PROSAGA码农传奇-云鉴权-通过令牌进行Spring Security身份验证

0# 子阳 | 2019-08-31 10-32

<div class =“post-text”itemprop =“text”>
  <P>
    您可以在spring security中使用以下bean来完成它
    <a href="http://static.springsource.org/spring-security/site/docs/3.0.x/apidocs/org/springframework/security/core/token/KeyBasedPersistenceTokenService.html" rel="nofollow">
      TimedKeyBasedPersistenceTokenService
    </A>
  </p>
   <pre>
    <code>
      <bean name="tokenService" class="com.digipos.security.core.token.TimedKeyBasedPersistenceTokenService">
    <property name="tokenLifeInMinutes" value="15000"/>
    <property name="serverSecret" value="1234567"/>
    <property name="serverInteger" value="15062013"/>
    <property name="pseudoRandomNumberBits" value="7"/>
    <property name="secureRandom" ref="secureRandom"/>
</bean>

</code>
  </pre>
  <P>
    除此之外，你还需要
  </p>
  <P>
    用一个
     <code>
      PreAuthenticatedAuthenticationProvider
    </code>
  </p>
  <P>
    和
     <code>
      entry-point-ref
    </code>
     的属性
     <code>
      <http>
    </code>
     至
     <code>
      Http403ForbiddenEntryPoint
    </code>
     豆
  </p>
</DIV>

1# 哎？小查查 | 2019-08-31 10-32

<div class =“post-text”itemprop =“text”>
  <P>
    我找到了一种更简单的方法：
  </p>
  <P>
    我的解决方案适用于令牌身份验证和表单身份验证，但如果需要，您可以轻松地禁用其中一个。
  </p>
  <P>
    我的过滤器类似于Roman的过滤器，但我不需要检查用户是否可以访问特定资源，也不需要注销 - ＆gt;传递给springSecurity。
  </p>
  <P>
    验证过滤器：
  </p>
   <pre>
    <code>
      public class TokenAuthenticationFilter extends AbstractAuthenticationProcessingFilter {

private static final String SECURITY_TOKEN_KEY = "token";
private static final String SECURITY_TOKEN_HEADER = "X-Token";

public TokenAuthenticationFilter() {

super( "/" );
}

@Override
public void doFilter( ServletRequest req, ServletResponse res, FilterChain chain ) throws IOException, ServletException {

HttpServletRequest request = (HttpServletRequest) req;
    HttpServletResponse response = (HttpServletResponse) res;

String token = request.getParameter( SECURITY_TOKEN_KEY );
    // or this.token = request.getHeader(SECURITY_TOKEN_HEADER);

if ( token != null ) {

Authentication authResult;
        try {
            authResult = attemptAuthentication( request, response, token );
            if ( authResult == null ) {
                notAuthenticated( request, response, new LockedException( "User Not found" ) );
                return;
            }
        } catch ( AuthenticationException failed ) {
            notAuthenticated( request, response, failed );
            return;
        }

try {
            successfulAuthentication( request, response, chain, authResult );
            return;
        } catch ( NestedServletException e ) {
            logger.error( e.getMessage( ), e );
            if ( e.getCause( ) instanceof AccessDeniedException ) {
                notAuthenticated( request, response, new LockedException( "Forbidden" ) );
                return;
            }
        }
    }
    chain.doFilter( request, response );// return to others spring security filters
}

public void notAuthenticated( HttpServletRequest request, HttpServletResponse response, AuthenticationException failed ) throws IOException {

response.sendRedirect( "http://www.google.ro" );
    // unsuccessfulAuthentication( request, response, failed );
}

public Authentication attemptAuthentication( HttpServletRequest request, HttpServletResponse response, String token ) throws AuthenticationException, IOException, ServletException {

