springsecurity核心原理以及主要的实现方实践

分手后的思念是犯贱 2022-05-21 04:11 202阅读 0赞

个人总结：

Authentication（认证）->各种认证的实现方式，例如UsernamePassWordAuthenticationToken  
\->认证提供者基础接口AuthenticationProvider，实现方式例如：AbstractUserDetailsAuthenticationProvider，DaoAuthenticationProvider  
\->认证提供者中实现检索用户retrieveUser和尝试验证的方法additionalAuthenticationChecks  
\->各种filter，拦截住了登录请求的url，并从请求中获取用户名密码信息，并在基础认证通过之后，将登录请求信息转发给Authentication或AuthenticationProvider，例如：UsernamePasswordAuthenticationFilter

所以想要实现额外的验证，有几种方法，一种是继承各种认证的实现方式，然后做扩展（本质上都是获取httpServletRequest对象，然后从其中获取到请求中的验证码，然后跟存储在服务端的session中的验证码做对比，而想要获取request对象，那么就得在filter等含义request的对象中才能获取）  
my extends UsernamePassWordAuthenticationToken

另一种是继承认证的filter，然后用验证码

public class LoginAuthenticationFilter extends UsernamePasswordAuthenticationFilter {
    
        public LoginAuthenticationFilter() {
            AntPathRequestMatcher requestMatcher = new AntPathRequestMatcher("/login", "POST");
            this.setRequiresAuthenticationRequestMatcher(requestMatcher);
            this.setAuthenticationManager(getAuthenticationManager());
    //        this.setAuthenticationFailureHandler(new LoginAuthenticationFailureHandler());
        }
    
        @Override
        public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response) throws AuthenticationException {
            String verification = request.getParameter("j_captcha");
            String captcha = (String) request.getSession().getAttribute("CAPTCHA_SESSION_KEY");
    
            if (!captcha.contentEquals(verification)) {
                throw new MyAuthenticationException("captcha code not matched!");
            }
            return super.attemptAuthentication(request, response);
        }
    }

主要分为两个步骤  
1.认证(鉴定你的账号密码是否正确)  
问题:如何实现认证功能？  
核心的认证接口：

org.springframework.security.core.Authentication
    设置了账户名，密码，授权信息等核心人认证信息

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3k0MTk5MjkxMA_size_16_color_FFFFFF_t_70]

验证器提供者（也就是实现类，或者设置的类）  
org.springframework.security.authentication.AuthenticationProvider

import org.springframework.security.core.Authentication;
 import org.springframework.security.core.AuthenticationException;
 public interface AuthenticationProvider {
 	Authentication authenticate(Authentication authentication)
 			throws AuthenticationException;
 	boolean supports(Class<?> authentication);
 }

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3k0MTk5MjkxMA_size_16_color_FFFFFF_t_70 1]

org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter

package org.springframework.security.web.authentication;
 
 import org.springframework.security.authentication.AuthenticationServiceException;
 import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
 import org.springframework.security.core.Authentication;
 import org.springframework.security.core.AuthenticationException;
 import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
 import org.springframework.util.Assert;
 
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 
 /**
 * Processes an authentication form submission. Called
 * {@code AuthenticationProcessingFilter} prior to Spring Security 3.0.
 * 
 * Login forms must present two parameters to this filter: a username and password. The
 * default parameter names to use are contained in the static fields
 * {@link #SPRING_SECURITY_FORM_USERNAME_KEY} and
 * {@link #SPRING_SECURITY_FORM_PASSWORD_KEY}. The parameter names can also be changed by
 * setting the {@code usernameParameter} and {@code passwordParameter} properties.
 * 
 * This filter by default responds to the URL {@code /login}.
 *
 * @author Ben Alex
 * @author Colin Sampaleanu
 * @author Luke Taylor
 * @since 3.0
 */
 public class UsernamePasswordAuthenticationFilter extends
 		AbstractAuthenticationProcessingFilter {
 	// ~ Static fields/initializers
 	// =====================================================================================
 
 	public static final String SPRING_SECURITY_FORM_USERNAME_KEY = "username";
 	public static final String SPRING_SECURITY_FORM_PASSWORD_KEY = "password";
 
 	private String usernameParameter = SPRING_SECURITY_FORM_USERNAME_KEY;
 	private String passwordParameter = SPRING_SECURITY_FORM_PASSWORD_KEY;
 	private boolean postOnly = true;
 
 	// ~ Constructors
 	// ===================================================================================================
 
 	public UsernamePasswordAuthenticationFilter() {
 		super(new AntPathRequestMatcher("/login", "POST"));
 	}
 
