Springboot security

既然系统重构，那么就从最基础的登录和安全说起！

（摘自：https://docs.spring.io/spring-boot/docs/current/reference/htmlsingle/#boot-features-security）

1.security

原文：If Spring Security is on the classpath then web applications will be secure by default with ‘basic’

authentication on all HTTP endpoints. 

也就是说类路径下只要有了spring security 的jar包，则之后对系统的请求都会加以验证是否登录过，是否有权限访问。

2.OAuth2

原文：If you have spring-security-oauth2 on your classpath you can take advantage of some auto-
configuration to make it easy to set up Authorization or Resource Server.

有了spring-security-oauth2后则可以配置自己的授权服务器和资源服务器。（授权服务器和资源服务器可以是同一个，也可以是 两个分开）。

    2.1Authorization Server
原文：To  create  an  Authorization  Server  and  grant  access  tokens  you  need  to  use
@EnableAuthorizationServer and provide security.oauth2.client.client-id and
security.oauth2.client.client-secret] properties. The client will be registered for you in an
in-memory repository.

关键的一点是启用@EnableAuthorizationServer注解，并配置保存相关的客户端的信息。默认 是将客户端信息存在内存中。在本系统中我们将OAuthClientDetails 信息存在数据库中。

    2.2Resource Server

原文：To use the access token you need a Resource Server (which can be the same as the Authorization
Server). Creating a Resource Server is easy, just add @EnableResourceServer and provide some
configuration to allow the server to decode access tokens.

如果应用是一个单独的服务则还需要配置额外的信息：

• security.oauth2.resource.user-info-uri  
• security.oauth2.resource.token-info-uri

若是两者同时指定，则token-info-uri 优先级默认高于另一方 (prefer-token-info=true is the default)

3.Client
原文：To make your webapp into an OAuth2 client you can simply add @EnableOAuth2Client
and Spring Boot will create an OAuth2RestTemplate for you to @Autowire.

启用@EnableOAuth2Client注解，并将在授权服务器上注册过的客户端信息配置好，则你的应用变成了客户端。

4.Single Sign On
An OAuth2 Client can be used to fetch user details from the provider (if such features are available)
and then convert them into an Authentication token for Spring Security. The Resource Server
above support this via the user-info-uri property This is the basis for a Single Sign On (SSO)
protocol based on OAuth2, and Spring Boot makes it easy to participate by providing an annotation
@EnableOAuth2Sso.

在步骤3的基础上，springboot 又支持了单点登录。同样是启用注解，启用该注解时@EnableOAuth2Client可以去掉，因为@EnableOAuth2Sso已经包含了该注解。

