|
|
|
|
|
|
|
|
package com.tuoheng.config; |
|
|
package com.tuoheng.config; |
|
|
|
|
|
|
|
|
|
|
|
import com.tuoheng.exception.DiyException; |
|
|
import com.tuoheng.oauth2.authentication.OAuth2ResourceOwnerPasswordAuthenticationConverter; |
|
|
import com.tuoheng.oauth2.authentication.OAuth2ResourceOwnerPasswordAuthenticationConverter; |
|
|
import com.tuoheng.handler.AccessDeniedHandler; |
|
|
import com.tuoheng.handler.AccessDeniedHandler; |
|
|
import com.tuoheng.mapper.UserMapper; |
|
|
import com.tuoheng.mapper.UserMapper; |
|
|
|
|
|
|
|
|
import org.springframework.security.config.annotation.web.configurers.oauth2.server.authorization.OAuth2AuthorizationServerConfigurer; |
|
|
import org.springframework.security.config.annotation.web.configurers.oauth2.server.authorization.OAuth2AuthorizationServerConfigurer; |
|
|
import org.springframework.security.config.annotation.web.configurers.oauth2.server.resource.OAuth2ResourceServerConfigurer; |
|
|
import org.springframework.security.config.annotation.web.configurers.oauth2.server.resource.OAuth2ResourceServerConfigurer; |
|
|
import org.springframework.security.core.userdetails.UserDetailsService; |
|
|
import org.springframework.security.core.userdetails.UserDetailsService; |
|
|
|
|
|
import org.springframework.security.oauth2.core.OAuth2AuthenticationException; |
|
|
import org.springframework.security.oauth2.core.OAuth2Token; |
|
|
import org.springframework.security.oauth2.core.OAuth2Token; |
|
|
import org.springframework.security.oauth2.core.oidc.OidcUserInfo; |
|
|
import org.springframework.security.oauth2.core.oidc.OidcUserInfo; |
|
|
import org.springframework.security.oauth2.server.authorization.OAuth2AuthorizationService; |
|
|
import org.springframework.security.oauth2.server.authorization.OAuth2AuthorizationService; |
|
|
|
|
|
|
|
|
OidcUserInfoAuthenticationToken authentication = context.getAuthentication(); |
|
|
OidcUserInfoAuthenticationToken authentication = context.getAuthentication(); |
|
|
JwtAuthenticationToken principal = (JwtAuthenticationToken) authentication.getPrincipal(); |
|
|
JwtAuthenticationToken principal = (JwtAuthenticationToken) authentication.getPrincipal(); |
|
|
UserBaseInfoDto userBaseInfoDto = userMapper.getUserBaseInfo(principal.getName()); |
|
|
UserBaseInfoDto userBaseInfoDto = userMapper.getUserBaseInfo(principal.getName()); |
|
|
|
|
|
// 在这里做校验 |
|
|
|
|
|
if (0 == userBaseInfoDto.getIsAble()) { |
|
|
|
|
|
throw new DiyException(1001, "该账号已被禁用,请联系系统管理员"); |
|
|
|
|
|
} |
|
|
|
|
|
if (0 == userBaseInfoDto.getIsExpire()) { |
|
|
|
|
|
throw new DiyException(1002, "系统有效期已过,请联系系统管理员"); |
|
|
|
|
|
} |
|
|
return oidcUserInfoService.loadUser(principal.getName(), context.getAccessToken().getScopes(), userBaseInfoDto); |
|
|
return oidcUserInfoService.loadUser(principal.getName(), context.getAccessToken().getScopes(), userBaseInfoDto); |
|
|
}; |
|
|
}; |
|
|
authorizationServerConfigurer.oidc((oidc) -> { |
|
|
authorizationServerConfigurer.oidc((oidc) -> { |
