mark v1 SecurityConfig

package cn.efunbox.cms.configuration;

import cn.efunbox.afw.core.entity.ApiCode;
import cn.efunbox.afw.core.entity.ApiResult;
import cn.efunbox.cms.code.CmsWebApiCode;
import cn.efunbox.cms.interceptor.LoginInterceptor;
import cn.efunbox.cms.security.CmsAuthenticationProvider;
import cn.efunbox.cms.security.CmsUserDetailsService;
import cn.efunbox.web.common.util.HttpUtil;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.boot.autoconfigure.security.SecurityProperties;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.core.annotation.Order;
import org.springframework.http.HttpMethod;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.authentication.BadCredentialsException;
import org.springframework.security.authentication.InsufficientAuthenticationException;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.builders.WebSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.AuthenticationException;
import org.springframework.security.core.session.SessionInformation;
import org.springframework.security.core.session.SessionRegistry;
import org.springframework.security.core.session.SessionRegistryImpl;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.core.userdetails.UsernameNotFoundException;
import org.springframework.security.web.AuthenticationEntryPoint;
import org.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler;
import org.springframework.security.web.authentication.SimpleUrlAuthenticationSuccessHandler;
import org.springframework.security.web.authentication.logout.SimpleUrlLogoutSuccessHandler;
import org.springframework.security.web.authentication.session.*;
import org.springframework.security.web.csrf.CsrfToken;
import org.springframework.security.web.csrf.CsrfTokenRepository;
import org.springframework.security.web.csrf.HttpSessionCsrfTokenRepository;
import org.springframework.security.web.session.ConcurrentSessionFilter;
import org.springframework.security.web.session.SessionManagementFilter;
import org.springframework.util.StringUtils;
import org.springframework.web.filter.OncePerRequestFilter;
import org.springframework.web.util.WebUtils;

import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.ServletException;
import javax.servlet.http.Cookie;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
import java.util.Arrays;
import java.util.List;

/**
 * 安全配置中心
 * @author by tomas
 * @date 2017-06-06 15:30:00
 */
@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true)//允许进入页面方法前检验
@Order(SecurityProperties.ACCESS_OVERRIDE_ORDER)
public class SecurityConfig extends WebSecurityConfigurerAdapter {

private static final Logger logger = LoggerFactory.getLogger(LoginInterceptor.class);

 @Bean
 public UserDetailsService userDetailsService() {
return new CmsUserDetailsService();
 }

@Bean
 public CmsAuthenticationProvider cmsAuthenticationProvider() {
return new CmsAuthenticationProvider();
 }

/**
 * 设置那些 URL 忽略权限
 * @param web
 * @throws Exception
 */
 @Override
 public void configure(WebSecurity web) throws Exception {
web.ignoring().antMatchers(HttpMethod.OPTIONS, "/**");
 web.ignoring().antMatchers(HttpMethod.GET,"/login/**");
 }

@Override
 protected void configure(HttpSecurity http) throws Exception {

http
.authorizeRequests()
.anyRequest().authenticated()
//先去掉 csrf
 .and().csrf().disable()
//.and().csrf().ignoringAntMatchers("/login","/logout").csrfTokenRepository(csrfTokenRepository()).and()
 .addFilterAfter(csrfHeaderFilter(), SessionManagementFilter.class)
.authorizeRequests().antMatchers("/login").permitAll();

 http
.formLogin().successHandler(new RestAuthenticationSuccessHandler())
.failureHandler(new RestAuthenticationFailureHandler())
.permitAll()
.and()
.logout().logoutSuccessHandler(new RestLogoutSuccessHandler())
.deleteCookies("JSESSIONID", "X-XSRF-TOKEN")
.permitAll();

 http.sessionManagement()
.sessionAuthenticationStrategy(sessionAuthenticationStrategy())
.and()
.addFilter(concurrentSessionFilter());

 http.exceptionHandling().authenticationEntryPoint(new RestAuthenticationEntryPoint());
// http
// .rememberMe()
// .rememberMeCookieName("")
// .tokenValiditySeconds(200000)
// .rememberMeServices(rememberMeServices);

 }

/**
 * 自定义 认证密码 和 获取用户 服务
 * @param auth
 * @throws Exception
 */
 @Autowired
 public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
auth
.authenticationProvider(cmsAuthenticationProvider())
.userDetailsService(userDetailsService());
 }

