spring Security4 和 oauth2整合注解+xml混合使用（替换用户名密码认证）

ゝ一世哀愁。 2022-06-04 05:56 181阅读 0赞

## spring Security4 和 oauth2整合 （替换用户名密码认证） ##

之前已经写了注解和xml配合搭建基本认证、页面认证、授权码认证、替换6位授权码方法等，这次在前面的基础上介绍如何替换用户名密码认证，下一篇介绍如何增加验证码等额外参数验证方法。  
代码比较多，这次只贴出来部分，完整代码在  
git地址：[https://gitee.com/ffch/OauthUmp][https_gitee.com_ffch_OauthUmp]

[spring Security4 和 oauth2整合 注解+xml混合使用（基础运行篇）][spring Security4 _ oauth2_ _xml]  
[spring Security4 和 oauth2整合 注解+xml混合使用（进阶篇）][spring Security4 _ oauth2_ _xml 1]  
[spring Security4 和 oauth2整合 注解+xml混合使用（授权码篇）][spring Security4 _ oauth2_ _xml 2]  
[spring Security4 和 oauth2整合 注解+xml混合使用（注意事项篇）][spring Security4 _ oauth2_ _xml 3]  
[spring Security4 和 oauth2整合 注解+xml混合使用（替换6位的授权码）][spring Security4 _ oauth2_ _xml_6]  
[spring Security4 和 oauth2整合 注解+xml混合使用（替换用户名密码认证）][spring Security4 _ oauth2_ _xml 4]  
[spring Security4 和 oauth2整合 注解+xml混合使用（验证码等额外数据验证）][spring Security4 _ oauth2_ _xml 5]

### 用户名密码来源 ###

首先，我们假设用户名密码是通过service层获取的。这个逻辑就可以按照自己的逻辑去写了。

1.实体

package com.ump.domain;
    
    import java.util.UUID;
    
    public class AppUser {
    	private String uuid;
    	private String userName;
    	private String password;
    	private String userType;
    	public AppUser() {
    		
    	}
    	
    	public AppUser(String userName, String password) {
    		this.userName = userName;
    		this.password = password;
    		this.uuid = UUID.randomUUID().toString();
    		this.userType = "1";
    	}
    	
    	public AppUser(AppUser appUser) {
    		this.userName = appUser.userName;
    		this.password = appUser.password;
    		this.uuid = appUser.uuid;
    		this.userType = appUser.userType;
    	}
    
    
    	public String getUuid() {
    		return uuid;
    	}
    	public void setUuid(String uuid) {
    		this.uuid = uuid;
    	}
    	public String getUserName() {
    		return userName;
    	}
    	public void setUserName(String userName) {
    		this.userName = userName;
    	}
    	public String getPassword() {
    		return password;
    	}
    	public void setPassword(String password) {
    		this.password = password;
    	}
    	public String getUserType() {
    		return userType;
    	}
    	public void setUserType(String userType) {
    		this.userType = userType;
    	}
    }

2.service服务

package com.ump.service;
    
    import java.util.HashMap;
    import java.util.Map;
    import java.util.UUID;
    
    import org.springframework.stereotype.Service;
    
    import com.ump.domain.AppUser;
    
    @Service
    public class AppUserService {
    
    	public AppUser findByName(String userName) {
    		Map<String,AppUser> users = new HashMap<String,AppUser>();
    		AppUser user1 = new AppUser();
    		user1.setUserName("bill");
    		user1.setPassword("abc123");
    		user1.setUserType("1");
    		user1.setUuid(UUID.randomUUID().toString());
    		users.put("bill", user1);
    		
    		AppUser user2 = new AppUser();
    		user2.setUserName("bob");
    		user2.setPassword("abc123");
    		user2.setUserType("1");
    		user2.setUuid(UUID.randomUUID().toString());
    		users.put("bob", user2);
    		return users.get(userName);
    	}
    	
    }

### 替换UserDetails ###

用户来源不是直接指定了，而是从service层取了，所以我们要自定义UserDetails

package com.ump.oauth.detail;
    
    import java.util.Collection;
    
    import org.springframework.security.core.GrantedAuthority;
    import org.springframework.security.core.authority.AuthorityUtils;
    import org.springframework.security.core.userdetails.UserDetails;
    
    import com.ump.domain.AppUser;
    
    public class OauthUserDetails extends AppUser implements UserDetails{
    
    	public OauthUserDetails(AppUser appUser) {
    		super(appUser);
    	}
    
    	/**
    	 * 
    	 */
    	private static final long serialVersionUID = 6272869114201567325L;
    
    	@Override
    	public Collection<? extends GrantedAuthority> getAuthorities() {
    		return AuthorityUtils.createAuthorityList("USER");
    	}
    
    	@Override
    	public String getUserType() {
    		return super.getUserType();
    	}
    
