Spring Security原理学习--权限校验(四)

Bertha 。 2022-05-08 18:52 402阅读 0赞

在上一篇博客[Spring Security原理学习--用户名和密码认证(三)][Spring Security_--]中我们已经了解到Spring Security关于用户名和密码在UsernamePasswordAuthenticationFilter中的认证处理逻辑，接下来我们看看权限的校验处理。

Spring Security权限角色的校验处理是在FilterSecurityInterceptor过滤器中进行处理的，在invoke方法中，调用父类的beforeInvocation方法对请求进行权限角色校验。

public void doFilter(ServletRequest request, ServletResponse response,
    			FilterChain chain) throws IOException, ServletException {
    		FilterInvocation fi = new FilterInvocation(request, response, chain);
    		invoke(fi);
    	}

在invoke方法中会调用父类AbstractSecurityInterceptor的beforeInvocation对Authentication对象进行身份校验。

public void invoke(FilterInvocation fi) throws IOException, ServletException {
    		if ((fi.getRequest() != null)
    				&& (fi.getRequest().getAttribute(FILTER_APPLIED) != null)
    				&& observeOncePerRequest) {
    			// filter already applied to this request and user wants us to observe
    			// once-per-request handling, so don't re-do security checking
    			fi.getChain().doFilter(fi.getRequest(), fi.getResponse());
    		}
    		else {
    			// first time this request being called, so perform security checking
    			if (fi.getRequest() != null) {
    				fi.getRequest().setAttribute(FILTER_APPLIED, Boolean.TRUE);
    			}
    			//调用父类的beforeInvocation进行身份校验
    			InterceptorStatusToken token = super.beforeInvocation(fi);
    
    			try {
    				fi.getChain().doFilter(fi.getRequest(), fi.getResponse());
    			}
    			finally {
    				super.finallyInvocation(token);
    			}
    
    			super.afterInvocation(token, null);
    		}
    	}

在beforeInvocation中叫调用接口AccessDecisionManager的实现类，校验角色。

protected InterceptorStatusToken beforeInvocation(Object object) {
    		
    		//省略部分代码
    		
    		//获取当前线程的Authentication对象
    		Authentication authenticated = authenticateIfRequired();
    
    		// Attempt authorization
    		try {
    			//权限角色校验
    			this.accessDecisionManager.decide(authenticated, object, attributes);
    		}
    		//校验失败抛出异常
    		catch (AccessDeniedException accessDeniedException) {
    			publishEvent(new AuthorizationFailureEvent(object, attributes, authenticated,
    					accessDeniedException));
    
    			throw accessDeniedException;
    		}
    
    		//省略部分代码
    	}

最终调用子类AffirmativeBased的decide方法，在decide方法中会获取AccessDecisionVoter对权限进行投票处理，获取投票结果，当投票结果是1时则表示有权限，否则等于-1表示没有权限，拒绝。

public void decide(Authentication authentication, Object object,
    			Collection<ConfigAttribute> configAttributes) throws AccessDeniedException {
    		int deny = 0;
    
    		for (AccessDecisionVoter voter : getDecisionVoters()) {
                //投票获取结果
    			int result = voter.vote(authentication, object, configAttributes);
    
    			if (logger.isDebugEnabled()) {
    				logger.debug("Voter: " + voter + ", returned: " + result);
    			}
                //当有权限时直接返回
    			switch (result) {
    			case AccessDecisionVoter.ACCESS_GRANTED:
    				return;
                //否则拒绝
    			case AccessDecisionVoter.ACCESS_DENIED:
    				deny++;
    
    				break;
    
    			default:
    				break;
    			}
    		}
            //
    		if (deny > 0) {
    			throw new AccessDeniedException(messages.getMessage(
    					"AbstractAccessDecisionManager.accessDenied", "Access is denied"));
    		}
    
    		// To get this far, every AccessDecisionVoter abstained
    		checkAllowIfAllAbstainDecisions();
    	}

在实现类WebExpressionVoter会根据authentication结果进行校验判断，根据Authentication对象创建接口SecurityExpressionOperations的实现类SecurityExpressionRoot

（1）当请求url被配置为permitAll，则直接返回true，校验通过

（2）其他需要登录请求url会调用isAuthenticated方法，最终调用AuthenticationTrustResolver的AuthenticationTrustResolverImpl的方法进行判断

public abstract class SecurityExpressionRoot implements SecurityExpressionOperations {
    	protected final Authentication authentication;
    	private AuthenticationTrustResolver trustResolver;
    	private RoleHierarchy roleHierarchy;
    	private Set<String> roles;
    	private String defaultRolePrefix = "ROLE_";
    
    	/** Allows "permitAll" expression */
    	public final boolean permitAll = true;
    
    	/** Allows "denyAll" expression */
    	public final boolean denyAll = false;
    	private PermissionEvaluator permissionEvaluator;
    	public final String read = "read";
    	public final String write = "write";
    	public final String create = "create";
    	public final String delete = "delete";
    	public final String admin = "administration";
    
