Spring Security 初探

@RestController
@RequestMapping("/api")
public class HelloController {

    @GetMapping("/hello")
    public String hello() {
        return "Hello, spring security!";
    }
}

public interface AuthenticationManager {
	Authentication authenticate(Authentication authentication) throws AuthenticationException;
}

public interface AuthenticationProvider {
    
	Authentication authenticate(Authentication authentication) throws AuthenticationException;

	boolean supports(Class<?> authentication);
}

@ConfigurationProperties(prefix = "spring.security")
public class SecurityProperties {
	// 省略部分代码
	public static class User {
		private String name = "user";
		private String password = UUID.randomUUID().toString();
	}
}

spring.security.user.name=koril
spring.security.user.password=123456

@AutoConfiguration
@ConditionalOnClass(AuthenticationManager.class)
@ConditionalOnBean(ObjectPostProcessor.class)
@ConditionalOnMissingBean(
		value = { AuthenticationManager.class, AuthenticationProvider.class, UserDetailsService.class,
				AuthenticationManagerResolver.class },
		type = { "org.springframework.security.oauth2.jwt.JwtDecoder",
				"org.springframework.security.oauth2.server.resource.introspection.OpaqueTokenIntrospector",
				"org.springframework.security.oauth2.client.registration.ClientRegistrationRepository",
				"org.springframework.security.saml2.provider.service.registration.RelyingPartyRegistrationRepository" })
public class UserDetailsServiceAutoConfiguration {

	private static final String NOOP_PASSWORD_PREFIX = "{noop}";

	private static final Pattern PASSWORD_ALGORITHM_PATTERN = Pattern.compile("^\\{.+}.*$");

	private static final Log logger = LogFactory.getLog(UserDetailsServiceAutoConfiguration.class);

	@Bean
	@Lazy
	public InMemoryUserDetailsManager inMemoryUserDetailsManager(SecurityProperties properties,
			ObjectProvider<PasswordEncoder> passwordEncoder) {
         // 从 security properties 当中获取用户
		SecurityProperties.User user = properties.getUser();
		List<String> roles = user.getRoles();
         // 构建一个 InMemoryUserDetailsService
		return new InMemoryUserDetailsManager(User.withUsername(user.getName())
			.password(getOrDeducePassword(user, passwordEncoder.getIfAvailable()))
			.roles(StringUtils.toStringArray(roles))
			.build());
	}
}

@Configuration(proxyBeanMethods = false)
@ConditionalOnWebApplication(type = Type.SERVLET)
class SpringBootWebSecurityConfiguration {

	@Configuration(proxyBeanMethods = false)
	@ConditionalOnDefaultWebSecurity
	static class SecurityFilterChainConfiguration {

		@Bean
		@Order(SecurityProperties.BASIC_AUTH_ORDER)
		SecurityFilterChain defaultSecurityFilterChain(HttpSecurity http) throws Exception {
             // 对所有请求都进行认证
			http.authorizeRequests().anyRequest().authenticated();
             // 表单登录
			http.formLogin();
             // Http Basic 认证
			http.httpBasic();
			return http.build();
		}
	}
}

@Configuration
public class ProjectConfig {

    @Bean
    public UserDetailsService userDetailsService() {
        return new InMemoryUserDetailsManager();
    }
}

@Configuration
public class ProjectConfig {

    @Bean
    public UserDetailsService userDetailsService() {

        InMemoryUserDetailsManager userDetailsManager = new InMemoryUserDetailsManager();
        // 创建一个用户
        UserDetails user = User.withUsername("alice").password("123456").build();
        userDetailsManager.createUser(user);

        return userDetailsManager;
    }
}

@Configuration
public class ProjectConfig {

    @Bean
    public UserDetailsService userDetailsService() {

        InMemoryUserDetailsManager userDetailsManager = new InMemoryUserDetailsManager();
        // 创建一个用户
        UserDetails user = User.withUsername("alice").password("123456").authorities("read").build();
        userDetailsManager.createUser(user);

        return userDetailsManager;
    }
}

@Configuration
public class ProjectConfig {

    @Bean
    public UserDetailsService userDetailsService() {

        InMemoryUserDetailsManager userDetailsManager = new InMemoryUserDetailsManager();
        // 创建一个用户
        UserDetails user = User.withUsername("alice").password("123456").authorities("read").build();
        userDetailsManager.createUser(user);

        return userDetailsManager;
    }

    // 指定一个 PasswordEncoder
    @Bean
    public PasswordEncoder passwordEncoder() {
        // 绝不建议在生产环境使用 NoOpPasswordEncoder，因为它不会对密码进行加密，仅仅作为普通文本对待
        return NoOpPasswordEncoder.getInstance();
    }
}