AbstractAuthenticationToken userAuthenticationToken = authUserByToken( token );
    if ( userAuthenticationToken == null )
        throw new AuthenticationServiceException( MessageFormat.format( "Error | {0}", "Bad Token" ) );

return userAuthenticationToken;
}

private AbstractAuthenticationToken authUserByToken( String tokenRaw ) {

AbstractAuthenticationToken authToken = null;
    try {
        // check your input token, identify the user
        // if success create AbstractAuthenticationToken for user to return
        // eg:
        // authToken = new UsernamePasswordAuthenticationToken( username, userHash, userAuthorities );
        // authToken = new UsernamePasswordAuthenticationToken( tokenRaw, authToken, )
        logger.info( "token received = " + tokenRaw );
        // obtain user by your methods
        // if ( user != null ) {
        // SecurityUser securityUser = new SecurityUser( user );
        // return new PreAuthenticatedAuthenticationToken( securityUser, securityUser.getPassword( ), securityUser.getAuthorities( ) );
        // }
    } catch ( Exception e ) {
        logger.error( "Error during authUserByToken", e );
    }
    return authToken;
}

@Override
protected void successfulAuthentication( HttpServletRequest request, HttpServletResponse response, Authentication authResult ) throws IOException, ServletException {

SecurityContextHolder.getContext( ).setAuthentication( authResult );

new CustomAuthenticationSuccessHandler( ).onAuthenticationSuccess( request, response, authResult );
}

@Override
public Authentication attemptAuthentication( HttpServletRequest request, HttpServletResponse response ) throws AuthenticationException, IOException, ServletException {

logger.error( "No TOKEN PROVIDED" );
    return null;
    }

}

</code>
  </pre>
  <P>
    那么你需要做的就是映射这个过滤器是在springSecurity（addFilterBefore）中配置它，这不必在servlet配置中映射。
  </p>
   <pre>
    <code>
              http.authorizeRequests( ).antMatchers( "/login*" ).permitAll( );
        http.authorizeRequests( ).antMatchers( "/register*" ).permitAll( );

http.authorizeRequests( ).antMatchers( "/admin/**" ).hasAnyAuthority( "ROLE_ADMIN", "ROLE_USER" );//

http.authorizeRequests( ).and( ).formLogin( )//
                .loginPage( "/login" )//
                .successHandler( successHandler( ) )//
                .failureUrl( "/login?error" ).permitAll( )//
                .and( ).logout( )//
                .logoutUrl( "/logout" ).logoutSuccessUrl( "/login?logout" ).permitAll( )//
                .and( ).rememberMe( ).key( applicationName + "_key" ).tokenValiditySeconds( 2419200 ); // remember me for 2 weeks

http.addFilterBefore( new TokenAuthenticationFilter( ), AnonymousAuthenticationFilter.class );

</code>
  </pre>
</DIV>

2# 冷月如霜·胡狼 | 2019-08-31 10-32

<div class =“post-text”itemprop =“text”>
  <P>
    您需要像这样实现自定义AuthenticationFilter
  </p>
   <pre>
    <code>
      public class CustomAuthenticationFilter extends AbstractAuthenticationProcessingFilter {

private static final String SECURITY_TOKEN_KEY    = "token";
  private static final String SECURITY_TOKEN_HEADER = "X-Token";
  private String token = null;

protected CustomAuthenticationFilter() {
    super("/");
  }

@Override
  public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain) throws IOException, ServletException {
    HttpServletRequest request = (HttpServletRequest) req;
    HttpServletResponse response = (HttpServletResponse) res;

this.token = request.getParameter(SECURITY_TOKEN_KEY);
    // or this.token = request.getHeader(SECURITY_TOKEN_HEADER);

if (request.getAttribute(FILTER_APPLIED) != null) {
      chain.doFilter(request, response);
      return;
    }

request.setAttribute(FILTER_APPLIED, Boolean.TRUE);

if(request.getParameter(actionParameter) !=null &&
        request.getParameter(actionParameter).equals("logout")) {
      SecurityContextHolder.clearContext();
      return;
    }

if (!requiresAuthentication(request, response)) {
      chain.doFilter(request, response);
      return;
    }