这样配置出来的资源服务器是一个oauth2里的客户端角色，支持单点登录，而且保护着受保护的资源。

这里只列出资源服务器的相关配置，配置文件和代码片段如下：

单点登录相关配置：

@Component@EnableOAuth2Sso@EnableWebSecurity@Order(SecurityProperties.ACCESS_OVERRIDE_ORDER)protected static class ConfigurerWebSecurity extends WebSecurityConfigurerAdapter {@Autowiredprivate AccessDecisionManager accessDecisionManager;@Autowiredprivate SessionRegistry sessionRegistry;@Autowiredprivate ObjectPostProcessor<FilterSecurityInterceptor> objectPostProcessorFilterSecurityInterceptor;@Value("${security.oauth2.authorization.uri}")String authorizationUri;/** * Override this method to configure the {@link HttpSecurity}. Typically subclasses should not invoke this * method by calling super as it may override their configuration. The default configuration is: * * <pre> * http.authorizeRequests().anyRequest().authenticated().and().formLogin().and().httpBasic(); * </pre> * * Configure the {@link CookieCsrfTokenRepository} here. * * @param http *            the {@link HttpSecurity} to modify * @throws Exception *             if an error occurs */@Overridepublic void configure(HttpSecurity http) throws Exception {super.configure(http);http// @formatter:off// TODO CSRF protection.csrf().disable()//.csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse())//.and().authorizeRequests().withObjectPostProcessor(objectPostProcessorFilterSecurityInterceptor).accessDecisionManager(accessDecisionManager)//.antMatchers("/").permitAll().anyRequest().authenticated().and()// session manager.sessionManagement()// .sessionFixation().changeSessionId()// .sessionAuthenticationStrategy(sessionAuthenticationStrategy())// .maxSessionsPreventsLogin(true).maximumSessions(1).sessionRegistry(sessionRegistry).and().and()// logout.logout().logoutSuccessHandler(logoutSuccessHandler()).permitAll().and()// remember me.rememberMe().tokenValiditySeconds(7 * 24 * 60 * 60)// .tokenRepository(tokenRepository());// .key("hywweb#28936f8ad1b1598f5d877612a7b75163").and();// @formatter:on;}@Overridepublic void configure(WebSecurity web) throws Exception {super.configure(web);// @formatter:offString[] urls = {"/image/**","/"};// @formatter:onweb.ignoring().antMatchers(urls);}@Bean@Lazypublic SavedRequestAwareAuthenticationSuccessHandler authenticationSuccessHandler() {SavedRequestAwareAuthenticationSuccessHandler handler = new SavedRequestAwareAuthenticationSuccessHandler();handler.setTargetUrlParameter("targetUrl");handler.setDefaultTargetUrl("/security/me");return handler;}@Bean@Lazypublic LogoutSuccessHandler logoutSuccessHandler() {SimpleUrlLogoutSuccessHandler handler = new SimpleUrlLogoutSuccessHandler() {@Overrideprotected String determineTargetUrl(HttpServletRequest request, HttpServletResponse response) {try {String targetUrl = super.determineTargetUrl(request, response);URI uri = new URI(targetUrl);if (!uri.isAbsolute()) {uri = new URI(request.getScheme(), request.getRemoteHost(), targetUrl, null);}targetUrl = UriUtils.encode(uri.toString(), "utf-8");return authorizationUri + "/logout?targetUrl=" + targetUrl;} catch (Exception e) {throw new RuntimeException(e);}}};handler.setTargetUrlParameter("targetUrl");return handler;}@Bean@Lazypublic SecurityAuditorAware auditorProvider(SecurityUserDetailsService userDetailsService) {return new SecurityAuditorAware(userDetailsService);}}

资源服务器相关配置

        @Component@EnableResourceServer@Order(SecurityProperties.ACCESS_OVERRIDE_ORDER)public class ConfigurerResourceServer extends ResourceServerConfigurerAdapter {@Autowiredprivate AccessDecisionManager accessDecisionManager;@Autowiredprivate AuthenticationEntryPoint ajaxAuthenticationEntryPoint;@Autowiredprivate RequestMatcher ajaxRequestMatcher;@Autowiredprivate ResourceServerProperties resourceServerProperties;@Overridepublic void configure(ResourceServerSecurityConfigurer resources) throws Exception {super.configure(resources);resources.resourceId(resourceServerProperties.getResourceId()).stateless(false);resources.expressionHandler(expressionHandler);}@Overridepublic void configure(HttpSecurity http) throws Exception {super.configure(http);// @formatter:offString[] urls = {"/api/**","/security/**",//"/security/me/**","/report/**","/jms/**","/webgis/**"};http.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.IF_REQUIRED).and().requestMatchers().antMatchers(urls).and().authorizeRequests().withObjectPostProcessor(objectPostProcessorFilterSecurityInterceptor()).accessDecisionManager(accessDecisionManager).antMatchers("/").permitAll().antMatchers(urls).access("#oauth2.hasScope('read') or (!#oauth2.isOAuth() and hasRole('ROLE_USER'))").and().exceptionHandling().defaultAuthenticationEntryPointFor(ajaxAuthenticationEntryPoint, ajaxRequestMatcher).authenticationEntryPoint(new LoginUrlAuthenticationEntryPoint("/login")).and()// @formatter:on;}}

没有了那么多的xml文件，springboot 的autoConfig 确实带来了不一样的开发体验 ，简化了对已有技术的使用。