1 //IAuthenticationFilter 認(rèn)證，認(rèn)證是否合法用戶
 2 public class AdminAuthenticationFilter : ActionFilterAttribute, IAuthenticationFilter
 3 {
 4     public void OnAuthentication(AuthenticationContext filterContext)
 5     {
 6         IPrincipal user = filterContext.Principal;
 7         if (user == null || !user.Identity.IsAuthenticated)
 8         {
 9             HttpCookie authCookie = filterContext.HttpContext.Request.Cookies[FormsAuthentication.FormsCookieName];
10             if (authCookie != null)
11             {
12                 FormsAuthenticationTicket ticket = FormsAuthentication.Decrypt(authCookie.Value);
13                 if (ticket != null && !string.IsNullOrEmpty(ticket.UserData))
14                 {
15                     var userId = Convert.ToInt32(ticket.UserData);
16                     user = EngineContext.Resolve<PFManagerService>().GetManager(userId);
17                     filterContext.Principal = user; //后續(xù)會傳遞給HttpContext.Current.User
18                 }
19             }
20         }
21     }
22 
23     public void OnAuthenticationChallenge(AuthenticationChallengeContext filterContext)
24     {
25         // 認(rèn)證失敗執(zhí)行
26     }
27 }

 1 public class AdminAuthorizationFilter : AuthorizeAttribute
 2 {        
 3     public override void OnAuthorization(AuthorizationContext filterContext)
 4     {
 5         //childaction不用授權(quán)
 6         if (filterContext.IsChildAction)
 7             return;
 8 
 9         if (!filterContext.ActionDescriptor.IsDefined(typeof(AllowAnonymousAttribute), true) && !filterContext.ActionDescriptor.ControllerDescriptor.IsDefined(typeof(AllowAnonymousAttribute), true))
10         {           
11             if (filterContext.HttpContext.User != null && filterContext.HttpContext.User.Identity.IsAuthenticated)
12             {
13                 var controllerName = filterContext.RouteData.Values["controller"].ToString().ToLower();
14                 var actionName = filterContext.RouteData.Values["action"].ToString().ToLower();
15                 //只要登錄，則都能訪問工作臺
16                 if (controllerName.ToLower() == "home" && actionName.ToLower() == "index")
17                     this.Roles = string.Empty;
18                 else
19                 {
20                     var roleIds = EngineContext.Resolve<BEModuleService>().GetRoleIdsHasModuleAuthorization(controllerName, actionName, MasonPlatformType.AdminPlatform);
21                     if (roleIds == null)
22                     {
23                         filterContext.Result = new HttpNotFoundResult();
24                         return;
25                     }
26                     //將資源所需權(quán)限賦給成員變量Roles
27                     this.Roles = string.Join(",", roleIds);
28                 }
29             }
30         }
31 
32         base.OnAuthorization(filterContext);
33     }
34 }

 1 @Configuration
 2 @EnableWebSecurity
 3 @EnableGlobalMethodSecurity(prePostEnabled = true)
 4 public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
 5     @Autowired
 6     private JwtAuthenticationEntryPoint unauthorizedHandler;
 7 
 8     @Autowired
 9     private UserDetailsService userDetailsService;
10 
11     @Autowired
12     private CustomPostProcessor postProcessor;
13 
14     @Autowired
15     public void configureAuthentication(AuthenticationManagerBuilder authenticationManagerBuilder) throws Exception {
16         authenticationManagerBuilder
17                 .userDetailsService(this.userDetailsService)
18                 .passwordEncoder(passwordEncoder());
19     }
20 
21     @Bean
22     public PasswordEncoder passwordEncoder() {
23         return new BCryptPasswordEncoder();
24     }
25 
26     @Bean
27     public JwtAuthenticationTokenFilter authenticationTokenFilterBean() throws Exception {
28         return new JwtAuthenticationTokenFilter();
29     }
30 
31     @Override
32     protected void configure(HttpSecurity httpSecurity) throws Exception {
33         httpSecurity
34                 // we don't need CSRF because our token is invulnerable
35                 .csrf().disable()
36                 .exceptionHandling().authenticationEntryPoint(unauthorizedHandler).and()
37                 // don't create session
38                 .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS).and()
39                 .authorizeRequests()
40                 .antMatchers(HttpMethod.OPTIONS, "/**").permitAll()
41                 .anyRequest().authenticated().withObjectPostProcessor(postProcessor);
42 
43         // Custom JWT based security filter
44         httpSecurity
45                 .addFilterBefore(authenticationTokenFilterBean(), UsernamePasswordAuthenticationFilter.class);
46     }
47 }

