SpringSecurity表单用户名和密码登陆

朱雀 2024-02-19 17:28 63阅读 0赞

流程：

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80MzU0OTU3OA_size_16_color_FFFFFF_t_70][]

关键点在 ：UsernamePasswordAuthenticationFilter：**用于处理用户名和密码登陆验证拦截**。

public class UsernamePasswordAuthenticationFilter extends
    		AbstractAuthenticationProcessingFilter {
    	//表单提交的请求参数名称
    	public static final String SPRING_SECURITY_FORM_USERNAME_KEY = "username";
    	public static final String SPRING_SECURITY_FORM_PASSWORD_KEY = "password";
    
    	private String usernameParameter = SPRING_SECURITY_FORM_USERNAME_KEY;
    	private String passwordParameter = SPRING_SECURITY_FORM_PASSWORD_KEY;
    	private boolean postOnly = true;
    
    	
    	public UsernamePasswordAuthenticationFilter() {
    		super(new AntPathRequestMatcher("/login", "POST"));
    	}
    
    	public Authentication attemptAuthentication(HttpServletRequest request,
    			HttpServletResponse response) throws AuthenticationException {
    		//只支持post提交方式	
    		if (postOnly && !request.getMethod().equals("POST")) {
    			throw new AuthenticationServiceException(
    					"Authentication method not supported: " + request.getMethod());
    		}
    
    		String username = obtainUsername(request);
    		String password = obtainPassword(request);
            ......................................
    		username = username.trim();
            //创建认证令牌
    		UsernamePasswordAuthenticationToken authRequest = new UsernamePasswordAuthenticationToken(
    				username, password);
    
    		// 将请求数据设置到UsernamePasswordAuthenticationToken
    		setDetails(request, authRequest);
            //获取AuthenticationManager认证管理器 进行请求认证
    		// AbstractUserDetailsAuthenticationProvider authenticate
    		return this.getAuthenticationManager().authenticate(authRequest);
    	}
    
    	............................................
    
    	protected void setDetails(HttpServletRequest request,
    			UsernamePasswordAuthenticationToken authRequest) {
    		authRequest.setDetails(authenticationDetailsSource.buildDetails(request));
    	}
       .............................................................
    }
    // AbstractUserDetailsAuthenticationProvider 
    public Authentication authenticate(Authentication authentication)
    			throws AuthenticationException {
    	Assert.isInstanceOf(UsernamePasswordAuthenticationToken.class, authentication,
    			messages.getMessage(
    					"AbstractUserDetailsAuthenticationProvider.onlySupports",
    					"Only UsernamePasswordAuthenticationToken is supported"));
    
    	// Determine username
    	String username = (authentication.getPrincipal() == null) ? "NONE_PROVIDED"
    			: authentication.getName();
    
    	boolean cacheWasUsed = true;
    	//先从换从中获取 UserDetails
    	UserDetails user = this.userCache.getUserFromCache(username);
    	
       if (user == null) {
    			cacheWasUsed = false;
    
    			try {
    			    //调用实现的 UserDetailsService的实现类进行登陆
    				user = retrieveUser(username,
    						(UsernamePasswordAuthenticationToken) authentication);
    			}
    			catch (UsernameNotFoundException notFound) {
    				..........................
    			}
    
    			Assert.notNull(user,
    					"retrieveUser returned null - a violation of the interface contract");
    		}
    
    	..................................
    	return createSuccessAuthentication(principalToReturn, authentication, user);
    }
    //获取UserDetails
    protected final UserDetails retrieveUser(String username,
    			UsernamePasswordAuthenticationToken authentication)
    			throws AuthenticationException {
    		UserDetails loadedUser;
    
    	try {
    	   //调用UserDetailsService实现类中重写的loadUserByUsername方法
    		loadedUser = this.getUserDetailsService().loadUserByUsername(username);
    	}
    	catch (UsernameNotFoundException notFound) {
    		if (authentication.getCredentials() != null) {
    			String presentedPassword = authentication.getCredentials().toString();
    			passwordEncoder.isPasswordValid(userNotFoundEncodedPassword,
    					presentedPassword, null);
    		}
    		throw notFound;
    	}
    	catch (Exception repositoryProblem) {
    		throw new InternalAuthenticationServiceException(
    				repositoryProblem.getMessage(), repositoryProblem);
    	}
    
    	if (loadedUser == null) {
    		throw new InternalAuthenticationServiceException(
    				"UserDetailsService returned null, which is an interface contract violation");
    	}
    	return loadedUser;
    }
    //认证成功
    protected Authentication createSuccessAuthentication(Object principal,
    	UsernamePasswordAuthenticationToken result = new UsernamePasswordAuthenticationToken(
    			principal, authentication.getCredentials(),
    			authoritiesMapper.mapAuthorities(user.getAuthorities()));
    	result.setDetails(authentication.getDetails());
    
    	return result;
    }
    
    //认证成功 /认证失败 会进入AbstractAuthenticationProcessingFilter选择相对于的handler处理器
    AbstractAuthenticationProcessingFilter
    public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain)
    			throws IOException, ServletException {
    
