question

为了在 Spring Security 中使用自定义身份验证，您必须实现 UserDetailsService 接口并覆盖 loadUserByUsername 方法，例如下面的示例

public class UserServiceImpl implements UserDetailsService{

    @Autowired
    private UserDao userDao;

    @Override
    public UserDetails loadUserByUsername(String useremail)
            throws UsernameNotFoundException {
        Users user = userDao.findByUserEmail(useremail);
        if(user == null){
            throw new UsernameNotFoundException("UserName or Password Invalid.");
        }
        return new org.springframework.security.core.userdetails.User(user.getUsername(), user.getPassword(), user.getEnabled(), true, true, true, getGrantedAuthorities(userDao.getUserRole(user.getUsersId())));
    }

它在整个网站上都可以正常工作。

我现在要做的是从同一主机公开一个宁静的 Web 服务，并且对该 WS 的所有请求都将通过 /api/** 使用不同类型的身份验证（例如：使用令牌） 有可能吗？如果是这样，有什么想法吗？任何有用的资源？

Answer 1

你可以先做如下的安全配置类

@Configuration
public class SecurityConfiguration extends WebSecurityConfigurerAdapter {

private final TokenAuthenticationFilter tokenAuthenticationFilter;

...

public SecurityConfiguration(TokenAuthenticationFilter tokenAuthenticationFilter) {
    this.corsFilter = corsFilter;
}

@Bean
public PasswordEncoder passwordEncoder() {
    return new BCryptPasswordEncoder();
}

@Override
public void configure(WebSecurity web) throws Exception {
    web.ignoring()
        .antMatchers(HttpMethod.OPTIONS, "/**");
}

@Override
protected void configure(HttpSecurity http) throws Exception {
    http
        .csrf().disable()
    .and()
        .addFilterBefore(tokenAuthenticationFilter, TokenAuthenticationFilter.class)
        .exceptionHandling()
        .authenticationEntryPoint(problemSupport)
        .accessDeniedHandler(problemSupport)
    .and()
        .logout()
        .logoutUrl("/api/logout")
        .logoutSuccessHandler(You log out success handler goes here)
        .permitAll()
    .and()
        .authorizeRequests()
        .antMatchers("/api/**").authenticated();

}

}

您的 TokenAuthenticationFilter 类将为每个请求执行令牌真实性。

@Configuration
public class SecurityConfiguration extends WebSecurityConfigurerAdapter {

private final TokenAuthenticationFilter tokenAuthenticationFilter;

...

public SecurityConfiguration(TokenAuthenticationFilter tokenAuthenticationFilter) {
    this.corsFilter = corsFilter;
}

@Bean
public PasswordEncoder passwordEncoder() {
    return new BCryptPasswordEncoder();
}

@Override
public void configure(WebSecurity web) throws Exception {
    web.ignoring()
        .antMatchers(HttpMethod.OPTIONS, "/**");
}

@Override
protected void configure(HttpSecurity http) throws Exception {
    http
        .csrf().disable()
    .and()
        .addFilterBefore(tokenAuthenticationFilter, TokenAuthenticationFilter.class)
        .exceptionHandling()
        .authenticationEntryPoint(problemSupport)
        .accessDeniedHandler(problemSupport)
    .and()
        .logout()
        .logoutUrl("/api/logout")
        .logoutSuccessHandler(You log out success handler goes here)
        .permitAll()
    .and()
        .authorizeRequests()
        .antMatchers("/api/**").authenticated();

   }
 }