 1 @Component
 2 public class CustomPostProcessor implements ObjectPostProcessor<FilterSecurityInterceptor> {
 3     @Autowired
 4     private CustomFilterSecurityMetadataSource customFilterSecurityMetadataSource;
 5 
 6     @Autowired
 7     private CustomAccessDecisionManager customAccessDecisionManager;
 8 
 9     @Override
10     public <T extends FilterSecurityInterceptor> T postProcess(T fsi) {
11         fsi.setSecurityMetadataSource(customFilterSecurityMetadataSource); //1.路徑（資源）攔截處理
12         fsi.setAccessDecisionManager(customAccessDecisionManager); //2.權(quán)限決策處理類
13         return fsi;
14     }
15 }

 1 @Service
 2 public class JwtUserDetailsServiceImpl implements UserDetailsService {
 3 
 4     @Autowired
 5     private UserRepository userRepository;
 6 
 7     @Override
 8     public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
 9         User user = userRepository.findByUsername(username);
10 
11         if (user == null) {
12             throw new UsernameNotFoundException(String.format("No user found with username '%s'.", username));
13         } else {
14             return JwtUserFactory.create(user);
15         }
16     }
17 }

 1 /**
 2  * 路徑攔截處理類
 3  * <p>
 4  * 如果路徑屬于允許訪問列表，則不做攔截，放開訪問；
 5  * <p>
 6  * 否則，獲得路徑訪問所需角色，并返回；如果沒有找到該路徑所需角色，則拒絕訪問。
 7  */
 8 @Component
 9 public class CustomFilterSecurityMetadataSource implements FilterInvocationSecurityMetadataSource {
10     @Autowired
11     private ApiRepository apiRepository;
12 
13     @Override
14     public Collection<ConfigAttribute> getAttributes(Object object) throws IllegalArgumentException {
15         FilterInvocation fi = (FilterInvocation) object; //當(dāng)前請求對象
16 
17         List<ConfigAttribute> configAttributes = getMatcherConfigAttribute(fi.getRequestUrl(), fi.getRequest().getMethod()); // 獲得訪問當(dāng)前路徑所需要的角色
18 
19         return configAttributes.size() > 0 ? configAttributes : deniedRequest(); //返回當(dāng)前路徑所需角色，如果路徑?jīng)]有對應(yīng)角色，則拒絕訪問
20     }
21 
22     @Override
23     public Collection<ConfigAttribute> getAllConfigAttributes() {
24         return null;
25     }
26 
27     @Override
28     public boolean supports(Class<?> clazz) {
29         return FilterInvocation.class.isAssignableFrom(clazz);
30     }
31 
32     /**
33      * 獲取當(dāng)前路徑以及請求方式獲得所需要的角色
34      *
35      * @param url 當(dāng)前路徑
36      * @return 所需角色集合
37      */
38     private List<ConfigAttribute> getMatcherConfigAttribute(String url, String method) {
39         Set<Authority> authorities = new HashSet<>();
40         // 1.根據(jù)url的開頭去數(shù)據(jù)庫模糊查詢相應(yīng)的api
41 
42         String prefix = url.substring(0, url.lastIndexOf("/"));
43 
44         prefix = StringUtil.isEmpty(prefix) ? url : prefix + "%";
45 
46         List<Api> apis = apiRepository.findByUriLikeAndMethod(prefix, method);
47 
48         // 2.查找完全匹配的api，如果沒有，比對pathMatcher是否有匹配的結(jié)果
49         apis.forEach(api -> {
50             String pattern = api.getUri();
51 
52             if (new AntPathMatcher().match(pattern, url)) {
53                 List<Resource> resources = api.getResources();
54 
55                 resources.forEach(resource -> {
56                     authorities.addAll(resource.getAuthorities());
57                 });
58             }
59         });
60 
61         return authorities.stream().map(authority -> new SecurityConfig(authority.getId().toString())).collect(Collectors.toList());
62     }
63 
64     /**
65      * @return 默認(rèn)拒絕訪問配置
66      */
67     private List<ConfigAttribute> deniedRequest() {
68         return Collections.singletonList(new SecurityConfig("ROLE_DENIED"));
69     }
70 }