 	// ~ Methods
 	// ========================================================================================================
 
 	public Authentication attemptAuthentication(HttpServletRequest request,
 			HttpServletResponse response) throws AuthenticationException {
 		if (postOnly && !request.getMethod().equals("POST")) {
 			throw new AuthenticationServiceException(
 					"Authentication method not supported: " + request.getMethod());
 		}
 
 		String username = obtainUsername(request);
 		String password = obtainPassword(request);
 
 		if (username == null) {
 			username = "";
 		}
 
 		if (password == null) {
 			password = "";
 		}
 
 		username = username.trim();
 
 		UsernamePasswordAuthenticationToken authRequest = new UsernamePasswordAuthenticationToken(
 				username, password);
 
 		// Allow subclasses to set the "details" property
 		setDetails(request, authRequest);
 
 		return this.getAuthenticationManager().authenticate(authRequest);
 	}
 
 	/**
 	 * Enables subclasses to override the composition of the password, such as by
 	 * including additional values and a separator.
 	 * 
 	 * This might be used for example if a postcode/zipcode was required in addition to
 	 * the password. A delimiter such as a pipe (|) should be used to separate the
 	 * password and extended value(s). The <code>AuthenticationDao</code> will need to
 	 * generate the expected password in a corresponding manner.
 	 * 
 	 *
 	 * @param request so that request attributes can be retrieved
 	 *
 	 * @return the password that will be presented in the <code>Authentication</code>
 	 * request token to the <code>AuthenticationManager</code>
 	 */
 	protected String obtainPassword(HttpServletRequest request) {
 		return request.getParameter(passwordParameter);
 	}
 
 	/**
 	 * Enables subclasses to override the composition of the username, such as by
 	 * including additional values and a separator.
 	 *
 	 * @param request so that request attributes can be retrieved
 	 *
 	 * @return the username that will be presented in the <code>Authentication</code>
 	 * request token to the <code>AuthenticationManager</code>
 	 */
 	protected String obtainUsername(HttpServletRequest request) {
 		return request.getParameter(usernameParameter);
 	}
 
 	/**
 	 * Provided so that subclasses may configure what is put into the authentication
 	 * request's details property.
 	 *
 	 * @param request that an authentication request is being created for
 	 * @param authRequest the authentication request object that should have its details
 	 * set
 	 */
 	protected void setDetails(HttpServletRequest request,
 			UsernamePasswordAuthenticationToken authRequest) {
 		authRequest.setDetails(authenticationDetailsSource.buildDetails(request));
 	}
 
 	/**
 	 * Sets the parameter name which will be used to obtain the username from the login
 	 * request.
 	 *
 	 * @param usernameParameter the parameter name. Defaults to "username".
 	 */
 	public void setUsernameParameter(String usernameParameter) {
 		Assert.hasText(usernameParameter, "Username parameter must not be empty or null");
 		this.usernameParameter = usernameParameter;
 	}
 
 	/**
 	 * Sets the parameter name which will be used to obtain the password from the login
 	 * request..
 	 *
 	 * @param passwordParameter the parameter name. Defaults to "password".
 	 */
 	public void setPasswordParameter(String passwordParameter) {
 		Assert.hasText(passwordParameter, "Password parameter must not be empty or null");
 		this.passwordParameter = passwordParameter;
 	}
 
 	/**
 	 * Defines whether only HTTP POST requests will be allowed by this filter. If set to
 	 * true, and an authentication request is received which is not a POST request, an
 	 * exception will be raised immediately and authentication will not be attempted. The
 	 * <tt>unsuccessfulAuthentication()</tt> method will be called as if handling a failed
 	 * authentication.
 	 * 
 	 * Defaults to <tt>true</tt> but may be overridden by subclasses.
 	 */
 	public void setPostOnly(boolean postOnly) {
 		this.postOnly = postOnly;
 	}
 
 	public final String getUsernameParameter() {
 		return usernameParameter;
 	}
 
 	public final String getPasswordParameter() {
 		return passwordParameter;
 	}
 }

实现自己的认证接口提供者：

MyAuthenticationProvider extends AbstractUserDetailsAuthenticationProvider

实现两个方法：  
1.检索用户,获取到UserDetails 对象

/**
    	 * retrieveUser，检索用户
    	 * 1.先通过用户账户查找该用户是否存在。如果存在，则交给：additionalAuthenticationChecks方法进行密码的验证
    	 * 
    	 */
    	@Override
    	protected UserDetails retrieveUser(String username,
    			UsernamePasswordAuthenticationToken authentication)
    			throws AuthenticationException {
    		 UserDetails loadedUser;
    