    	/**
    	 * Creates a new instance
    	 * @param authentication the {@link Authentication} to use. Cannot be null.
    	 */
    	public SecurityExpressionRoot(Authentication authentication) {
    		if (authentication == null) {
    			throw new IllegalArgumentException("Authentication object cannot be null");
    		}
    		this.authentication = authentication;
    	}
    
    	public final boolean hasAuthority(String authority) {
    		return hasAnyAuthority(authority);
    	}
    
    	public final boolean hasAnyAuthority(String... authorities) {
    		return hasAnyAuthorityName(null, authorities);
    	}
    
    	public final boolean hasRole(String role) {
    		return hasAnyRole(role);
    	}
    
    	public final boolean hasAnyRole(String... roles) {
    		return hasAnyAuthorityName(defaultRolePrefix, roles);
    	}
    
    	private boolean hasAnyAuthorityName(String prefix, String... roles) {
    		Set<String> roleSet = getAuthoritySet();
    
    		for (String role : roles) {
    			String defaultedRole = getRoleWithDefaultPrefix(prefix, role);
    			if (roleSet.contains(defaultedRole)) {
    				return true;
    			}
    		}
    
    		return false;
    	}
    
    	public final Authentication getAuthentication() {
    		return authentication;
    	}
    
    	public final boolean permitAll() {
    		return true;
    	}
    
    	public final boolean denyAll() {
    		return false;
    	}
    
    	public final boolean isAnonymous() {
    		return trustResolver.isAnonymous(authentication);
    	}
    
    	public final boolean isAuthenticated() {
    		return !isAnonymous();
    	}
    
    	public final boolean isRememberMe() {
    		return trustResolver.isRememberMe(authentication);
    	}
    
    	public final boolean isFullyAuthenticated() {
    		return !trustResolver.isAnonymous(authentication)
    				&& !trustResolver.isRememberMe(authentication);
    	}
    
    	/**
    	 * Convenience method to access {@link Authentication#getPrincipal()} from
    	 * {@link #getAuthentication()}
    	 * @return
    	 */
    	public Object getPrincipal() {
    		return authentication.getPrincipal();
    	}
    
    	public void setTrustResolver(AuthenticationTrustResolver trustResolver) {
    		this.trustResolver = trustResolver;
    	}
    
    	public void setRoleHierarchy(RoleHierarchy roleHierarchy) {
    		this.roleHierarchy = roleHierarchy;
    	}
    
    	/**
    	 * <p>
    	 * Sets the default prefix to be added to {@link #hasAnyRole(String...)} or
    	 * {@link #hasRole(String)}. For example, if hasRole("ADMIN") or hasRole("ROLE_ADMIN")
    	 * is passed in, then the role ROLE_ADMIN will be used when the defaultRolePrefix is
    	 * "ROLE_" (default).
    	 * </p>
    	 *
    	 * <p>
    	 * If null or empty, then no default role prefix is used.
    	 * </p>
    	 *
    	 * @param defaultRolePrefix the default prefix to add to roles. Default "ROLE_".
    	 */
    	public void setDefaultRolePrefix(String defaultRolePrefix) {
    		this.defaultRolePrefix = defaultRolePrefix;
    	}
    
    	private Set<String> getAuthoritySet() {
    		if (roles == null) {
    			roles = new HashSet<String>();
    			Collection<? extends GrantedAuthority> userAuthorities = authentication
    					.getAuthorities();
    
    			if (roleHierarchy != null) {
    				userAuthorities = roleHierarchy
    						.getReachableGrantedAuthorities(userAuthorities);
    			}
    
    			roles = AuthorityUtils.authorityListToSet(userAuthorities);
    		}
    
    		return roles;
    	}
    
    	public boolean hasPermission(Object target, Object permission) {
    		return permissionEvaluator.hasPermission(authentication, target, permission);
    	}
    
    	public boolean hasPermission(Object targetId, String targetType, Object permission) {
    		return permissionEvaluator.hasPermission(authentication, (Serializable) targetId,
    				targetType, permission);
    	}
    
    	public void setPermissionEvaluator(PermissionEvaluator permissionEvaluator) {
    		this.permissionEvaluator = permissionEvaluator;
    	}
    
    	/**
    	 * Prefixes role with defaultRolePrefix if defaultRolePrefix is non-null and if role
    	 * does not already start with defaultRolePrefix.
    	 *
    	 * @param defaultRolePrefix
    	 * @param role
    	 * @return
    	 */
    	private static String getRoleWithDefaultPrefix(String defaultRolePrefix, String role) {
    		if (role == null) {
    			return role;
    		}
    		if (defaultRolePrefix == null || defaultRolePrefix.length() == 0) {
    			return role;
    		}
    		if (role.startsWith(defaultRolePrefix)) {
    			return role;
    		}
    		return defaultRolePrefix + role;
    	}
    }

在AuthenticationTrustResolverImpl方法isAnonymous中就是判断传递过来的Authentication对象是不是AnonymousAuthenticationToken，如果是AnonymousAuthenticationToken则表示没有登录，因为登录之后生成的对象是UsernamePasswordAuthenticationToken或其他Authentication对象，这也是Spring Security设计的最精华也是最难以理解也是最简单的方式。

private Class<? extends Authentication> anonymousClass = AnonymousAuthenticationToken.class;
    
    	public boolean isAnonymous(Authentication authentication) {
    		if ((anonymousClass == null) || (authentication == null)) {
    			return false;
    		}
    
    		return anonymousClass.isAssignableFrom(authentication.getClass());
    	}

总结：Spring Security对url的权限判断有两种方式，一种是请求是permitAll的则直接返回校验通过，另外一个是判断Authentication是不是AnonymousAuthenticationToken，因为正常登录等产生的不是这个对象，如果不是这个类型的对象则表示登录成功了。

[Spring Security_--]: https://blog.csdn.net/qq924862077/article/details/83027033