oauth2授权,配置springSecurity web认证

一 继承WebSecurityConfigurerAdapter抽象类

package com.xy.uums.auth.config;

import com.xy.uums.auth.security.service.AuthUserDetailsService;
import com.xy.uums.core.security.CustomAccessDeniedHandler;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.authentication.AuthenticationProvider;
import org.springframework.security.authentication.dao.DaoAuthenticationProvider;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.builders.WebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.config.http.SessionCreationPolicy;
import org.springframework.security.crypto.password.PasswordEncoder;

/**
* oauth2 权限控制
*
*/
@Configuration
public class OAuth2SecurityConfigurer extends WebSecurityConfigurerAdapter {
@Autowired
private AuthUserDetailsService    userDetailsService;
@Autowired
private CustomAccessDeniedHandler accessDeniedHandler;
@Autowired
private PasswordEncoder           passwordEncoder;//定义在这里-> CoreBeanConfigurer.java

@Override
@Bean
public AuthenticationManager authenticationManagerBean() throws Exception {
return super.authenticationManagerBean();
}

/**
* 配置 user-detail 服务
*
* @param auth
* @throws Exception
* @since 2018-03-22
*/
@Override
protected void configure(AuthenticationManagerBuilder auth) {
auth.authenticationProvider
3ff7
(daoAuthenticationProvider());
auth.eraseCredentials(true);    //登录完成后清除密码
}

@Bean
public AuthenticationProvider daoAuthenticationProvider() {
DaoAuthenticationProvider provider = new DaoAuthenticationProvider();
provider.setUserDetailsService(userDetailsService);
provider.setHideUserNotFoundExceptions(false);
provider.setPasswordEncoder(passwordEncoder);
return provider;
}

/**
* 配置 spring security 的 custom 链
*
* @param web
* @throws Exception
*/
@Override
public void configure(WebSecurity web) {
web.debug(false);
web.ignoring().antMatchers(
"/image/**",
//静态资源
"/view/**",
"/public/**",
"/**/*.ico",
"/**/*.js",
"/**/*.css",
"/**/*.tff",
"/**/*.eot",
"/**/*.woff",
"/**/*.svg",
"/**/*.woff2",
"/**/*.css.map",
"/**/*.jpg",
"/**/*.gif",
"/**/*.bmp",
"/**/*.png"
);
}

/**
* 配置 如何通过拦截器保护请求
*
* @param http
* @throws Exception
*/
@Override
protected void configure(HttpSecurity http) throws Exception {
http.csrf().disable();

http.exceptionHandling()
.accessDeniedHandler(accessDeniedHandler)
.authenticationEntryPoint(accessDeniedHandler);

http.authorizeRequests()
.anyRequest()
.authenticated();

http.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);
}

}

spring security大体上是由一堆Filter（所以才能在spring mvc前拦截请求）实现的，Filter有几个，登出Filter（LogoutFilter），用户名密码验证Filter（UsernamePasswordAuthenticationFilter）之类的，Filter再交由其他组件完成细分的功能，例如最常用的UsernamePasswordAuthenticationFilter会持有一个AuthenticationManager引用，AuthenticationManager顾名思义，验证管理器，负责验证的，但AuthenticationManager本身并不做具体的验证工作，AuthenticationManager持有一个AuthenticationProvider集合，AuthenticationProvider才是做验证工作的组件，AuthenticationManager和AuthenticationProvider的工作机制可以大概看一下这两个的java doc，然后成功失败都有相对应该Handler 。大体的spring security的验证工作流程就是这样了。

需要一个数据库认证的AuthenticationProvider，我们可以直接用spring security提供的DaoAuthenticationProvider，设置一下UserServiceDetails和PasswordEncoder就可以了

然后 配置拦截器保护请求已经不需要权限的资源

以上的

@Autowired
private PasswordEncoder           passwordEncoder; //这里使用以下的密码加密器, 默认的不安全

/**
* 密码加密器
*
*/
@Bean
public PasswordEncoder passwordEncoder() {
String encodingId = "bcrypt";
Map<String, PasswordEncoder> encoders = new HashMap<>();
encoders.put(encodingId, new BCryptPasswordEncoder());
encoders.put("ldap", new org.springframework.security.crypto.password.LdapShaPasswordEncoder());
encoders.put("MD4", new org.springframework.security.crypto.password.Md4PasswordEncoder());
encoders.put("MD5", new org.springframework.security.crypto.password.MessageDigestPasswordEncoder("MD5"));
encoders.put("noop", org.springframework.security.crypto.password.NoOpPasswordEncoder.getInstance());
encoders.put("pbkdf2", new Pbkdf2PasswordEncoder());
encoders.put("scrypt", new SCryptPasswordEncoder());
encoders.put("SHA-1", new org.springframework.security.crypto.password.MessageDigestPasswordEncoder("SHA-1"));
encoders.put("SHA-256", new org.springframework.security.crypto.password.MessageDigestPasswordEncoder("SHA-256"));
encoders.put("sha256", new org.springframework.security.crypto.password.StandardPasswordEncoder());

return new DelegatingPasswordEncoder(encodingId, encoders);
}