@Bean
 public AuthenticationManager authenticationManagerBean() throws Exception {
return super.authenticationManagerBean();
 }

/**
 * csrf 过滤器 请求必须
 * @return
 */
 private Filter csrfHeaderFilter() {
return new OncePerRequestFilter() {

@Override
 protected void doFilterInternal(HttpServletRequest request,
 HttpServletResponse response,
 FilterChain filterChain) throws ServletException, IOException {

CsrfToken csrf = (CsrfToken) request.getAttribute(CsrfToken.class.getName());
 if (csrf != null) {
Cookie cookie = WebUtils.getCookie(request, "XSRF-TOKEN");
 String token = csrf.getToken();
 if (cookie == null || token != null
 && !token.equals(cookie.getValue())) {
cookie = new Cookie("XSRF-TOKEN", token);
 cookie.setPath("/");
 response.addCookie(cookie);
 }
}
filterChain.doFilter(request, response);
 }
};
 }
private CsrfTokenRepository csrfTokenRepository() {
HttpSessionCsrfTokenRepository repository = new HttpSessionCsrfTokenRepository();
 repository.setHeaderName("X-XSRF-TOKEN");//repository.setSessionAttributeName(("X-XSRF-TOKEN"));
 return repository;
 }

/**
 * 注册自定义的SessionRegistry
 */
 @Bean
 public SessionRegistry sessionRegistry() {
return new SessionRegistryImpl();
 }

/**
 * 注册自定义 sessionAuthenticationStrategy
 * 设置 ConcurrentSessionControlAuthenticationStrategy 控制并发
 * 设置 SessionFixationProtectionStrategy 可以防盗session
 * 设置 RegisterSessionAuthenticationStrategy 触发了注册新sessin
 */
 @Bean
 public CompositeSessionAuthenticationStrategy sessionAuthenticationStrategy() {
ConcurrentSessionControlAuthenticationStrategy concurrentSessionControlAuthenticationStrategy = new ConcurrentSessionControlAuthenticationStrategy(sessionRegistry());
 concurrentSessionControlAuthenticationStrategy.setMaximumSessions();
 concurrentSessionControlAuthenticationStrategy.setExceptionIfMaximumExceeded(true);
 SessionFixationProtectionStrategy sessionFixationProtectionStrategy = new SessionFixationProtectionStrategy();
 RegisterSessionAuthenticationStrategy registerSessionStrategy = new RegisterSessionAuthenticationStrategy(sessionRegistry());
 CompositeSessionAuthenticationStrategy sessionAuthenticationStrategy = new CompositeSessionAuthenticationStrategy(
Arrays.asList(concurrentSessionControlAuthenticationStrategy, sessionFixationProtectionStrategy, registerSessionStrategy));
 return sessionAuthenticationStrategy;
 }

/**
 * 注册并发Session Filter
 */
 @Bean
 public ConcurrentSessionFilter concurrentSessionFilter() {
return new ConcurrentSessionFilter(sessionRegistry(), "/login?expired");
 }

/**
 * Rest 登陆成功后的处理
 */
 public class RestAuthenticationSuccessHandler extends SimpleUrlAuthenticationSuccessHandler {
@Override
 public void onAuthenticationSuccess(HttpServletRequest request,
 HttpServletResponse response, Authentication authentication)
throws ServletException, IOException {
HttpUtil.responseOutWithJson(request,response, ApiResult.ok(authentication.getPrincipal()));
 clearAuthenticationAttributes(request);
 }
}

/**
 * Rest 登录认证失败后的处理
 */

 public class RestAuthenticationFailureHandler extends SimpleUrlAuthenticationFailureHandler {
@Override
 public void onAuthenticationFailure (HttpServletRequest request, HttpServletResponse response, AuthenticationException exception)
throws ServletException, IOException {

logger.error("登录失败 exception={}" ,exception);
 saveException(request, exception);
 //密码错误
 if(exception instanceof BadCredentialsException){
HttpUtil.responseOutWithJson(request,response, ApiResult.error(CmsWebApiCode.PASSWORD_ERROR));
 }
//查询用户出错
 else if(exception instanceof UsernameNotFoundException){
HttpUtil.responseOutWithJson(request,response, ApiResult.error(CmsWebApiCode.USERNAME_PASSWORD_ERROR));
 }
//查询用户出错
 else if(exception instanceof SessionAuthenticationException){
HttpUtil.responseOutWithJson(request,response, ApiResult.error(CmsWebApiCode.MAX_COUNT_SESSION_ERROR));
 }
else {
HttpUtil.responseOutWithJson(request,response, ApiResult.error(CmsWebApiCode.AUTHORIZED_FAILD));
 }
}
}