    	HttpServletRequest request = (HttpServletRequest) req;
    	HttpServletResponse response = (HttpServletResponse) res;
    
    	..............................................
    	Authentication authResult;
    
    	try {
    	    //获取身份认证结果
    		authResult = attemptAuthentication(request, response);
    		if (authResult == null) {
    			return;
    		}
    		sessionStrategy.onAuthentication(authResult, request, response);
    	}catch (InternalAuthenticationServiceException failed) {
    		.............................
    		//认证失败处理器
    		unsuccessfulAuthentication(request, response, failed);
    
    		return;
    	}
    	catch (AuthenticationException failed) {
    		//认证失败处理器
    		unsuccessfulAuthentication(request, response, failed);
    
    		return;
    	}
    
    	//认证成功处理器
    	if (continueChainBeforeSuccessfulAuthentication) {
    		chain.doFilter(request, response);
    	}
    
    	successfulAuthentication(request, response, chain, authResult);
    }
    
    protected void successfulAuthentication(HttpServletRequest request,
    		HttpServletResponse response, FilterChain chain, Authentication authResult)
    		throws IOException, ServletException {
          。。。。。。。。。。。。。。。。。。。。。。。
    	//将认证结果设置到SecurityContext
    	SecurityContextHolder.getContext().setAuthentication(authResult);
        //记住我配置
    	rememberMeServices.loginSuccess(request, response, authResult);
    
    	//事件派发
    	if (this.eventPublisher != null) {
    		eventPublisher.publishEvent(new InteractiveAuthenticationSuccessEvent(
    				authResult, this.getClass()));
    	}
        //如果没有自定义的successHandler 则调用默认的SavedRequestAwareAuthenticationSuccessHandler中的onAuthenticationSuccess
    	//如果项目中有实现了AuthenticationSuccessHandler接口的实现类，则调用自定义处理器中的onAuthenticationSuccess方法。
    	successHandler.onAuthenticationSuccess(request, response, authResult);
    }

案例：

UserDetailsService实现类

package com.spring.security;
    
    import org.slf4j.Logger;
    import org.slf4j.LoggerFactory;
    import org.springframework.beans.factory.annotation.Autowired;
    import org.springframework.security.core.authority.AuthorityUtils;
    import org.springframework.security.core.userdetails.UserDetails;
    import org.springframework.security.core.userdetails.UserDetailsService;
    import org.springframework.security.core.userdetails.UsernameNotFoundException;
    import org.springframework.security.crypto.password.PasswordEncoder;
    import org.springframework.social.security.SocialUser;
    import org.springframework.social.security.SocialUserDetails;
    import org.springframework.social.security.SocialUserDetailsService;
    import org.springframework.stereotype.Component;
    import org.springframework.transaction.annotation.Transactional;
    
    
    
    @Component
    @Transactional
    public class DemoUserDetailsService implements UserDetailsService{
    
    	private Logger logger = LoggerFactory.getLogger(getClass());
    
    	@Autowired
    	private PasswordEncoder passwordEncoder;
    
    
    	@Override
    	public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
           //TODO 查找数据库 获取用户信息 验证数据
    		return new User(username, password,
    				true, true, true, true,
    				AuthorityUtils.commaSeparatedStringToAuthorityList("xxx"));
    }
    
    
    	
    }

配置：

认证成功后的拦截器：

@Component("springAuthenticationSuccessHandler")
    public class SpringAuthenticationSuccessHandler extends SavedRequestAwareAuthenticationSuccessHandler {
    
    	private Logger logger = LoggerFactory.getLogger(getClass());
    
    	@Autowired
    	private ObjectMapper objectMapper;
    
    	@Autowired
    	private SecurityProperties securityProperties;
    
    	private RequestCache requestCache = new HttpSessionRequestCache();
    
    	/*
    	 * (non-Javadoc)
    	 *
    	 * @see org.springframework.security.web.authentication.
    	 * AuthenticationSuccessHandler#onAuthenticationSuccess(javax.servlet.http.
    	 * HttpServletRequest, javax.servlet.http.HttpServletResponse,
    	 * org.springframework.security.core.Authentication)
    	 */
    	@Override
    	public void onAuthenticationSuccess(HttpServletRequest request, HttpServletResponse response,
    			Authentication authentication) throws IOException, ServletException {
    
    		logger.info("登录成功");
    
    
    		response.setContentType("application/json;charset=UTF-8");
    		String type = authentication.getClass().getSimpleName();
    		response.getWriter().write(objectMapper.writeValueAsString(type);
    		
