基于SpringSecurity实现的基本认证及OAuth2

//依赖关系dependencies {//该依赖用于编译阶段compile('org.springf ramework . boot : spring-boot-starter-security')

@EnableGlobalMe thodsecurity@SpringBootApplicationpublic class Application {public static void main (String[] args) {SpringApplication. run (Application.class, args) ;

@EnableGlobalMethodSecurity (securedEnabled = true)public class MethodSecuri tyConfig {// ...@EnableGlobalMethodSecurity (jsr250Enabled = true)public class MethodSecurityConfig {//...@EnableGlobalMe thodsecurity (prePostEnabled = true)public class MethodSecurityConfig {
/...
}

@PreAuthorize ("hasAuthority('ROLE ADMIN')") // 指定角色权限才能操作方法@GetMapping(value = "delete/ {id}")
public ModelAndView delete (@PathVariable ("id") Long id, Model model) {userService. removeUser (id) ;model . addAttribute ("userList", userService. listUsers()) ;model. addAttribute("title", "删除用户");return new ModelAndView ("users/list", "userModel", model) ;}

Using default security password: fa195d-3f4c-48b1-ad50-e24c31d5cf36

security . user . name=guest
security. user . password=guest123

github. cl ient. clientId=ad2abbc19b6c5f0ed117gi thub. client. clientSecret=26db88a4dfc34cebaf196e68761c1294ac4ce265gi thub.c1 ient. accessTokenUri=https://gi thub. com/1ogin/ oauth/access_tokengithub. client .userAuthorizationUri=https:/ /github. com/ login/ oauth/authorizegi thub. client.clientAuthenticationScheme-form gi thub. client. tokenName=oauth_ tokengithub. client.authenticationScheme=querygi thub. resource .userInfoUri=https:/ /api .github. com/user

@EnableWebSecurity@EnableOAuth2Client//启用0Auth2.0客户端@EnableGlobalMethodSecurity (prePostEnabledtrue)
启用方法安全设置
public class SecurityConfig extends WebSecurityConfigurerAdapter {//...}

@Override
protected void configure (HttpSecurity http) throws Exception {
http. addFilterBefore (ssoFilter(), BasicAuthenticationFilter.class). antMatcher ("/**")
. authori zeRequests ()
. antMatchers("/", "/index", "/403", "/css/**", "/js/**", "/
fonts/**") .permitAll() //不设限制，都允许访问
. anyRequest ()
. authenticated()
.and() .logout () . logoutSuccessUrl ("/") . permitAll ()
.and() .csrf () . csrfTokenRepository (CookieCsrfTokenRepository.
wi thHttpOnlyFalse() )

其中，我们也设置了一个过滤器ssoFiter,用于在BasicAuthenticationFilter之前进行拦截。如果拦截到的是/login,就是访问认证服务器。private Filter ssoFilter () {
OAuth2ClientAuthenticationProcessingFilter githubFilter = new OAu-
th2ClientAuthenticationProcessingFilter ("/login") ;
OAuth2RestTemplate githubTemplate = new OAuth2Res tTemplate (github()，
oauth2Cl ientContext) ;
gi thubFilter. setRestTemplate (gi thubTemplate) ;
UserInfoTokenServices tokenServices = new UserInfoTokenServices
(githubResource () .getUserInfoUri ()，github() .getClientId());
tokenServices. setRestTemplate (githubTemplate) ;
githubFilter. setTokenServices (tokenServices) ;return githubFilter;@Beanpublic FilterRegistrationBean oauth2C1 ientFilterRegistration (
OAuth2ClientContextFilter filter) {
FilterRegistrationBean registration = new FilterRegistrationBean() ;
registration.setFilter (filter) ;
registration. setOrder(-) ;return registration;@Bean@ConfigurationProperties ("github. client")public AuthorizationCodeResourceDetails github() {return new Authori zationCodeResourceDetails () ;@Bean@ConfigurationProperties ("gi thub . resource")public ResourceServerProperties gi thubResource() {return new ResourceServerProperties() ;

@Controllerpublic class MainController {@GetMapping("/")public String root ()return "redirect: / index";@GetMapping ("/index")public String index (Principal principal, Model model) {if (principal == null ) {return "index";
System. out.println (principal. toString()) ;
model . addAttribute ("principal", principal) ;return "index";@GetMapping ("/403")public String accesssDenied() {return "403";
}
}

另一个控制器是UserContrllerjava,用来模拟用户管理的相关资源。
@RestController
@RequestMapping("/")public class UserController/**
*查询所用用户return@GetMapping(" /users")CPreAuthorize ("hasAuthority('ROLE_ USER')") // 指定角色权限才能操作方法public ModelAndView list (Model model) {List<User> list = new ArrayList<>() ; //当前所在页面数据列表list. add (new User ("waylau",)) ;list.add (new User("老卫",)) ;
model. addAttribute ("title", "用户管理") ;
model. addAttribute ("userList", list) ;return new ModelAndView ("users/list", "userModel", model) ;
}

首页用于显示用户的基本信息。<body><div class="container"><div class="mt-3"><h2>He1l1o Spring Security</h2></div><div sec: authori ze=" isAuthenticated()" th:if="${principal}" th:-object="${principal}"><p>已有用户登录</p><p>登录的用户为: <span sec: authentication="name"></span></p><p>用户权限为: <span th: text="* {userAuthentication. authori-
ties}"></span></p><p>用户头像为: <img alt="" class="avatar width-full rounded-
2" height="230"th:src="* {userAuthentication.details.avatar_ url}"width="230"></p></div><div sec: authori ze="i sAnonymous () "><p>未有用户登录</p></div></div></body>用户管理界面显示用户的列表。<body><div class="container"><div class="mt-3"><h2 th:text="$ {userModel. title} ">Welcome to waylau. com</h2></div><table class="table table-hover"><thead><tr><td>Age</td><td>Name</td><td sec :authorize="hasRole (' ADMIN') ">Operation</td></tr></ thead><tbody><tr th:if="$ {userModel.userList.size() } eq 0"><td colspan="3">没有用户信息! ! </td></tr><tr th:each="user : $ {userModel .userList}"><td th:text="${user.age}">11</td><td th: text="$ {user . name}">waylau</a></td><td sec:authorize="hasRole(' ADMIN')"><div >我是管理员</div></td></tr></ tbody></ table></body>

Client ID : ad2abbc1 9b6c5f0ed117Client Secret :  6db88a4dfc34cebaf196e68761c1294ac4ce265