1幻灯片 1 幻灯片 2 <dependency> <groupId>org.springframework.boot<

幻灯片 1

幻灯片 2

<dependency> <groupId>org.springframework.boot</groupId> <artifactId>spring-boot-starter-security</artifactId> </dependency>

幻灯片 3

幻灯片 4

<html lang="en"> <head> <meta charset="UTF-8"> <title>Login</title> <link href="maxcdn.bootstrapcdn.com/bootstrap/4…" rel="stylesheet" integrity="sha384-/Y6pD6FV/Vv2HJnA6t+vslU6fwYXjCFtcEpHbNJ0lyAFsXTsjBbfaDjzALeQsN6M" crossorigin="anonymous"> <link href="getbootstrap.com/docs/4.0/ex…" rel="stylesheet" crossorigin="anonymous"/> </head> <body> <div class="container"> <form class="form-signin" method="post" action="/login"> <h2 class="form-signin-heading">CLX-Please sign in</h2> <label for="username" class="sr-only">Username</label> <input type="text" id="username" name="username" class="form-control" placeholder="Username" required autofocus> <label for="password" class="sr-only">Password</label> <input type="password" id="password" name="password" class="form-control" placeholder="Password" required> <input name="_csrf" type="hidden" value="c66eed70-0fde-4120-9f32-1e035ab5f06c" /> <button class="btn btn-lg btn-primary btn-block" type="submit">Sign in</button> </form> </body> </html>

幻灯片 5

public class CustomPasswordEncoder implements PasswordEncoder { @Override public String encode(CharSequence charSequence) { return charSequence.toString(); }

@Override public boolean matches(CharSequence charSequence, String s) { return s.equals(charSequence.toString()); } }

幻灯片 6

@Configuration public class CustomWebMvcConfigure implements WebMvcConfigurer { @Override public void addViewControllers(ViewControllerRegistry registry) { registry.addViewController("/login").setViewName("login.html"); } }

@Configuration public class CustomSecurityConfigurer extends WebSecurityConfigurerAdapter {

@Override protected void configure(AuthenticationManagerBuilder auth) throws Exception { auth.inMemoryAuthentication().passwordEncoder(new CustomPasswordEncoder()). withUser("admin").password("admin").roles("ADMIN") .and() .withUser("clx").password("clx").roles("USER"); }

@Override protected void configure(HttpSecurity http) throws Exception { http.authorizeRequests().anyRequest().authenticated() .and().formLogin().loginPage("/login").permitAll() .and().csrf().disable(); } }

幻灯片 7

幻灯片 8

幻灯片 9

幻灯片 10

@Configuration public class CustomSecurityConfigurer extends WebSecurityConfigurerAdapter {

@Autowired CustomAuthentlcationProvider customAuthentlcationProvider;

@Override protected void configure(AuthenticationManagerBuilder auth) throws Exception { auth.authenticationProvider(customAuthentlcationProvider); // auth.inMemoryAuthentication().passwordEncoder(new CustomPasswordEncoder()). // withUser("admin").password("admin").roles("ADMIN") // .and() // .withUser("clx").password("clx").roles("USER"); }

幻灯片 11

@Component public class CustomAuthentlcationProvider implements AuthenticationProvider {

@Autowired private CustomUserDetailsService customUserDetailsService;

@Override public Authentication authenticate(Authentication authentication) throws AuthenticationException { // 获取用户名 String username = (String)authentication.getPrincipal(); // 获取密码 String password = (String)authentication.getCredentials();

*// TODO 此处可以进行加密处理

// 后台处理得到的密码* UserDetails userDetails = customUserDetailsService.loadUserByUsername(username); if(!password.equals(userDetails.getPassword())) { throw new BadCredentialsException("用户名和密码不正确，请重新登录"); }

return new UsernamePasswordAuthenticationToken(username, password, userDetails.getAuthorities()); }

@Override public boolean supports(Class<?> aClass) { return true; } }

幻灯片 12

@Component public class CustomUserDetailsService implements UserDetailsService { @Autowired private CustomUserDetails customUserDetails;

@Override public UserDetails loadUserByUsername(String s) throws UsernameNotFoundException { // TODO 从数据库里面查或者从LDAP里面查 customUserDetails**.setUsername(s); customUserDetails.setPassword("test");

return customUserDetails; } }

幻灯片 13

@Component public class CustomUserDetails implements UserDetails, Serializable { private String username; private String password;

@Override public Collection<? extends GrantedAuthority> getAuthorities() { return null; }

@Override public String getPassword() { return this.password; }

@Override public String getUsername() { return this.username; }

public void setUsername(String username) { this.username = username; }

public void setPassword(String password) { this.password = password; }

//-----为了测试，暂时都设置为True，默认false-----Start @Override public boolean isAccountNonExpired() { return true; }

