springboot + security 自定义登陆校验Filter

妖狐艹你老母 2022-06-03 10:47 435阅读 0赞

默认的登陆校验Filter是UsernamePasswordAuthenticationFilter，实现顺序是  
AbstractAuthenticationProcessingFilter.doFilter->UsernamePasswordAuthenticationFilter.attemptAuthentication->ProviderManager.authenticate->AbstractUserDetailsAuthenticationProvider.authenticate->DaoAuthenticationProvider.retrieveUser->自定义的UserDetailsService.loadUserByUsername  
这里在自定义的UserDetailsService里按username取出user，security会去给你判断密码是否相等。

因为业务需求，需要在登录前进入业务逻辑的判断，所以这里自定义Filter

public class OpenIdAuthenticationFilter extends UsernamePasswordAuthenticationFilter{ 
    
      @Autowired
      private RefactorSysUserService sysUserService;
    
      @Override
      public Authentication attemptAuthentication(HttpServletRequest request,
                                                  HttpServletResponse response) throws AuthenticationException {
         //业务逻辑 
    }

在securityConfig配置，感兴趣的可以去看看这个类FilterComparator，里面有个Map

@Override
      protected void configure(HttpSecurity http) throws Exception {
        http.addFilter(openIdAuthenticationFilter());
      }
    
    /** * 自定义登陆验证接口 */
      public OpenIdAuthenticationFilter openIdAuthenticationFilter() throws Exception {
        OpenIdAuthenticationFilter openIdAuthenticationFilter = new OpenIdAuthenticationFilter();
        openIdAuthenticationFilter.setAuthenticationManager(authenticationManager());
        //只有post请求才拦截
        openIdAuthenticationFilter.setRequiresAuthenticationRequestMatcher(new AntPathRequestMatcher("/login", "POST"));
        openIdAuthenticationFilter.setAuthenticationSuccessHandler(securityAuthenticationSuccessHandler);
        openIdAuthenticationFilter.setAuthenticationFailureHandler(securityAuthenticationFailureHandler);
        return openIdAuthenticationFilter;
      }