|
|
@@ -0,0 +1,139 @@
|
|
|
+package com.uas.platform.click.config;
|
|
|
+
|
|
|
+import com.uas.platform.click.util.RequestUtil;
|
|
|
+import com.uas.platform.click.web.ResponseWrap;
|
|
|
+import org.springframework.beans.factory.annotation.Autowired;
|
|
|
+import org.springframework.context.MessageSource;
|
|
|
+import org.springframework.context.annotation.Bean;
|
|
|
+import org.springframework.context.annotation.Configuration;
|
|
|
+import org.springframework.context.i18n.LocaleContextHolder;
|
|
|
+import org.springframework.http.HttpStatus;
|
|
|
+import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
|
|
|
+import org.springframework.security.config.annotation.web.builders.HttpSecurity;
|
|
|
+import org.springframework.security.config.annotation.web.builders.WebSecurity;
|
|
|
+import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
|
|
|
+import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
|
|
|
+import org.springframework.security.config.http.SessionCreationPolicy;
|
|
|
+import org.springframework.security.core.Authentication;
|
|
|
+import org.springframework.security.core.AuthenticationException;
|
|
|
+import org.springframework.security.web.AuthenticationEntryPoint;
|
|
|
+import org.springframework.security.web.authentication.AuthenticationFailureHandler;
|
|
|
+import org.springframework.security.web.authentication.AuthenticationSuccessHandler;
|
|
|
+import org.springframework.security.web.util.matcher.AnyRequestMatcher;
|
|
|
+import org.springframework.session.ExpiringSession;
|
|
|
+import org.springframework.session.MapSessionRepository;
|
|
|
+import org.springframework.session.SessionRepository;
|
|
|
+import org.springframework.ui.ModelMap;
|
|
|
+
|
|
|
+import javax.servlet.ServletException;
|
|
|
+import javax.servlet.http.HttpServletRequest;
|
|
|
+import javax.servlet.http.HttpServletResponse;
|
|
|
+import java.io.IOException;
|
|
|
+
|
|
|
+/**
|
|
|
+ * Created by Pro1 on 2017/6/20.
|
|
|
+ */
|
|
|
+@Configuration
|
|
|
+@EnableWebSecurity
|
|
|
+public class WebSecurityConfig extends WebSecurityConfigurerAdapter{
|
|
|
+
|
|
|
+ @Autowired
|
|
|
+ private MessageSource messageSource;
|
|
|
+
|
|
|
+ @Bean
|
|
|
+ public SessionRepository<ExpiringSession> sessionRepository() {
|
|
|
+ return new MapSessionRepository();
|
|
|
+ }
|
|
|
+
|
|
|
+ @Override
|
|
|
+ public void configure(WebSecurity web) throws Exception {
|
|
|
+ web.ignoring().antMatchers("/resources/**", "/static/**", "/public/**",
|
|
|
+ "/html/**", "/css/**", "/js/**", "**/*.css", "**/*.js");
|
|
|
+ }
|
|
|
+
|
|
|
+ @Override
|
|
|
+ public void configure(HttpSecurity http) throws Exception {
|
|
|
+ http.authorizeRequests()
|
|
|
+ .antMatchers("/dashboard/login", "/v1/redirect", "/v1/wrap")
|
|
|
+ .permitAll()
|
|
|
+ .anyRequest()
|
|
|
+ .authenticated()
|
|
|
+ .and()
|
|
|
+ .formLogin()
|
|
|
+ .loginProcessingUrl("/dashboard/login")
|
|
|
+ .successHandler(authenticationSuccessHandler())
|
|
|
+ .failureHandler(authenticationFailureHandler())
|
|
|
+ .and()
|
|
|
+ .exceptionHandling()
|
|
|
+ .defaultAuthenticationEntryPointFor(jsonAuthenticationEntryPoint(), AnyRequestMatcher.INSTANCE)
|
|
|
+ .and()
|
|
|
+ .logout()
|
|
|
+ .logoutUrl("/dashboard/logout")
|
|
|
+ .and()
|
|
|
+ .csrf()
|
|
|
+ .disable()
|
|
|
+ .sessionManagement()
|
|
|
+ .sessionCreationPolicy(SessionCreationPolicy.IF_REQUIRED);
|
|
|
+ }
|
|
|
+
|
|
|
+ /**
|
|
|
+ * 登录成功时
|
|
|
+ * @return
|
|
|
+ */
|
|
|
+ @Bean
|
|
|
+ public AuthenticationSuccessHandler authenticationSuccessHandler() {
|
|
|
+ return new AuthenticationSuccessHandler() {
|
|
|
+ @Override
|
|
|
+ public void onAuthenticationSuccess(HttpServletRequest request, HttpServletResponse response, Authentication authentication) throws IOException, ServletException {
|
|
|
+ Object returnUrl = request.getSession().getAttribute(RETURN_URL);
|
|
|
+ if (null == returnUrl || returnUrl.toString().matches(".*\\/dashboard\\/login")) {
|
|
|
+ returnUrl = "/dashboard";
|
|
|
+ }
|
|
|
+ if (RequestUtil.isAjax(request)) {
|
|
|
+ ResponseWrap.ok(response, new ModelMap(RETURN_URL, returnUrl));
|
|
|
+ } else {
|
|
|
+ response.sendRedirect(returnUrl.toString());
|
|
|
+ }
|
|
|
+ }
|
|
|
+ };
|
|
|
+ }
|
|
|
+
|
|
|
+ /**
|
|
|
+ * 登录失败时
|
|
|
+ * @return
|
|
|
+ */
|
|
|
+ @Bean
|
|
|
+ public AuthenticationFailureHandler authenticationFailureHandler() {
|
|
|
+ return new AuthenticationFailureHandler() {
|
|
|
+ public void onAuthenticationFailure(HttpServletRequest request, HttpServletResponse response, AuthenticationException exception) throws IOException, ServletException {
|
|
|
+ ResponseWrap.badRequest(response, messageSource.getMessage("AbstractUserDetailsAuthenticationProvider.badCredentials", null, LocaleContextHolder.getLocale()));
|
|
|
+ }
|
|
|
+ };
|
|
|
+ }
|
|
|
+
|
|
|
+ final static String RETURN_URL = "returnUrl";
|
|
|
+
|
|
|
+ /**
|
|
|
+ * 身份信息验证失败时
|
|
|
+ * @return
|
|
|
+ */
|
|
|
+ @Bean
|
|
|
+ public AuthenticationEntryPoint jsonAuthenticationEntryPoint() {
|
|
|
+ return new AuthenticationEntryPoint() {
|
|
|
+ @Override
|
|
|
+ public void commence(HttpServletRequest request, HttpServletResponse response, AuthenticationException e) throws IOException, ServletException {
|
|
|
+ if (RequestUtil.isAjax(request)) {
|
|
|
+ ResponseWrap.badRequest(response, HttpStatus.UNAUTHORIZED.value(), HttpStatus.UNAUTHORIZED.getReasonPhrase());
|
|
|
+ } else {
|
|
|
+ request.getSession().setAttribute(RETURN_URL, RequestUtil.getUri(request));
|
|
|
+ response.sendRedirect("/dashboard/login");
|
|
|
+ }
|
|
|
+ }
|
|
|
+ };
|
|
|
+ }
|
|
|
+
|
|
|
+ @Autowired
|
|
|
+ public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
|
|
|
+ auth.inMemoryAuthentication().withUser("admin").password("select").roles("ADMIN");
|
|
|
+ }
|
|
|
+}
|