@Override public boolean isAccountNonLocked() { return true; }

@Override public boolean isCredentialsNonExpired() { return true; }

@Override public boolean isEnabled() { return true; } //-----为了测试，暂时都设置为True，默认false-----End }

幻灯片 14

幻灯片 15

幻灯片 16

幻灯片 17

CustomResponseBody：

public class CustomResponseBody implements Serializable { private String status; private String msg; private String result;

public String getStatus() { return status; }

public void setStatus(String status) { this.status = status; }

public String getMsg() { return msg; }

public void setMsg(String msg) { this.msg = msg; }

public String getResult() { return result; }

public void setResult(String result) { this.result = result; } }

---------------------------------------------------------------

CustomAuthenticationEntryPoint

@Component public class CustomAuthenticationEntryPoint implements AuthenticationEntryPoint { @Override public void commence(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, AuthenticationException e) throws IOException, ServletException { CustomResponseBody customResponseBody = new CustomResponseBody(); customResponseBody.setStatus("01"); customResponseBody.setMsg("Need Login"); httpServletResponse.getWriter().write(JSON.toJSONString(customResponseBody)); } }

-----------------------------------------------------------------------

CustomSecurityConfigurer

@Configuration public class CustomSecurityConfigurer extends WebSecurityConfigurerAdapter {

@Autowired CustomAuthentlcationProvider customAuthentlcationProvider;

@Autowired CustomAuthenticationEntryPoint customAuthenticationEntryPoint;

@Override protected void configure(HttpSecurity http) throws Exception { http .httpBasic().authenticationEntryPoint(customAuthenticationEntryPoint) .and() .authorizeRequests().anyRequest().authenticated() .and().formLogin().loginPage("/login").permitAll() .and().csrf().disable(); } }

幻灯片 18

幻灯片 19

@Component public class CustomAuthenticationSuccessHandler implements AuthenticationSuccessHandler { @Override public void onAuthenticationSuccess(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, Authentication authentication) throws IOException, ServletException { CustomResponseBody customResponseBody = new CustomResponseBody(); customResponseBody.setStatus("02"); customResponseBody.setMsg("Login success"); httpServletResponse.getWriter().write(JSON.toJSONString(customResponseBody)); } }

---------------------------------------------------------------

CustomSecurityConfigurer

@Configuration public class CustomSecurityConfigurer extends WebSecurityConfigurerAdapter {

@Autowired CustomAuthentlcationProvider customAuthentlcationProvider;

@Autowired CustomAuthenticationEntryPoint customAuthenticationEntryPoint;

@Autowired CustomAuthenticationSuccessHandler customAuthenticationSuccessHandler;

@Autowired CustomAuthenticationFailureHandler customAuthenticationFailureHandler;

幻灯片 20

幻灯片 21

@Component public class CustomAuthenticationFailureHandler implements AuthenticationFailureHandler { @Override public void onAuthenticationFailure(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, AuthenticationException e) throws IOException, ServletException { CustomResponseBody customResponseBody = new CustomResponseBody(); customResponseBody.setStatus("03"); customResponseBody.setMsg("Login fail"); httpServletResponse.getWriter().write(JSON.toJSONString(customResponseBody)); } }

--------------------------------------------------------------------------------------

CustomSecurityConfigurer

@Configuration public class CustomSecurityConfigurer extends WebSecurityConfigurerAdapter {

@Autowired CustomAuthentlcationProvider customAuthentlcationProvider;

@Autowired CustomAuthenticationEntryPoint customAuthenticationEntryPoint;

@Autowired CustomAuthenticationSuccessHandler customAuthenticationSuccessHandler;

@Autowired CustomAuthenticationFailureHandler customAuthenticationFailureHandler;

幻灯片 22

幻灯片 23

幻灯片 24

幻灯片 25

CustomUserDetailsService

@Component public class CustomUserDetailsService implements UserDetailsService { @Autowired private CustomUserDetails customUserDetails;

Set authoritiesSet = new HashSet(); GrantedAuthority grantedAuthority = new SimpleGrantedAuthority("ROLE_AAA"); authoritiesSet.add(grantedAuthority); customUserDetails.setAuthorities(authoritiesSet);

return customUserDetails; } }

-------------------------------------------------------------

CustomUserDetails

@Component public class CustomUserDetails implements UserDetails, Serializable { private String username; private String password; // 权限 private Set<? extends GrantedAuthority> authorities;

@Override public Collection<? extends GrantedAuthority> getAuthorities() { return this.authorities; }

public void setAuthorities(Set<? extends GrantedAuthority> authorities) { this.authorities = authorities; }