 1 /**
 2  * 權(quán)限決策處理類
 3  *
 4  * 判斷用戶的角色，如果為空，則拒絕訪問；
 5  *
 6  * 判斷用戶所有的角色中是否有一個包含在 訪問路徑允許的角色集合中；
 7  *
 8  * 如果有，則放開；否則拒絕訪問；
 9  */
10 @Component
11 public class CustomAccessDecisionManager implements AccessDecisionManager {
12     @Override
13     public void decide(Authentication authentication, Object object, Collection<ConfigAttribute> configAttributes) throws AccessDeniedException, InsufficientAuthenticationException {
14         if (authentication == null) {
15             throw new AccessDeniedException("permission denied");
16         }
17 
18         //當(dāng)前用戶擁有的角色集合
19         List<String> roleCodes = authentication.getAuthorities().stream().map(GrantedAuthority::getAuthority).collect(Collectors.toList());
20 
21         //訪問路徑所需要的角色集合
22         List<String> configRoleCodes = configAttributes.stream().map(ConfigAttribute::getAttribute).collect(Collectors.toList());
23         for (String roleCode : roleCodes) {
24             if (configRoleCodes.contains(roleCode)) {
25                 return;
26             }
27         }
28 
29         throw new AccessDeniedException("permission denied");
30     }
31 
32     @Override
33     public boolean supports(ConfigAttribute attribute) {
34         return true;
35     }
36 
37     @Override
38     public boolean supports(Class<?> clazz) {
39         return true;
40     }
41 }

 1 public class JwtAuthenticationTokenFilter extends OncePerRequestFilter {
 2 
 3     private final Log logger = LogFactory.getLog(this.getClass());
 4 
 5     @Autowired
 6     private UserDetailsService userDetailsService;
 7 
 8     @Autowired
 9     private JwtTokenUtil jwtTokenUtil;
10 
11     @Value("${jwt.header}")
12     private String tokenHeader;
13 
14     @Override
15     protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain chain) throws ServletException, IOException {
16         final String requestHeader = request.getHeader(this.tokenHeader);
17 
18         String username = null;
19         String authToken = null;
20         if (requestHeader != null && requestHeader.startsWith("Bearer ")) {
21             authToken = requestHeader.substring(7);
22             try {
23                 username = jwtTokenUtil.getUsernameFromToken(authToken);
24             } catch (IllegalArgumentException e) {
25                 logger.error("an error occured during getting username from token", e);
26             } catch (Exception e1) {
27                 logger.error(e1.getMessage());
28             }
29         }
30 
31         if (username != null && SecurityContextHolder.getContext().getAuthentication() == null) {
32 
33             // It is not compelling necessary to load the use details from the database. You could also store the information
34             // in the token and read it from it. It's up to you ;)
35             UserDetails userDetails = this.userDetailsService.loadUserByUsername(username);
36 
37             // For simple validation it is completely sufficient to just check the token integrity. You don't have to call
38             // the database compellingly. Again it's up to you ;)
39             if (jwtTokenUtil.validateToken(authToken, userDetails)) {
40                 UsernamePasswordAuthenticationToken authentication = new UsernamePasswordAuthenticationToken(userDetails, null, userDetails.getAuthorities());
41                 authentication.setDetails(new WebAuthenticationDetailsSource().buildDetails(request));
42                 logger.info("authenticated user " + username + ", setting security context");
43                 SecurityContextHolder.getContext().setAuthentication(authentication);
44             }
45         }
46 
47         chain.doFilter(request, response);
48     }
49 }