@Configuration
public class ProjectConfig extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        // ...一些配置代码
    }
}

@Bean
public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
    // ...一些配置代码
    return http.build();
}

@Bean
public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
    // 不进行验证，统统放行
    http.authorizeRequests().anyRequest().permitAll();
    return http.build();
}

@Component
public class CustomAuthenticationProvider implements AuthenticationProvider {
    @Override
    public Authentication authenticate(Authentication authentication) throws AuthenticationException {

        String username = authentication.getName();
        String password = (String) authentication.getCredentials();

        // 自定义身份验证的逻辑
        if ("bob".equals(username) && "123456".equals(password)) {
            return new UsernamePasswordAuthenticationToken(username, password, new HashSet<>());
        }

        throw new AuthenticationCredentialsNotFoundException("authentication error!");
    }

    @Override
    public boolean supports(Class<?> authentication) {
        return UsernamePasswordAuthenticationToken.class.isAssignableFrom(authentication);
    }
}

@Configuration
public class UserManagementConfig {


    @Bean
    public UserDetailsService userDetailsService() {
        InMemoryUserDetailsManager userDetailsManager = new InMemoryUserDetailsManager();
        // 创建一个用户
        UserDetails user = User.withUsername("alice").password("123456").authorities("read").build();
        userDetailsManager.createUser(user);

        return userDetailsManager;
    }

    @Bean
    public PasswordEncoder passwordEncoder() {
        return NoOpPasswordEncoder.getInstance();
    }
}

@Configuration
public class WebAuthenticationConfig {

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http.httpBasic();
        http.authorizeRequests().anyRequest().authenticated();
        return http.build();
    }

}

public interface UserDetailsService {
    
    // UserDetailsService 仅仅有一个方法，接收一个用户名，返回一个完整的 user record，返回值永远不会是 null
    // 如果无法根据 username 找到对应的用户信息，那么就会抛出 UsernameNotFoundException 的异常
    UserDetails loadUserByUsername(String username) throws UsernameNotFoundException;
}

public interface UserDetailsManager extends UserDetailsService {

	/**
	 * 创建一个 user
	 */
	void createUser(UserDetails user);

	/**
	 * 更新一个 user
	 */
	void updateUser(UserDetails user);

	/**
	 * 删除一个 
	 */
	void deleteUser(String username);

	/**
	 * 更改当前用户的密码
	 */
	void changePassword(String oldPassword, String newPassword);

	/**
	 * 检查用户是否存在于系统中
	 */
	boolean userExists(String username);

}

public interface UserDetails extends Serializable {

	/**
	 * 返回授予用户的权限，返回值不会为 null
	 */
	Collection<? extends GrantedAuthority> getAuthorities();

	/**
	 * 返回用于验证用户身份的密码
	 */
	String getPassword();

	/**
	 * 返回用于验证用户身份的用户名
	 */
	String getUsername();

	/**
	 * 表示账号是否过期，过期的账号无法通过验证
	 * true: 没过期，正常通过验证
	 * false: 过期账号，无法通过验证
	 */
	boolean isAccountNonExpired();

	/**
	 * 表示账号是否被锁定，锁定的账号无法通过验证
	 * true: 未锁定，正常通过验证
	 * false: 被锁定，无法通过验证
	 */
	boolean isAccountNonLocked();

	/**
	 * 表示凭据是否过期，过期的凭据无法通过验证
	 * true: 凭据未过期，正常通过验证
	 * false: 凭据已过期，无法通过验证
	 */
	boolean isCredentialsNonExpired();

	/**
	 * 表示账号是否启用，非启用账号无法通过验证
	 * true: 启用，正常通过验证
	 * false: 未启用，无法通过验证
	 */
	boolean isEnabled();

}

public interface GrantedAuthority extends Serializable {

	/**
	 * 获取权限的名称
	 */
	String getAuthority();

}

GrantedAuthority authority1 = () -> "READ";
GrantedAuthority authority2 = new SimpleGrantedAuthority("WRITE");