Spring boot整合Spring Security实现验证码登陆
验证码登陆在日常使用软件中是很常见的，甚至可以说超过了密码登陆。
如何通过Spring Security框架实现验证码登陆，并且登陆成功之后也同样返回和密码登陆类似的token？
- 先看一张Spring Security拦截请求的流程图
可以发现Spring Security默认有用户名密码登陆拦截器，查看 UsernamePasswordAuthenticationFilter 实现了 AbstractAuthenticationProcessingFilter类 。根据UsernamePasswordAuthenticationFilter的设计模式可以在Spring security的基础上拓展自己的拦截器，实现相应的功能。
- 新增一个 SmsCodeAuthenticationToken 实体类，需要继承IrhAuthenticationToken，而IrhAuthenticationToken继承了 AbstractAuthenticationToken 用来封装验证码登陆时需要的信息，并且自定义一个AuthenticationToken的父类的作用就是用来在管理在具有多种登陆方式的系统中，能记录最核心的两个信息，一个是用户身份，一个是登陆口令；并且在后期能直接向上转型而不报错。
package top.imuster.auth.config;
import org.springframework.security.core.GrantedAuthority;
import java.util.Collection;
/**
* @ClassName: SmsCodeAuthenticationToken
* @Description: 验证码登录验证信息封装类
* @author: hmr
* @date: 2020/4/30 13:59
*/
public class SmsCodeAuthenticationToken extends IrhAuthenticationToken {
public SmsCodeAuthenticationToken(Object principal, Object credentials) {
super(principal, credentials);
}
public SmsCodeAuthenticationToken(Object principal, Object credentials, Collection<? extends GrantedAuthority> authorities) {
super(principal, credentials, authorities);
}
}
package top.imuster.auth.config;
import org.springframework.security.authentication.AbstractAuthenticationToken;
import org.springframework.security.core.GrantedAuthority;
import java.util.Collection;
/**
* @Author hmr
* @Description 自定义AbstractAuthenticationToken
* @Date: 2020/5/1 13:51
* @param irh平台的认证实体类 可以通过继承该类来实现不同的登录逻辑
* @reture:
**/
public class IrhAuthenticationToken extends AbstractAuthenticationToken {
private static final long serialVersionUID = 110L;
//用户信息
protected final Object principal;
//密码或者邮箱验证码
protected Object credentials;
/**
* This constructor can be safely used by any code that wishes to create a
* <code>UsernamePasswordAuthenticationToken</code>, as the {@link
* #isAuthenticated()} will return <code>false</code>.
*
*/
public IrhAuthenticationToken(Object principal, Object credentials) {
super(null);
this.principal = principal;
this.credentials = credentials;
this.setAuthenticated(false);
}
/**
* This constructor should only be used by <code>AuthenticationManager</code> or <code>AuthenticationProvider</code>
* implementations that are satisfied with producing a trusted (i.e. {@link #isAuthenticated()} = <code>true</code>)
* token token.