Authentication authResult;
    try {
      authResult = attemptAuthentication(request, response);
      if (authResult == null) {
        return;
      }
    } catch (AuthenticationException failed) {
      unsuccessfulAuthentication(request, response, failed);
      return;
    }

try {
      successfulAuthentication(request, response, chain, authResult);
    } catch (NestedServletException e) {
      if(e.getCause() instanceof AccessDeniedException) {
        unsuccessfulAuthentication(request, response, new LockedException("Forbidden"));
      }
    }
  }

@Override
  public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response) throws AuthenticationException, IOException, ServletException {

AbstractAuthenticationToken userAuthenticationToken = authUserByToken(this.token);
    if(userAuthenticationToken == null)
      throw new AuthenticationServiceException(MessageFormat.format("Error | {0}", "Bad Token"));

return userAuthenticationToken;
  }

private AbstractAuthenticationToken authUserByToken(String tokenRaw) {
    AbstractAuthenticationToken authToken = null;
    try {
      // check your input token, identify the user
      // if success create AbstractAuthenticationToken for user to return
      // eg:
      authToken = new UsernamePasswordAuthenticationToken(username, userHash, userAuthorities);

} catch (Exception e) {
      logger.error("Error during authUserByToken", e);
    }
    return authToken;
  }

@Override
  protected void successfulAuthentication(HttpServletRequest request, HttpServletResponse response,
                                          Authentication authResult) throws IOException, ServletException {
    SecurityContextHolder.getContext().setAuthentication(authResult);

getSuccessHandler().onAuthenticationSuccess(request, response, authResult);
  }

}

</code>
  </pre>
  <P>
    和自定义SuccessHandler一样
  </p>
   <pre>
    <code>
      public class CustomAuthenticationSuccessHandler extends SavedRequestAwareAuthenticationSuccessHandler {

@Override
  protected String determineTargetUrl(HttpServletRequest request, HttpServletResponse response) {
    return request.getServletPath();
  }

@Override
  public void onAuthenticationSuccess(HttpServletRequest request, HttpServletResponse response, Authentication authentication) throws ServletException, IOException {
    request.getRequestDispatcher(request.getServletPath()).forward(request, response);
  }
}

</code>
  </pre>
  <P>
    并在spring config中连接它
  </p>
   <pre>
    <code>
      <?xml version="1.0" encoding="UTF-8"?>
<b:beans
    xmlns="http://www.springframework.org/schema/security"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xmlns:b="http://www.springframework.org/schema/beans"
    xmlns:p="http://www.springframework.org/schema/p"
    xmlns:sec="http://www.springframework.org/schema/security"
    xmlns:context="http://www.springframework.org/schema/context"
    xmlns:aop="http://www.springframework.org/schema/aop"
    xsi:schemaLocation="http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.1.xsd
    http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.1.xsd
    http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-3.1.xsd
    http://www.springframework.org/schema/aop http://www.springframework.org/schema/aop/spring-aop-2.0.xsd">

<context:annotation-config/>
  <context:component-scan base-package="com.your.path" />

<aop:aspectj-autoproxy/>

<global-method-security pre-post-annotations="enabled" secured-annotations="enabled" proxy-target-class="true"
                          access-decision-manager-ref="accessDecisionManager"/>

<b:bean id="restAuthenticationEntryPoint" class="org.springframework.security.web.authentication.Http403ForbiddenEntryPoint"/>

<b:bean id="restFilter" class="com.your.path.CustomAuthenticationFilter">
    <b:property name="authenticationSuccessHandler" ref="mySuccessHandler"/>
  </b:bean>

<b:bean id="mySuccessHandler" class="com.your.path.CustomAuthenticationSuccessHandler"/>

<b:bean id="accessDecisionManager" class="org.springframework.security.access.vote.UnanimousBased">
    <b:property name="allowIfAllAbstainDecisions" value="true"/>
    <b:property name="decisionVoters">
      <b:list>
        <b:bean class="org.springframework.security.access.vote.RoleVoter">
          <b:property name="rolePrefix" value=""/>
        </b:bean>
        <b:bean class="org.springframework.security.access.vote.AuthenticatedVoter" />
      </b:list>
    </b:property>
  </b:bean>

</b:beans>

</code>
  </pre>
  <P>
    这应该有所帮助。
  </p>
</DIV>