5.spring security 新增校验方式(验证码登录)

项目地址:https://github.com/liangjinquan17/spring-security-demo
简要:新增校验方式主要是通过实现TokenGranter、AuthenticationProvider和Authentication接口。当然他们都有现成的抽象类或者具体类，你也可以选择分别继承他们然后重写部分方法

1.第一步实现校验类（实现Authentication接口，这类贯穿TokenGranter和AuthenticationProvider）

import java.util.Collection;
import java.util.List;

import org.springframework.security.core.Authentication;
import org.springframework.security.core.GrantedAuthority;

public class MyAuthentication implements Authentication {
    
    private static final long serialVersionUID = -9095353071305602273L;
    
    public MyAuthentication(String name, List authenrities, Object credentials, Object details, Object principal, boolean isAuthenticated) {
        this.name = name;
        this.authenrities = authenrities;
        this.credentials = credentials;
        this.details = details;
        this.principal = principal;
        this.isAuthenticated = isAuthenticated;
    }
    
    private String name;
    private List authenrities;
    private Object credentials;
    private Object details;
    private Object principal;
    private boolean isAuthenticated = false;
    

    @Override
    public String getName() {
        // TODO Auto-generated method stub
        return name;
    }

    @Override
    public Collection getAuthorities() {
        // TODO Auto-generated method stub
        return authenrities;
    }

    @Override
    public Object getCredentials() {
        // TODO Auto-generated method stub
        return credentials;
    }

    @Override
    public Object getDetails() {
        // TODO Auto-generated method stub
        return details;
    }

    @Override
    public Object getPrincipal() {
        // TODO Auto-generated method stub
        return principal;
    }

    @Override
    public boolean isAuthenticated() {
        // TODO Auto-generated method stub
        return isAuthenticated;
    }

    @Override
    public void setAuthenticated(boolean isAuthenticated) throws IllegalArgumentException {
        // TODO Auto-generated method stub
        this.isAuthenticated = isAuthenticated;
    }

}

2.第二步实现TokenGranter,并且添加到配置里面去。
2.1 我们新建一个MyTokenGranter类实现验证码登录功能,校验方式为：verificationCode，如图:

image.png

import java.util.LinkedHashMap;
import java.util.Map;

import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.core.Authentication;
import org.springframework.security.oauth2.common.OAuth2AccessToken;
import org.springframework.security.oauth2.provider.OAuth2Authentication;
import org.springframework.security.oauth2.provider.OAuth2Request;
import org.springframework.security.oauth2.provider.TokenGranter;
import org.springframework.security.oauth2.provider.TokenRequest;
import org.springframework.security.oauth2.provider.token.AuthorizationServerTokenServices;

public class MyTokenGranter implements TokenGranter{
    
    private String grantType = "verificationCode";
    
    private AuthenticationManager authenticationManager;
    private AuthorizationServerTokenServices tokenServices;
    
    public MyTokenGranter(AuthenticationManager authenticationManager, AuthorizationServerTokenServices tokenServices) {
        this.authenticationManager = authenticationManager;
        this.tokenServices = tokenServices;
    }

    @SuppressWarnings("deprecation")
    @Override
    public OAuth2AccessToken grant(String grantType, TokenRequest tokenRequest) {
        if(!this.grantType.equals(grantType)) {
            return null;
        }
        
        Map parameters = new LinkedHashMap(tokenRequest.getRequestParameters());
        String username = parameters.get("username");
        String code = parameters.get("code");
        
        if(!"123456".equals(code)) {return null;}
        
        // todo 调用校验列表校验登录数据
        Authentication authentication = new MyAuthentication(username, null, username, null, null, false);
        authentication = authenticationManager.authenticate(authentication);
        if(null == authentication) {
            return null;
        }
        // todo 校验成功后，通过tokenservice生成token
        return tokenServices.createAccessToken(new OAuth2Authentication(
                new OAuth2Request(null, "client", null, true, null, null, null, null, null), authentication));
    }
}

2.2 添加校验方式到配置类里面去。

image.png

3.第三步，增加校验提供类，来验证新增的校验方式，
其中方法authenticate的逻辑可以自定义

image.png

截图框柱的表示用这个校验类来校验

import org.springframework.security.authentication.AuthenticationProvider;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.AuthenticationException;

public class MyAuthenticationProvider implements AuthenticationProvider {
    

    @Override
    public Authentication authenticate(Authentication authentication) throws AuthenticationException {
        // TODO Auto-generated method stub
        // todo 要经过UserDetailsService的校验，这里就不写了？！
        // todo 返回校验成功案例
        authentication.setAuthenticated(true);
        return authentication;
    }

    @Override
    public boolean supports(Class authentication) {
        // TODO Auto-generated method stub
        return MyAuthentication.class.isAssignableFrom(authentication);
    }

}

新增完后添加到校验组合里面去。

image.png

然后启动项目，调用verificationCode校验方式来登录就可以了

image.png