    	@Override
    	public String getUsername() {
    		return super.getUserName();
    	}
    
    	@Override
    	public boolean isAccountNonExpired() {
    		return true;
    	}
    
    	@Override
    	public boolean isAccountNonLocked() {
    		return true;
    	}
    
    	@Override
    	public boolean isCredentialsNonExpired() {
    		return true;
    	}
    
    	@Override
    	public boolean isEnabled() {
    		return true;
    	}
    
    }

### 自定义UserDetailsService ###

我们需要提供loadUserByUsername方法。

package com.ump.oauth.part;
    
    import org.springframework.beans.factory.annotation.Autowired;
    import org.springframework.security.core.userdetails.UserDetails;
    import org.springframework.security.core.userdetails.UserDetailsService;
    import org.springframework.security.core.userdetails.UsernameNotFoundException;
    import org.springframework.stereotype.Service;
    
    import com.ump.domain.AppUser;
    import com.ump.oauth.detail.OauthUserDetails;
    import com.ump.service.AppUserService;
    
    @Service("oauthUserDetailsService")
    public class OauthUserDetailsService implements UserDetailsService {
    	@Autowired
    	private AppUserService appUserService;
    
    	@Override
    	public UserDetails loadUserByUsername(String userName) throws UsernameNotFoundException {
    		AppUser user;
            try {
                user = appUserService.findByName(userName);
            } catch (Exception e) {
                throw new UsernameNotFoundException("user select fail");
            }
            if(user == null){
                throw new UsernameNotFoundException("no user found");
            } else {
                try {
                    return new OauthUserDetails(user);
                } catch (Exception e) {
                    throw new UsernameNotFoundException("user role select fail");
                }
            }
    	}
    
    }

### AuthenticationProvider ###

AuthenticationProvider提供认证逻辑。

package com.ump.oauth.part;
    
    import java.util.Collection;
    
    import org.springframework.beans.factory.annotation.Autowired;
    import org.springframework.security.authentication.AuthenticationProvider;
    import org.springframework.security.authentication.BadCredentialsException;
    import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
    import org.springframework.security.core.Authentication;
    import org.springframework.security.core.AuthenticationException;
    import org.springframework.security.core.GrantedAuthority;
    import org.springframework.stereotype.Component;
    
    import com.ump.oauth.detail.OauthAddUserDetails;
    import com.ump.oauth.detail.OauthUserDetails;
    
    @Component
    public class OauthAuthenticationProvider implements AuthenticationProvider {
    	@Autowired
    	private OauthUserDetailsService oauthUserDetailsService;
    
    	/**
    	 * 自定义验证方式
    	 */
    	@Override
    	public Authentication authenticate(Authentication authentication) throws AuthenticationException {
    		//验证码等校验
    //		OauthAddUserDetails details = (OauthAddUserDetails) authentication.getDetails();
    //
    //		System.out.println(details.getToken() + "+++++++++++++++++" + details.getSessionToken());
    //		if (!details.getToken().equalsIgnoreCase(details.getSessionToken())) {
    //			throw new BadCredentialsException("验证码错误。");
    //		}
    		
    		//用户名密码校验
    		OauthUserDetails oauthUserDetails = (OauthUserDetails) oauthUserDetailsService
    				.loadUserByUsername(authentication.getName());
    		System.out.println(authentication.getName() + "+++++++++++++++++" + authentication.getCredentials());
    		if (!oauthUserDetails.getUserName().equals(authentication.getName())
    				|| !oauthUserDetails.getPassword().equals(authentication.getCredentials())) {
    			throw new BadCredentialsException("用户名或密码错误。");
    		}
    		Collection<? extends GrantedAuthority> authorities = oauthUserDetails.getAuthorities();
    		return new UsernamePasswordAuthenticationToken(oauthUserDetails.getUsername(), oauthUserDetails.getPassword(),
    				authorities);
    	}
    
    	@Override
    	public boolean supports(Class<?> arg0) {
    		return true;
    	}
    }

### spring security配置 ###

继承WebSecurityConfigurerAdapter的OAuth2SecurityConfiguration需要指向AuthenticationProvider。

package com.ump.oauth.config;
    
    import javax.servlet.http.HttpServletRequest;
    
    import org.springframework.beans.factory.annotation.Autowired;
    import org.springframework.beans.factory.annotation.Qualifier;
    import org.springframework.context.annotation.Bean;
    import org.springframework.context.annotation.Configuration;
    import org.springframework.security.authentication.AuthenticationDetailsSource;
    import org.springframework.security.authentication.AuthenticationManager;
    import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
    import org.springframework.security.config.annotation.web.builders.HttpSecurity;
    import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
    import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
    import org.springframework.security.core.userdetails.UserDetailsService;
    import org.springframework.security.oauth2.provider.ClientDetailsService;
    import org.springframework.security.oauth2.provider.approval.ApprovalStore;
    import org.springframework.security.oauth2.provider.approval.TokenApprovalStore;
    import org.springframework.security.oauth2.provider.approval.TokenStoreUserApprovalHandler;
    import org.springframework.security.oauth2.provider.error.OAuth2AuthenticationEntryPoint;
    import org.springframework.security.oauth2.provider.request.DefaultOAuth2RequestFactory;
    import org.springframework.security.oauth2.provider.token.TokenStore;
    import org.springframework.security.oauth2.provider.token.store.InMemoryTokenStore;
    import org.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler;
    import org.springframework.security.web.authentication.WebAuthenticationDetails;
    
    import com.ump.oauth.part.OauthAuthenticationProvider;
    
