SpringSecurity项目中如何在多个模块中配置认证信息

⒈在SpringSecurity项目中创建AuthorizeConfigProvider接口用于配置认证信息

 package cn.coreqi.ssoserver.authorize;

 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
 import org.springframework.security.config.annotation.web.configurers.ExpressionUrlAuthorizationConfigurer;

 public interface AuthorizeConfigProvider {
     void config(ExpressionUrlAuthorizationConfigurer<HttpSecurity>.ExpressionInterceptUrlRegistry config);
 }

⒉我们实现此接口

 package cn.coreqi.ssoserver.authorize.impl;

 import cn.coreqi.ssoserver.authorize.AuthorizeConfigProvider;
 import org.springframework.http.HttpMethod;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
 import org.springframework.security.config.annotation.web.configurers.ExpressionUrlAuthorizationConfigurer;
 import org.springframework.stereotype.Component;

 @Component
 public class CoreqiAuthorizeConfigProvider implements AuthorizeConfigProvider {
     @Override
     public void config(ExpressionUrlAuthorizationConfigurer<HttpSecurity>.ExpressionInterceptUrlRegistry config) {
           config.antMatchers("/oauth/*","/login/*").permitAll()
                 .antMatchers(HttpMethod.GET,"/auth/*").hasRole("admin")
                 .anyRequest().authenticated();  //任何请求都需要身份认证
     }
 }

⒊在SpringSecurity项目中创建AuthorizeConfigManager接口用于调用系统中所有的配置信息

 package cn.coreqi.ssoserver.authorize;

 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
 import org.springframework.security.config.annotation.web.configurers.ExpressionUrlAuthorizationConfigurer;

 public interface AuthorizeConfigManager {
     void config(ExpressionUrlAuthorizationConfigurer<HttpSecurity>.ExpressionInterceptUrlRegistry config);
 }

⒋我们实现此接口

 package cn.coreqi.ssoserver.authorize.impl;

 import cn.coreqi.ssoserver.authorize.AuthorizeConfigManager;
 import cn.coreqi.ssoserver.authorize.AuthorizeConfigProvider;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
 import org.springframework.security.config.annotation.web.configurers.ExpressionUrlAuthorizationConfigurer;
 import org.springframework.stereotype.Component;

 import java.util.Set;

 @Component
 public class CoreqiAuthorizeConfigManager implements AuthorizeConfigManager {
     /**
      * 将系统中所有的AuthorizeConfigProvider收集起来
      */
     @Autowired
     private Set<AuthorizeConfigProvider> authorizeConfigProviders;
     @Override
     public void config(ExpressionUrlAuthorizationConfigurer<HttpSecurity>.ExpressionInterceptUrlRegistry config) {
         for (AuthorizeConfigProvider authorizeConfigProvider : authorizeConfigProviders ){
             authorizeConfigProvider.config(config);
         }
         config.anyRequest().authenticated();
     }
 }

⒌在SpringSecurity配置中进行如下配置

 @EnableWebSecurity
 public class SsoWebSecurityConfig extends WebSecurityConfigurerAdapter {

     @Autowired
     private AuthorizeConfigManager authorizeConfigManager;
     @Override
     protected void configure(HttpSecurity http) throws Exception {
         http.formLogin()
                 .and()
                 .csrf().disable();    //禁用CSRF

         authorizeConfigManager.config(http.authorizeRequests());
     }
 }