*
* @param principal
* @param credentials
* @param authorities
*/
public IrhAuthenticationToken(Object principal, Object credentials, Collection<? extends GrantedAuthority> authorities) {
super(authorities);
this.principal = principal;
this.credentials = credentials;
super.setAuthenticated(true);
}
@Override
public Object getCredentials() {
return this.credentials;
}
@Override
public Object getPrincipal() {
return this.principal;
}
public void setAuthenticated(boolean isAuthenticated) throws IllegalArgumentException {
if(isAuthenticated) {
throw new IllegalArgumentException("Cannot set this token to trusted - use constructor which takes a GrantedAuthority list instead");
} else {
super.setAuthenticated(false);
}
}
public void eraseCredentials() {
super.eraseCredentials();
this.credentials = null;
}
}
- 继承AbstractAuthenticationProcessingFilter之后就可以将自定义的Filter假如到过滤器链中。所以自定义一个 SmsAuthenticationFilter 类并且继承 AbstractAuthenticationProcessingFilter 类，并且该Filter中只校验输入参数是否正确，如果不完整，则抛出 AuthenticationServiceException异常，如果抛出自定义异常，会被Security框架处理。用原生异常可以设置异常信息，直接返回给前端。
package top.imuster.auth.component.login;
import org.apache.commons.lang3.StringUtils;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.authentication.AuthenticationServiceException;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.AuthenticationException;
import org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter;
import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
import top.imuster.auth.config.SecurityConstants;
import top.imuster.auth.config.SmsCodeAuthenticationToken;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
/**
* @ClassName: SmsCodeAuthenticationFilter
* @Description: 自定义拦截器，拦截登录请求中的登录类型
* @author: hmr
* @date: 2020/4/30 12:16
*/
public class SmsCodeAuthenticationFilter extends AbstractAuthenticationProcessingFilter {
private static final Logger log = LoggerFactory.getLogger(SmsCodeAuthenticationFilter.class);
private static final String POST = "post";
private boolean postOnly = true;
public SmsCodeAuthenticationFilter(){
super(new AntPathRequestMatcher("/emailCodeLogin", "POST"));
}
@Autowired
AuthenticationManager authenticationManager;
@Override
@Autowired
public void setAuthenticationManager(AuthenticationManager authenticationManager) {
super.setAuthenticationManager(authenticationManager);
}
@Override
public Authentication attemptAuthentication(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse) throws AuthenticationException, IOException, ServletException {
if(postOnly && !POST.equalsIgnoreCase(httpServletRequest.getMethod())){
throw new AuthenticationServiceException("不允许{}这种的请求方式: " + httpServletRequest.getMethod());
}
//邮箱地址
String loginName = obtainParameter(httpServletRequest, SecurityConstants.LOGIN_PARAM_NAME);
//验证码
String credentials = obtainParameter(httpServletRequest, SecurityConstants.EMAIL_VERIFY_CODE);
loginName = loginName.trim();
if(StringUtils.isBlank(loginName)) throw new AuthenticationServiceException("登录名不能为空");
if(StringUtils.isBlank(credentials)) throw new AuthenticationServiceException("验证码不能为空");
SmsCodeAuthenticationToken authenticationToken = new SmsCodeAuthenticationToken(loginName, credentials); //将输入的信息封装成一个SmsCodeAuthenicationToken对象，并向后传递
setDetails(httpServletRequest, authenticationToken);
return authenticationManager.authenticate(authenticationToken);
}
private void setDetails(HttpServletRequest request,
SmsCodeAuthenticationToken authRequest) {
authRequest.setDetails(authenticationDetailsSource.buildDetails(request));
}
/**
* @Author hmr
* @Description 从request中获得参数
* @Date: 2020/4/30 12:22
* @param request
* @reture: java.lang.String
**/
protected String obtainParameter(HttpServletRequest request, String type){
return request.getParameter(type);
}
}
- 设置了Filter拦截到登陆请求之后，还需要一个具体的校验验证码是否正确的类 SmsAuthenticationProvider，该类才是具体的业务代码
package top.imuster.auth.component.login;
import org.apache.commons.lang3.StringUtils;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.data.redis.core.RedisTemplate;
import org.springframework.security.authentication.AuthenticationProvider;
