若依系统中增加短信登录

首先需要明白AuthenticationManager和UserDetailsService的关系：
https://blog.csdn.net/feng905001561/article/details/119868411
了解过后就开始编写短信登录所需要的东西，基本上都是仿着账号密码登录的东西去写的

添加用户验证所执行的方法

@Service
public class SmsUserDetailsServiceImpl implements UserDetailsService
{
    private static final Logger log = LoggerFactory.getLogger(SmsUserDetailsServiceImpl.class);

    @Autowired
    private ISysUserService userService;

    @Autowired
    private SysPermissionService permissionService;

    @Override
    public UserDetails loadUserByUsername(String phone) throws UsernameNotFoundException
    {
        // 根据手机号查询用户的方法
        SysUser user = userService.selectUserByPhonenumber(phone);
        if (StringUtils.isNull(user))
        {
            log.info("登录手机号：{} 不存在.", phone);
            throw new UsernameNotFoundException("登录手机号：" + phone + " 不存在");
        }
        else if (UserStatus.DELETED.getCode().equals(user.getDelFlag()))
        {
            log.info("登录用户：{} 已被删除.", phone);
            throw new BaseException("对不起，您的账号：" + phone + " 已被删除");
        }
        else if (UserStatus.DISABLE.getCode().equals(user.getStatus()))
        {
            log.info("登录用户：{} 已被停用.", phone);
            throw new BaseException("对不起，您的账号：" + phone + " 已停用");
        }

        return createLoginUser(user);
    }

    public UserDetails createLoginUser(SysUser user)
    {
        return new LoginUser(user, permissionService.getMenuPermission(user));
    }

}

添加短信登录的鉴权过滤器

/**
 * 短信登录的鉴权过滤器，模仿 UsernamePasswordAuthenticationFilter 实现
 */
public class SmsAuthenticationFilter extends AbstractAuthenticationProcessingFilter {

    /**
     * 手机号码的字段name
     */
    public static final String SPRING_SECURITY_FORM_PHONE_KEY = "phonenumber";

    private String phoneParameter = SPRING_SECURITY_FORM_PHONE_KEY;

    private static final AntPathRequestMatcher DEFAULT_ANT_PATH_REQUEST_MATCHER = new AntPathRequestMatcher("/smsLogin", "POST");

    /**
     * 是否仅 POST 方式
     */
    private boolean postOnly = true;

    public SmsAuthenticationFilter() {
        super(DEFAULT_ANT_PATH_REQUEST_MATCHER);
    }

    public SmsAuthenticationFilter(AuthenticationManager authenticationManager) {
        super(DEFAULT_ANT_PATH_REQUEST_MATCHER, authenticationManager);
    }

    @Override
    public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response) throws AuthenticationException, IOException, ServletException {
        if (postOnly && !request.getMethod().equals("POST")) {
            throw new AuthenticationServiceException(
                    "Authentication method not supported: " + request.getMethod());
        }

        String phone = obtainPhone(request);

        if (phone == null) {
            phone = "";
        }

        phone = phone.trim();

        SmsAuthenticationToken authRequest = new SmsAuthenticationToken(phone);

        // Allow subclasses to set the "details" property
        setDetails(request, authRequest);

        return this.getAuthenticationManager().authenticate(authRequest);
    }

    @Nullable
    protected String obtainPhone(HttpServletRequest request) {
        return request.getParameter(phoneParameter);
    }

    protected void setDetails(HttpServletRequest request, SmsAuthenticationToken authRequest) {
        authRequest.setDetails(authenticationDetailsSource.buildDetails(request));
    }

    public String getPhoneParameter() {
        return phoneParameter;
    }

    public void setPhoneParameter(String phoneParameter) {
        Assert.hasText(phoneParameter, "Phone parameter must not be empty or null");
        this.phoneParameter = phoneParameter;
    }

    public void setPostOnly(boolean postOnly) {
        this.postOnly = postOnly;
    }
}

添加短信认证Token

/**
 * 短信登录 AuthenticationToken，模仿 UsernamePasswordAuthenticationToken 实现
 */
public class SmsAuthenticationToken extends AbstractAuthenticationToken {

    private static final long serialVersionUID = SpringSecurityCoreVersion.SERIAL_VERSION_UID;

    /**
     * 在 UsernamePasswordAuthenticationToken 中该字段代表登录的用户名，
     * 在这里就代表登录的手机号码
     */
    private final Object principal;

    public SmsAuthenticationToken(Object principal) {
        super(null);
        this.principal = principal;
        super.setAuthenticated(true);
    }

    public SmsAuthenticationToken(Object principal, Collection<? extends GrantedAuthority> authorities) {
        super(authorities);
        this.principal = principal;
        super.setAuthenticated(true);
    }

    @Override
    public Object getCredentials() {
        return null;
    }

    @Override
    public Object getPrincipal() {
        return this.principal;
    }

