|
@@ -11,10 +11,12 @@ import org.springframework.context.annotation.Bean;
|
|
|
import org.springframework.context.annotation.Configuration;
|
|
|
import org.springframework.http.HttpMethod;
|
|
|
import org.springframework.security.authentication.AuthenticationManager;
|
|
|
+import org.springframework.security.config.Customizer;
|
|
|
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
|
|
|
import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
|
|
|
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
|
|
|
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
|
|
|
+import org.springframework.security.config.annotation.web.configurers.ExpressionUrlAuthorizationConfigurer;
|
|
|
import org.springframework.security.config.http.SessionCreationPolicy;
|
|
|
import org.springframework.security.crypto.password.PasswordEncoder;
|
|
|
import org.springframework.security.web.AuthenticationEntryPoint;
|
|
@@ -40,9 +42,6 @@ public class YudaoWebSecurityConfigurerAdapter extends WebSecurityConfigurerAdap
|
|
|
@Resource
|
|
|
private WebProperties webProperties;
|
|
|
|
|
|
- @Value("${spring.boot.admin.context-path:''}")
|
|
|
- private String adminSeverContextPath;
|
|
|
-
|
|
|
/**
|
|
|
* 自定义用户【认证】逻辑
|
|
|
*/
|
|
@@ -73,6 +72,13 @@ public class YudaoWebSecurityConfigurerAdapter extends WebSecurityConfigurerAdap
|
|
|
*/
|
|
|
@Resource
|
|
|
private JwtAuthenticationTokenFilter authenticationTokenFilter;
|
|
|
+ /**
|
|
|
+ * 自定义的权限映射 Bean
|
|
|
+ *
|
|
|
+ * @see #configure(HttpSecurity)
|
|
|
+ */
|
|
|
+ @Resource
|
|
|
+ private Customizer<ExpressionUrlAuthorizationConfigurer<HttpSecurity>.ExpressionInterceptUrlRegistry> authorizeRequestsCustomizer;
|
|
|
|
|
|
@Autowired
|
|
|
private Auth2AutoConfigurer auth2AutoConfigurer;
|
|
@@ -122,7 +128,6 @@ public class YudaoWebSecurityConfigurerAdapter extends WebSecurityConfigurerAdap
|
|
|
*/
|
|
|
@Override
|
|
|
protected void configure(HttpSecurity httpSecurity) throws Exception {
|
|
|
-
|
|
|
httpSecurity
|
|
|
// ========= start: 使用 justAuth-spring-security-starter 必须步骤 =========
|
|
|
// 添加 Auth2AutoConfigurer 使 OAuth2(justAuth) login 生效.
|
|
@@ -133,45 +138,38 @@ public class YudaoWebSecurityConfigurerAdapter extends WebSecurityConfigurerAdap
|
|
|
.csrf().disable()
|
|
|
// 基于 token 机制,所以不需要 Session
|
|
|
.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS).and()
|
|
|
+ .headers().frameOptions().disable().and()
|
|
|
// 一堆自定义的 Spring Security 处理器
|
|
|
.exceptionHandling().authenticationEntryPoint(authenticationEntryPoint)
|
|
|
- .accessDeniedHandler(accessDeniedHandler).and()
|
|
|
- .formLogin().loginPage(api("/login")).successHandler(authenticationSuccessHandler).and()
|
|
|
- // 设置每个请求的权限
|
|
|
- .authorizeRequests()
|
|
|
- // 登陆的接口,可匿名访问
|
|
|
- .antMatchers(api("/login")).anonymous()
|
|
|
- // 通用的接口,可匿名访问 TODO 芋艿:需要抽象出去
|
|
|
- .antMatchers(api("/system/captcha/**")).anonymous()
|
|
|