import org.springframework.security.authentication.AuthenticationServiceException;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.AuthenticationException;
import top.imuster.auth.config.SmsCodeAuthenticationToken;
import top.imuster.common.core.utils.RedisUtil;
/**
* @ClassName: IrhAuthenticationProvider
* @Description: IrhAuthenticationProvider
* @author: hmr
* @date: 2020/4/30 14:36
*/
public class SmsAuthenticationProvider implements AuthenticationProvider {
private final Logger log = LoggerFactory.getLogger(this.getClass());
@Autowired
RedisTemplate redisTemplate;
@Override
public Authentication authenticate(Authentication authentication) throws AuthenticationException {
SmsCodeAuthenticationToken authenticationToken = (SmsCodeAuthenticationToken) authentication; //先将authentication强转成SmsCodeAuthenticationToken
//登录名
String loginName = authenticationToken.getPrincipal() == null?"NONE_PROVIDED":authentication.getName();
//验证码
String verify = (String)authenticationToken.getCredentials();
String redisCode = (String)redisTemplate.opsForValue().get(RedisUtil.getConsumerLoginByEmail(loginName)); //从redis中获得申请到的验证码
if(StringUtils.isEmpty(redisCode) || !verify.equalsIgnoreCase(redisCode)){
throw new AuthenticationServiceException("验证码失效或者错误");
}
return authentication;
}
@Override
public boolean supports(Class<?> aClass) {
return (SmsCodeAuthenticationToken.class.isAssignableFrom(aClass));
}
}
并且在一个继承了 WebSecurityConfigurerAdapter的类中将Filter和Provide声明成Bean
package top.imuster.auth.config;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.core.annotation.Order;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.authentication.ProviderManager;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.builders.WebSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import top.imuster.auth.component.login.*;
import top.imuster.auth.service.Impl.UsernameUserDetailsServiceImpl;
import java.util.Arrays;
@Configuration
@EnableWebSecurity
@Order(2147483636)
class WebSecurityConfig extends WebSecurityConfigurerAdapter {
@Bean
public SmsCodeAuthenticationFilter smsCodeAuthenticationFilter(){
SmsCodeAuthenticationFilter smsCodeAuthenticationFilter = new SmsCodeAuthenticationFilter();
try {
smsCodeAuthenticationFilter.setAuthenticationManager(this.authenticationManager());
} catch (Exception e) {
e.printStackTrace();
}
smsCodeAuthenticationFilter.setAuthenticationSuccessHandler(irhAuthenticationSuccessHandler());
smsCodeAuthenticationFilter.setAuthenticationFailureHandler(irhAuthenticationFailHandler());
return smsCodeAuthenticationFilter;
}
@Bean
public SmsAuthenticationProvider smsAuthenticationProvider(){
SmsAuthenticationProvider provider = new SmsAuthenticationProvider();
// 设置userDetailsService
// 禁止隐藏用户未找到异常
return provider;
}
@Bean
@Override
public AuthenticationManager authenticationManager() throws Exception {
ProviderManager authenticationManager = new ProviderManager(Arrays.asList(smsAuthenticationProvider()));
return authenticationManager;
}
}
说明：Filter是用来拦截Request请求，并且从request请求中将指定的信息提取出来，判断一些必要信息是否存在，不对信息进行校验，校验信息合法之后将其封装到token中，向后传递给provide如；provider则
将filter中得到的信息进行校验，在provider中，主要要注意的就是需要重写 supports(Class<?> aClass) 方法，该方法的作用就是假如在系统中有多个filter，并且向后传递了多个不同的token，那么对应的token只能传递到对应的provider中，所以该方法返回到是一个boolean类型，用来给Spring Security决策是否需要进入该provider。
- 获取验证码
/**
* @Author hmr
* @Description 发送email验证码
* @Date: 2020/4/30 10:12
* @param email 接受code的邮箱
* @param type 1-注册 2-登录 3-忘记密码
* @reture: top.imuster.common.base.wrapper.Message<java.lang.String>
**/
@ApiOperation(value = "发送email验证码",httpMethod = "GET")
@Idempotent(submitTotal = 5, timeTotal = 30, timeUnit = TimeUnit.MINUTES)
@GetMapping("/sendCode/{type}/{email}")
public Message<String> getCode(@ApiParam("邮箱地址") @PathVariable("email") String email, @PathVariable("type") Integer type) throws Exception {
if(type != 1 && type != 2 && type != 3 && type != 4){
return Message.createByError("参数异常,请刷新后重试");
}
userLoginService.getCode(email, type);
return Message.createBySuccess();
}
具体代码我已经开源到GitHub上，仓库地址为https://github.com/HMingR/irh，该项目中还有利用Spring security实现微信小程序登陆，用户名密码登陆等。