    	}
    
    }

认证安全配置：

package com.spring.security.browser;
    
    import javax.sql.DataSource;
    
    import com.spring.security.core.properties.SecurityConstants;
    import org.springframework.beans.factory.annotation.Autowired;
    import org.springframework.context.annotation.Bean;
    import org.springframework.context.annotation.Configuration;
    import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
    import org.springframework.security.config.annotation.web.builders.HttpSecurity;
    import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
    import org.springframework.security.core.userdetails.UserDetailsService;
    import org.springframework.security.web.authentication.AuthenticationSuccessHandler;
    import org.springframework.security.web.authentication.logout.LogoutSuccessHandler;
    import org.springframework.security.web.authentication.rememberme.JdbcTokenRepositoryImpl;
    import org.springframework.security.web.authentication.rememberme.PersistentTokenRepository;
    import org.springframework.security.web.session.InvalidSessionStrategy;
    import org.springframework.security.web.session.SessionInformationExpiredStrategy;
    import org.springframework.social.security.SpringSocialConfigurer;
    
    import com.spring.security.core.authentication.FormAuthenticationConfig;
    import com.spring.security.core.authentication.mobile.SmsCodeAuthenticationSecurityConfig;
    import com.spring.security.core.authorize.AuthorizeConfigManager;
    import com.spring.security.core.properties.SecurityProperties;
    import com.spring.security.core.validate.code.ValidateCodeSecurityConfig;
    
    /**
     * 浏览器环境下安全配置主类
     */
    @Configuration
    public class BrowserSecurityConfig extends WebSecurityConfigurerAdapter {
    
    
    	@Autowired
    	private DataSource dataSource;
    
    	@Autowired
    	private UserDetailsService userDetailsService;
    
    	@Autowired
    	private AuthenticationSuccessHandler authenticationSuccessHandle;
        //认证安全配置
    	@Override
    	protected void configure(HttpSecurity http) throws Exception {
    
    
    		http.formLogin()
    				.loginPage("/authentication/require")//登陆跳转路径
    				.loginProcessingUrl("/authentication/form")//登陆表单提交路径 默认是/login
    				.successHandler(authenticationSuccessHandle)//认证成功处理器
    				.and()
    				.authorizeRequests()
    				.antMatchers("/authentication/require","/code/*",
    						"/spring-signIn.html").permitAll() //路径不需要身份认证就可以访问
    				.anyRequest()
    				.authenticated()
    				.and()
    				.csrf()
    				.disable();
    
    	}
    
    	/**
    	 * 记住我功能的token存取器配置
    	 * @return
    	 */
    	@Bean
    	public PersistentTokenRepository persistentTokenRepository() {
    		JdbcTokenRepositoryImpl tokenRepository = new JdbcTokenRepositoryImpl();
    		tokenRepository.setDataSource(dataSource);
    //		tokenRepository.setCreateTableOnStartup(true);
    		return tokenRepository;
    	}
    
    }

认证处理逻辑：

/**
    	 * 当需要身份认证时，跳转到这里
    	 *
    	 * @param request
    	 * @param response
    	 * @return
    	 * @throws IOException
    	 */
    	@RequestMapping('authentication/require')
    	@ResponseStatus(code = HttpStatus.UNAUTHORIZED)
    	public SimpleResponse requireAuthentication(HttpServletRequest request, HttpServletResponse response)
    			throws IOException {
    
    		SavedRequest savedRequest = requestCache.getRequest(request, response);
    
    		if (savedRequest != null) {
    			String targetUrl = savedRequest.getRedirectUrl();
    			logger.info("引发跳转的请求是:" + targetUrl);
    			if (StringUtils.endsWithIgnoreCase(targetUrl, ".html")) {
    				redirectStrategy.sendRedirect(request, response, 'spring-signIn.html');
    			}
    		}
    
    		return new SimpleResponse("访问的服务需要身份认证，请引导用户到登录页");
    	}

spring-signIn.html：

<form action="/authentication/form" method="post">
    		<table>
    			<tr>
    				<td>用户名:</td>
    				<td><input type="text" name="username"></td>
    			</tr>
    			<tr>
    				<td>密码:</td>
    				<td><input type="password" name="password"></td>
    			</tr>
    			<tr>
    				<td>图形验证码:</td>
    				<td>
    					<input type="text" name="imageCode">
    					<img src="/code/image?width=200">
    				</td>
    			</tr>
    			<tr>
    				<td colspan='2'><input name="remember-me" type="checkbox" value="true" />记住我</td>
    			</tr>
    			<tr>
    				<td colspan="2"><button type="submit">登录</button></td>
    			</tr>
    		</table>
    	</form>

结果：

![20190220145755269.png][]

[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80MzU0OTU3OA_size_16_color_FFFFFF_t_70]: https://image.dandelioncloud.cn/pgy_files/images/2024/01/29/107df6bc9a1040f79ec2495c4d04c4df.png
[20190220145755269.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/01/29/228f4bfa2746435bad2313949443765a.png