    @Override
    public void setAuthenticated(boolean isAuthenticated) throws IllegalArgumentException {
        Assert.isTrue(!isAuthenticated, "Cannot set this token to trusted - use constructor which takes a GrantedAuthority list instead");
        super.setAuthenticated(false);
    }

    @Override
    public void eraseCredentials() {
        super.eraseCredentials();
    }
}

添加短信登录的鉴权认证器

/**
 * 短信登录的鉴权认证器，模仿 AbstractUserDetailsAuthenticationProvider 实现
 */
public class SmsAuthenticationProvider implements AuthenticationProvider {

    protected final Log logger = LogFactory.getLog(this.getClass());
    protected MessageSourceAccessor messages = SpringSecurityMessageSource.getAccessor();

    private SmsUserDetailsServiceImpl userDetailsService;

    @Override
    public Authentication authenticate(Authentication authentication) throws AuthenticationException {
        Assert.isInstanceOf(SmsAuthenticationToken.class, authentication, () ->
                this.messages.getMessage("AbstractSmsCodeAuthenticationProvider.onlySupports", "Only SmsCodeAuthenticationToken is supported"));

        SmsAuthenticationToken authenticationToken = (SmsAuthenticationToken) authentication;
        // 手机号
        String phone = (String) authenticationToken.getPrincipal();
        // 查询用户信息
        UserDetails userDetails = userDetailsService.loadUserByUsername(phone);

        SmsAuthenticationToken authenticationResult = new SmsAuthenticationToken(userDetails, userDetails.getAuthorities());
        authenticationResult.setDetails(authenticationToken.getDetails());
        this.logger.debug("Authenticated user");
        return authenticationResult;
    }

    @Override
    public boolean supports(Class<?> authentication) {
        // 判断 authentication 是不是 SmsCodeAuthenticationToken 的子类或子接口
        return SmsAuthenticationToken.class.isAssignableFrom(authentication);
    }

    public UserDetailsService getUserDetailsService() {
        return userDetailsService;
    }

    public void setUserDetailsService(SmsUserDetailsServiceImpl userDetailsService) {
        this.userDetailsService = userDetailsService;
    }
}

添加短信认证配置

/**
 * 短信认证配置
 */
@Component
public class SmsAuthenticationSecurityConfig extends SecurityConfigurerAdapter<DefaultSecurityFilterChain, HttpSecurity> {

    @Autowired
    private SmsUserDetailsServiceImpl userDetailsService;

    @Override
    public void configure(HttpSecurity http) {
        // 实例化认证器
        SmsAuthenticationProvider smsAuthenticationProvider = new SmsAuthenticationProvider();
        // 设置认证器 SmsUserDetailsServiceImpl
        smsAuthenticationProvider.setUserDetailsService(userDetailsService);
        http.authenticationProvider(smsAuthenticationProvider);
    }
}

在SecurityConfig中使用改配置，并放行你的登录方法

添加短信登录的方法

/**
 * 短信登录
 *
 * @param phonenumber 手机号
 * @param code        验证码
 * @return 结果
 */
public String smsLogin(String phonenumber, String code) {
    // 用户验证
    Authentication authentication;
    // 用户信息
    LoginUser loginUser;
    try {
        // 该方法会去调用SmsUserDetailsServiceImpl.loadUserByUsername
        authentication = authenticationManager.authenticate(new SmsAuthenticationToken(phonenumber));
        loginUser = (LoginUser) authentication.getPrincipal();
        // 验证码校验
        checkSms(phonenumber, code);
    } catch (Exception e) {
        AsyncManager.me().execute(AsyncFactory.recordLogininfor(phonenumber, Constants.LOGIN_FAIL, e.getMessage()));
        throw new ServiceException(e.getMessage());
    }
    AsyncManager.me().execute(AsyncFactory.recordLogininfor(loginUser.getUsername(), Constants.LOGIN_SUCCESS, MessageUtils.message("user.login.success")));
    // 记录登录信息
    recordLoginInfo(loginUser.getUserId());
    // 删除验证码缓存
    redisCache.deleteObject(String.format("sms_captcha_code:%s", phonenumber));
    // 生成token
    return tokenService.createToken(loginUser);
}

/**
  * 检查手机号登录
  *
  * @param phone 手机号
  * @param code 验证码
  */
private void checkSms(String phone, String code) {

  String verifyKey = String.format("sms_captcha_code:%s", phone);

  String smsCode = redisCache.getCacheObject(verifyKey);
  if (StringUtils.isEmpty(code)) {
      throw new BadCredentialsException("验证码不能为空");
  }
  if (StringUtils.isEmpty(smsCode)) {
      throw new BadCredentialsException("验证码失效");
  }
  if (!code.equals(smsCode)) {
      throw new BadCredentialsException("验证码错误");
  }
}