/**
 * Rest 登出成功后的处理
 */

 public class RestLogoutSuccessHandler extends SimpleUrlLogoutSuccessHandler {
@Override
 public void onLogoutSuccess(HttpServletRequest request,
 HttpServletResponse response, Authentication authentication)
throws IOException, ServletException {
logger.info("登出成功! ");
 if (!StringUtils.isEmpty(request.getRequestedSessionId())){
//sessionRegistry().removeSessionInformation(request.getRequestedSessionId());
 if(null!=authentication && null!=authentication.getDetails() && null!=authentication.getPrincipal()){
List<SessionInformation> sessionInformations= sessionRegistry().getAllSessions(authentication.getPrincipal(),false);
 for (SessionInformation sessionInformation : sessionInformations) {
sessionInformation.expireNow();
 }
sessionRegistry().getAllPrincipals().remove(authentication.getDetails());
 }
}
HttpUtil.delCookies(request,response,"JSESSIONID", "X-XSRF-TOKEN");
 HttpUtil.responseOk(request,response);

 }
}

/**
 * Rest 权限不通过的处理
 */
 public class RestAuthenticationEntryPoint implements AuthenticationEntryPoint {
@Override
 public void commence(HttpServletRequest request,
 HttpServletResponse response,
 AuthenticationException authException) throws IOException {
//原生返回 response.sendError(HttpServletResponse.SC_UNAUTHORIZED,"Authentication Failed: " + authException.getMessage());
 //cookie失效
 if(authException instanceof InsufficientAuthenticationException){
HttpUtil.responseOutWithJson(request,response, ApiResult.error(CmsWebApiCode.INVALID_COOKIE));
 }
HttpUtil.responseApiCode(request,response, ApiCode.ACCESS_DENIED);
 }
}
}

http://git.oschina.net/xiangxik/castle-platform/blob/master/castle-sample/castle-sample-console/src/main/java/com/whenling/sample/security/MainWebSecurityConfigBean.java

@Configuration
@Order(Ordered.HIGHEST_PRECEDENCE)
publicclassMainWebSecurityConfigBeanextendsWebSecurityConfigurerAdapter{
@Value("${security.skip_auth_urls?:/assets/**,/captcha**,/upload/**}")
privateString[]skipAuthUrls;
@Autowired
privateObjectFactoryobjectMapper;
@Autowired
privateObjectFactorymessageSourceAccessor;
publicMainWebSecurityConfigBean(){
super(true);
}
@Override
protectedvoidconfigure(HttpSecurityhttp)throwsException{
http.csrf().and().addFilter(newWebAsyncManagerIntegrationFilter()).exceptionHandling().and().headers().and().sessionManagement().and()
.securityContext().and().requestCache().and().anonymous().and().servletApi().and().logout();
http.getSharedObject(AuthenticationManagerBuilder.class)// .authenticationProvider(null)

.authenticationEventPublisher(defaultAuthenticationEventPublisher());
http.rememberMe().userDetailsService(userDetailsService());
FormLoginConfigurerconfigurer=http.headers().frameOptions().sameOrigin().and().csrf().disable().formLogin();
configurer.successHandler(newResultAuthenticationSuccessHandler(objectMapper.getObject()))
.failureHandler(newResultAuthenticationFailureHanlder(objectMapper.getObject(),messageSourceAccessor.getObject()));
ExceptionHandlingConfigurerexceptionConfigurer=configurer.permitAll().and().authorizeRequests().antMatchers(skipAuthUrls)
.permitAll().anyRequest().authenticated().and().exceptionHandling();
exceptionConfigurer.authenticationEntryPoint(
newExceptionAuthenticationEntryPoint(newHttp403ForbiddenEntryPoint(),newLoginUrlAuthenticationEntryPoint("/login")));
exceptionConfigurer.and().logout().logoutSuccessUrl("/login").permitAll();
}
@Bean
publicUserDetailsServiceuserDetailsService(){
returnnewAdminDetailsService();
}
@Bean
publicDefaultAuthenticationEventPublisherdefaultAuthenticationEventPublisher(){
returnnewDefaultAuthenticationEventPublisher();
}
}