    @Configuration
    @EnableWebSecurity
    public class OAuth2SecurityConfiguration extends WebSecurityConfigurerAdapter {
    
    	@Autowired
    	@Qualifier("myClientDetailsService")
    	private ClientDetailsService clientDetailsService;
    	
    //	@Autowired
    //	@Qualifier("myUserDetailsService")
    //	private UserDetailsService userDetailsService;
    	
    //	@Autowired
    //    public void globalUserDetails(AuthenticationManagerBuilder auth) throws Exception {
    //		//auth.userDetailsService(userDetailsService);
    //		auth.inMemoryAuthentication()
    //        .withUser("bill").password("abc123").roles("ADMIN").and()
    //        .withUser("bob").password("abc123").roles("USER");
    //    }
    	
    	@Autowired
        private OauthAuthenticationProvider oauthAuthenticationProvider; 
    	
    	@Autowired
    	@Qualifier("oauthAuthenticationDetailsSource")
    	private AuthenticationDetailsSource<HttpServletRequest, WebAuthenticationDetails> authenticationDetailsSource;
    
    	@Autowired
        public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
            auth.authenticationProvider(oauthAuthenticationProvider);
        }
    
        @Override
        public void configure(HttpSecurity http) throws Exception {
        	SimpleUrlAuthenticationFailureHandler hander = new SimpleUrlAuthenticationFailureHandler();
        	hander.setUseForward(true);
        	hander.setDefaultFailureUrl("/authlogin.jsp");
        	
    		http
    		.csrf().disable()
    	  	.authorizeRequests()
    	  	.antMatchers("/oauth/token")
    	  	.permitAll().and()
    	  	.formLogin().loginPage("/authlogin.jsp")
    	  	.usernameParameter("userName").passwordParameter("userPwd")
    	  	.authenticationDetailsSource(authenticationDetailsSource)
    //	  	.loginProcessingUrl("/login").failureUrl("/index1.jsp")
    	  	.loginProcessingUrl("/login").failureHandler(hander)
    	  	.and().logout().logoutUrl("/logout");
    		http.authorizeRequests().antMatchers("/user/**").authenticated();
        }
    
        @Override
        @Bean
        public AuthenticationManager authenticationManagerBean() throws Exception {
            return super.authenticationManagerBean();
        }
    
    	@Bean
    	@Autowired
    	public TokenStoreUserApprovalHandler userApprovalHandler(TokenStore tokenStore){
    		TokenStoreUserApprovalHandler handler = new TokenStoreUserApprovalHandler();
    		handler.setTokenStore(tokenStore);
    		handler.setRequestFactory(new DefaultOAuth2RequestFactory(clientDetailsService));
    		handler.setClientDetailsService(clientDetailsService);
    		return handler;
    	}
    	
    	@Bean
    	@Autowired
    	public ApprovalStore approvalStore(TokenStore tokenStore) throws Exception {
    		TokenApprovalStore store = new TokenApprovalStore();
    		store.setTokenStore(tokenStore);
    		return store;
    	}
    	
    }

这样就可以了，中间有其他代码，删减即可，增加验证码的逻辑单独分开了，方便扩展。下一篇说明。

[https_gitee.com_ffch_OauthUmp]: https://gitee.com/ffch/OauthUmp
[spring Security4 _ oauth2_ _xml]: http://blog.csdn.net/feiyangtianyao/article/details/78687161
[spring Security4 _ oauth2_ _xml 1]: http://blog.csdn.net/feiyangtianyao/article/details/78687403
[spring Security4 _ oauth2_ _xml 2]: http://blog.csdn.net/feiyangtianyao/article/details/78687569
[spring Security4 _ oauth2_ _xml 3]: http://blog.csdn.net/feiyangtianyao/article/details/78687700
[spring Security4 _ oauth2_ _xml_6]: http://blog.csdn.net/feiyangtianyao/article/details/78721818
[spring Security4 _ oauth2_ _xml 4]: http://blog.csdn.net/feiyangtianyao/article/details/78727949
[spring Security4 _ oauth2_ _xml 5]: http://blog.csdn.net/feiyangtianyao/article/details/78728147