    	        try {
    	            String password = (String) authentication.getCredentials();
    	            /**
    	             * 区别:这里使用的是自定义的验证方法
    	             */
    	            //loadedUser = getUserDetailsService().loadUserByUsername(username, password);
    	            loadedUser = getUserDetailsService().loadUserByUsername(username);
    	        } catch (UsernameNotFoundException notFound) {
    	            throw notFound;
    	        } catch (Exception repositoryProblem) {
    	            throw new AuthenticationServiceException(repositoryProblem.getMessage(), repositoryProblem);
    	        }
    
    	        if (loadedUser == null) {
    	            throw new AuthenticationServiceException(
    	                    "UserDetailsService returned null, which is an interface contract violation");
    	        }
    	        return loadedUser;
    	}

2.附加的认证检查

/**
    	 * 
    additional Authentication Checks：附加的认证检查
    	 * 2.验证数据库查询获取的UserDetails中的用户名和密码，与用户登录所输入的用户名和密码是否匹配（UsernamePasswordAuthenticationToken）
    	 */
    	@Override
    	protected void additionalAuthenticationChecks(UserDetails userDetails,
    			UsernamePasswordAuthenticationToken authentication)
    			throws AuthenticationException {
    		//直接使用sha1的散列方式进行密码加密，不需要额外的盐值
    //        Object salt = null;
    
    //        if (this.saltSource != null) {
    //            salt = this.saltSource.getSalt(userDetails);
    //        }
    //
    //        if (authentication.getCredentials() == null) {
    //            logger.debug("Authentication failed: no credentials provided");
    //
    //            throw new BadCredentialsException("Bad credentials:" + userDetails);
    //        }
    		System.out.println("authentication:" + authentication);
            String presentedPassword = authentication.getCredentials().toString();
    
    		//这里需要设置验证密码的方式,用户注册的时候，以何种方式加密，这里也以何种salt进行加密        
            if (!passwordEncoder.matches(presentedPassword, userDetails.getPassword())) {
                logger.debug("Authentication failed: password does not match stored value");
    
                throw new BadCredentialsException("Bad credentials:" + userDetails);
            }
    	}

注册自己的认证器

/**
    	 * 设置认证管理
    	 * 设置UserDetailsService
    	 * 设置验证器
    	 */
        @Override
        protected void configure(AuthenticationManagerBuilder auth) throws Exception {
            auth.userDetailsService(myUserDetailsService());
            auth.authenticationProvider(MyAuthenticationProvider());
        }

常用的认证接口：用户名和密码认证接口

UsernamePasswordAuthenticationToken

2.授权(允许你访问哪些资源)  
Authorization

2、框架原理

众所周知 想要对对Web资源进行保护，最好的办法莫过于Filter，要想对方法调用进行保护，最好的办法莫过于AOP。所以springSecurity在我们进行用户认证以及授予权限的时候，通过各种各样的拦截器来控制权限的访问，从而实现安全。
        如下为其主要过滤器  
        WebAsyncManagerIntegrationFilter 
        SecurityContextPersistenceFilter 
        HeaderWriterFilter 
        CorsFilter 
        LogoutFilter
        RequestCacheAwareFilter
        SecurityContextHolderAwareRequestFilter
        AnonymousAuthenticationFilter
        SessionManagementFilter
        ExceptionTranslationFilter
        FilterSecurityInterceptor
        UsernamePasswordAuthenticationFilter
        BasicAuthenticationFilter
     3、框架的核心组件
      SecurityContextHolder：提供对SecurityContext的访问
      SecurityContext,：持有Authentication对象和其他可能需要的信息
      AuthenticationManager 其中可以包含多个AuthenticationProvider
      ProviderManager对象为AuthenticationManager接口的实现类
      AuthenticationProvider 主要用来进行认证操作的类 调用其中的authenticate()方法去进行认证操作
      Authentication：Spring Security方式的认证主体
      GrantedAuthority：对认证主题的应用层面的授权，含当前用户的权限信息，通常使用角色表示
     UserDetails：构建Authentication对象必须的信息，可以自定义，可能需要访问DB得到
      UserDetailsService：通过username构建UserDetails对象，通过loadUserByUsername根据userName获取UserDetail对象 （可以在这里基于自身业务进行自定义的实现  如通过数据库，xml,缓存获取等）

[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3k0MTk5MjkxMA_size_16_color_FFFFFF_t_70]: /images/20220521/088e64ef3c484cf09f2402dc775681b7.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3k0MTk5MjkxMA_size_16_color_FFFFFF_t_70 1]: /images/20220521/533d15cf548c4e15939e0c8b3b090525.png