|
|
|
|
|
|
|
|
.authorizeRequests((authorizeRequests) -> { |
|
|
.authorizeRequests((authorizeRequests) -> { |
|
|
((ExpressionUrlAuthorizationConfigurer.AuthorizedUrl) authorizeRequests.anyRequest()).authenticated(); |
|
|
((ExpressionUrlAuthorizationConfigurer.AuthorizedUrl) authorizeRequests.anyRequest()).authenticated(); |
|
|
}).csrf((csrf) -> { |
|
|
}).csrf((csrf) -> { |
|
|
csrf.ignoringRequestMatchers(new RequestMatcher[]{endpointsMatcher}); |
|
|
|
|
|
}).apply(authorizationServerConfigurer) |
|
|
|
|
|
|
|
|
csrf.ignoringRequestMatchers(new RequestMatcher[]{endpointsMatcher}); |
|
|
|
|
|
}).apply(authorizationServerConfigurer) |
|
|
.and() |
|
|
.and() |
|
|
.oauth2ResourceServer(OAuth2ResourceServerConfigurer::jwt) |
|
|
.oauth2ResourceServer(OAuth2ResourceServerConfigurer::jwt) |
|
|
.exceptionHandling(exceptions -> exceptions |
|
|
.exceptionHandling(exceptions -> exceptions |
|
|
.authenticationEntryPoint(new LoginUrlAuthenticationEntryPoint("/toLogin")) |
|
|
.authenticationEntryPoint(new LoginUrlAuthenticationEntryPoint("/toLogin")) |
|
|
.accessDeniedHandler(new AccessDeniedHandler())) |
|
|
.accessDeniedHandler(new AccessDeniedHandler())) |
|
|
//.authenticationEntryPoint(new AuthenticationEntryPoint())) |
|
|
|
|
|
|
|
|
//.authenticationEntryPoint(new AuthenticationEntryPoint())) |
|
|
.apply(authorizationServerConfigurer); |
|
|
.apply(authorizationServerConfigurer); |
|
|
SecurityFilterChain securityFilterChain = http.build(); |
|
|
SecurityFilterChain securityFilterChain = http.build(); |
|
|
addCustomOAuth2ResourceOwnerPasswordAuthenticationProvider(http); |
|
|
addCustomOAuth2ResourceOwnerPasswordAuthenticationProvider(http); |
|
|
|
|
|
|
|
|
@Order(2) |
|
|
@Order(2) |
|
|
SecurityFilterChain defaultSecurityFilterChain(HttpSecurity http) throws Exception { |
|
|
SecurityFilterChain defaultSecurityFilterChain(HttpSecurity http) throws Exception { |
|
|
//http.addFilterBefore(verifyCodeFilter, UsernamePasswordAuthenticationFilter.class); |
|
|
//http.addFilterBefore(verifyCodeFilter, UsernamePasswordAuthenticationFilter.class); |
|
|
http.addFilterAt(new VerifyCodeFilter(),UsernamePasswordAuthenticationFilter.class); |
|
|
|
|
|
|
|
|
http.addFilterAt(new VerifyCodeFilter(), UsernamePasswordAuthenticationFilter.class); |
|
|
http.csrf().disable() |
|
|
http.csrf().disable() |
|
|
.authorizeHttpRequests((authorize) -> authorize |
|
|
.authorizeHttpRequests((authorize) -> authorize |
|
|
.antMatchers("/toLogin", "/getHealth", "/static/**", "/vercode").permitAll() |
|
|
.antMatchers("/toLogin", "/getHealth", "/static/**", "/vercode").permitAll() |
|
|
.antMatchers("/user/create","/user/getInfo").permitAll() |
|
|
|
|
|
|
|
|
.antMatchers("/user/create", "/user/getInfo").permitAll() |
|
|
.anyRequest().authenticated() |
|
|
.anyRequest().authenticated() |
|
|
) |
|
|
) |
|
|
// Form login handles the redirect to the login page from the |
|
|
// Form login handles the redirect to the login page from the |