|
|
@@ -0,0 +1,135 @@
|
|
|
+package com.uas.erp.manage.server.config;
|
|
|
+
|
|
|
+import com.uas.erp.manage.server.web.ResponseWrap;
|
|
|
+import org.springframework.beans.factory.annotation.Autowired;
|
|
|
+import org.springframework.context.MessageSource;
|
|
|
+import org.springframework.context.annotation.Bean;
|
|
|
+import org.springframework.context.annotation.Configuration;
|
|
|
+import org.springframework.context.i18n.LocaleContextHolder;
|
|
|
+import org.springframework.http.HttpStatus;
|
|
|
+import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
|
|
|
+import org.springframework.security.config.annotation.web.builders.HttpSecurity;
|
|
|
+import org.springframework.security.config.annotation.web.builders.WebSecurity;
|
|
|
+import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
|
|
|
+import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
|
|
|
+import org.springframework.security.config.http.SessionCreationPolicy;
|
|
|
+import org.springframework.security.core.Authentication;
|
|
|
+import org.springframework.security.core.AuthenticationException;
|
|
|
+import org.springframework.security.web.AuthenticationEntryPoint;
|
|
|
+import org.springframework.security.web.access.channel.ChannelProcessingFilter;
|
|
|
+import org.springframework.security.web.authentication.AuthenticationFailureHandler;
|
|
|
+import org.springframework.security.web.authentication.AuthenticationSuccessHandler;
|
|
|
+import org.springframework.security.web.util.matcher.AnyRequestMatcher;
|
|
|
+import org.springframework.session.ExpiringSession;
|
|
|
+import org.springframework.session.MapSessionRepository;
|
|
|
+import org.springframework.session.SessionRepository;
|
|
|
+import org.springframework.session.web.http.HeaderHttpSessionStrategy;
|
|
|
+import org.springframework.session.web.http.SessionRepositoryFilter;
|
|
|
+import org.springframework.ui.ModelMap;
|
|
|
+
|
|
|
+import javax.servlet.ServletException;
|
|
|
+import javax.servlet.http.HttpServletRequest;
|
|
|
+import javax.servlet.http.HttpServletResponse;
|
|
|
+import java.io.IOException;
|
|
|
+
|
|
|
+/**
|
|
|
+ * Created by Pro1 on 2017/6/20.
|
|
|
+ */
|
|
|
+@Configuration
|
|
|
+@EnableWebSecurity
|
|
|
+public class WebSecurityConfig extends WebSecurityConfigurerAdapter{
|
|
|
+
|
|
|
+ @Autowired
|
|
|
+ private MessageSource messageSource;
|
|
|
+
|
|
|
+ @Bean
|
|
|
+ public SessionRepository<ExpiringSession> sessionRepository() {
|
|
|
+ return new MapSessionRepository();
|
|
|
+ }
|
|
|
+
|
|
|
+ @Bean
|
|
|
+ public SessionRepositoryFilter<ExpiringSession> sessionRepositoryFilter() {
|
|
|
+ SessionRepositoryFilter<ExpiringSession> sessionRepositoryFilter = new SessionRepositoryFilter<ExpiringSession>(
|
|
|
+ sessionRepository());
|
|
|
+ sessionRepositoryFilter.setHttpSessionStrategy(new HeaderHttpSessionStrategy());
|
|
|
+ return sessionRepositoryFilter;
|
|
|
+ }
|
|
|
+
|
|
|
+ @Override
|
|
|
+ public void configure(WebSecurity web) throws Exception {
|
|
|
+ web.ignoring().antMatchers("/resources/**", "/static/**", "/public/**");
|
|
|
+ }
|
|
|
+
|
|
|
+ @Override
|
|
|
+ public void configure(HttpSecurity http) throws Exception {
|
|
|
+ http.authorizeRequests()
|
|
|
+ .antMatchers("/", "/v1/client/info")
|
|
|
+ .permitAll()
|
|
|
+ .anyRequest()
|
|
|
+ .authenticated()
|
|
|
+ .and()
|
|
|
+ .formLogin()
|
|
|
+ .loginProcessingUrl("/login")
|
|
|
+ .successHandler(authenticationSuccessHandler())
|
|
|
+ .failureHandler(authenticationFailureHandler())
|
|
|
+ .and()
|
|
|
+ .exceptionHandling()
|
|
|
+ .defaultAuthenticationEntryPointFor(jsonAuthenticationEntryPoint(), AnyRequestMatcher.INSTANCE)
|
|
|
+ .and()
|
|
|
+ .logout()
|
|
|
+ .logoutUrl("/logout")
|
|
|
+ .and()
|
|
|
+ .addFilterBefore(sessionRepositoryFilter(), ChannelProcessingFilter.class)
|
|
|
+ .csrf()
|
|
|
+ .disable()
|
|
|
+ .sessionManagement()
|
|
|
+ .sessionCreationPolicy(SessionCreationPolicy.IF_REQUIRED);
|
|
|
+ }
|
|
|
+
|
|
|
+ /**
|
|
|
+ * 登录成功时
|
|
|
+ * @return
|
|
|
+ */
|
|
|
+ @Bean
|
|
|
+ public AuthenticationSuccessHandler authenticationSuccessHandler() {
|
|
|
+ return new AuthenticationSuccessHandler() {
|
|
|
+ @Override
|
|
|
+ public void onAuthenticationSuccess(HttpServletRequest request, HttpServletResponse response, Authentication authentication) throws IOException, ServletException {
|
|
|
+ // 客户端保存token,后续每次请求header里面加x-auth-token进行身份验证
|
|
|
+ ResponseWrap.ok(response, new ModelMap("token", request.getSession().getId()));
|
|
|
+ }
|
|
|
+ };
|
|
|
+ }
|
|
|
+
|
|
|
+ /**
|
|
|
+ * 登录失败时
|
|
|
+ * @return
|
|
|
+ */
|
|
|
+ @Bean
|
|
|
+ public AuthenticationFailureHandler authenticationFailureHandler() {
|
|
|
+ return new AuthenticationFailureHandler() {
|
|
|
+ public void onAuthenticationFailure(HttpServletRequest request, HttpServletResponse response, AuthenticationException exception) throws IOException, ServletException {
|
|
|
+ ResponseWrap.badRequest(response, messageSource.getMessage("AbstractUserDetailsAuthenticationProvider.badCredentials", null, LocaleContextHolder.getLocale()));
|
|
|
+ }
|
|
|
+ };
|
|
|
+ }
|
|
|
+
|
|
|
+ /**
|
|
|
+ * 身份信息验证失败时
|
|
|
+ * @return
|
|
|
+ */
|
|
|
+ @Bean
|
|
|
+ public AuthenticationEntryPoint jsonAuthenticationEntryPoint() {
|
|
|
+ return new AuthenticationEntryPoint() {
|
|
|
+ @Override
|
|
|
+ public void commence(HttpServletRequest request, HttpServletResponse response, AuthenticationException e) throws IOException, ServletException {
|
|
|
+ ResponseWrap.badRequest(response, HttpStatus.UNAUTHORIZED.value(), HttpStatus.UNAUTHORIZED.getReasonPhrase());
|
|
|
+ }
|
|
|
+ };
|
|
|
+ }
|
|
|
+
|
|
|
+ @Autowired
|
|
|
+ public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
|
|
|
+ auth.inMemoryAuthentication().withUser("admin").password("select").roles("ADMIN");
|
|
|
+ }
|
|
|
+}
|