- // 静态资源,可匿名访问
|
|
|
- .antMatchers(HttpMethod.GET, "/*.html", "/**/*.html", "/**/*.css", "/**/*.js").permitAll()
|
|
|
- // 文件的获取接口,可匿名访问
|
|
|
- .antMatchers(api("/infra/file/get/**")).anonymous()
|
|
|
- // Swagger 接口文档
|
|
|
- .antMatchers("/swagger-ui.html").anonymous()
|
|
|
- .antMatchers("/favicon.ico").anonymous()
|
|
|
- .antMatchers("/swagger-resources/**").anonymous()
|
|
|
- .antMatchers("/webjars/**").anonymous()
|
|
|
- .antMatchers("/*/api-docs").anonymous()
|
|
|
- // Spring Boot Admin Server 的安全配置 TODO 芋艿:需要抽象出去
|
|
|
- .antMatchers(adminSeverContextPath).anonymous()
|
|
|
- .antMatchers(adminSeverContextPath + "/**").anonymous()
|
|
|
- // Spring Boot Actuator 的安全配置
|
|
|
- .antMatchers("/actuator").anonymous()
|
|
|
- .antMatchers("/actuator/**").anonymous()
|
|
|
- // Druid 监控 TODO 芋艿:需要抽象出去
|
|
|
- .antMatchers("/druid/**").anonymous()
|
|
|
- // 短信回调 API TODO 芋艿:需要抽象出去
|
|
|
- .antMatchers(api("/system/sms/callback/**")).anonymous()
|
|
|
- // oAuth2 auth2/login/gitee
|
|
|
- .antMatchers(api("/auth2/login/**")).anonymous()
|
|
|
- .antMatchers(api("/auth2/authorization/**")).anonymous()
|
|
|
- .antMatchers("/api/callback/**").anonymous()
|
|
|
- // 除上面外的所有请求全部需要鉴权认证
|
|
|
- .anyRequest().authenticated()
|
|
|
- .and()
|
|
|
- .headers().frameOptions().disable();
|
|
|
- httpSecurity.logout().logoutUrl(api("/logout")).logoutSuccessHandler(logoutSuccessHandler);
|
|
|
+ .accessDeniedHandler(accessDeniedHandler).and()
|
|
|
+ .logout().logoutUrl(api("/logout")).logoutSuccessHandler(logoutSuccessHandler); // 登出
|
|
|
+
|
|
|
+ // 设置每个请求的权限 ①:全局共享规则
|
|
|
+ httpSecurity.authorizeRequests()
|
|
|
+ // 登陆的接口,可匿名访问
|
|
|
+ .antMatchers(api("/login")).anonymous()
|
|
|
+ // 静态资源,可匿名访问
|
|
|
+ .antMatchers(HttpMethod.GET, "/*.html", "/**/*.html", "/**/*.css", "/**/*.js").permitAll()
|
|
|
+ // 文件的获取接口,可匿名访问
|
|
|
+ .antMatchers(api("/infra/file/get/**")).anonymous()
|
|
|
+ // Swagger 接口文档
|
|
|
+ .antMatchers("/swagger-ui.html").anonymous()
|
|
|
+ .antMatchers("/swagger-resources/**").anonymous()
|
|
|
+ .antMatchers("/webjars/**").anonymous()
|
|
|
+ .antMatchers("/*/api-docs").anonymous()
|
|
|
+ // Spring Boot Actuator 的安全配置
|
|
|
+ .antMatchers("/actuator").anonymous()
|
|
|
+ .antMatchers("/actuator/**").anonymous()
|
|
|
+ // Druid 监控 TODO 芋艿:等对接了 druid admin 后,在调整下。
|
|
|
+ .antMatchers("/druid/**").anonymous()
|
|
|
+ // oAuth2 auth2/login/gitee
|
|
|
+ .antMatchers(api("/auth2/login/**")).anonymous()
|
|
|
+ .antMatchers(api("/auth2/authorization/**")).anonymous()
|
|
|
+ .antMatchers("/api/callback/**").anonymous()
|
|
|
+ // 设置每个请求的权限 ②:每个项目的自定义规则
|
|
|
+ .and().authorizeRequests(authorizeRequestsCustomizer)
|
|
|
+ // 设置每个请求的权限 ③:兜底规则,必须认证
|
|
|
+ .authorizeRequests().anyRequest().authenticated();
|
|
|
// 添加 JWT Filter
|
|
|
httpSecurity.addFilterBefore(authenticationTokenFilter, UsernamePasswordAuthenticationFilter.class);
|
|
|
|