1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
package com.yiboshi.science.config.security;
import com.yiboshi.science.config.annotation.Anonymous;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.oauth2.config.annotation.web.configuration.EnableResourceServer;
import org.springframework.security.oauth2.config.annotation.web.configuration.ResourceServerConfigurerAdapter;
import org.springframework.security.oauth2.config.annotation.web.configurers.ResourceServerSecurityConfigurer;
import org.springframework.web.context.WebApplicationContext;
import org.springframework.web.method.HandlerMethod;
import org.springframework.web.servlet.mvc.condition.PatternsRequestCondition;
import org.springframework.web.servlet.mvc.method.RequestMappingInfo;
import org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerMapping;
import java.util.HashMap;
import java.util.HashSet;
import java.util.Map;
import java.util.Set;
@Configuration
@EnableResourceServer
public class ResourceServerConfig extends ResourceServerConfigurerAdapter {
@Autowired
private AuthorizationAccessDeniedHandler customAccessDeniedHandler;
@Autowired
private AuthExceptionEntryPointHandler authExceptionEntryPoint;
@Autowired
private WebApplicationContext applicationContext;
@Override
public void configure(ResourceServerSecurityConfigurer resources) {
resources.authenticationEntryPoint(authExceptionEntryPoint);
resources.accessDeniedHandler(customAccessDeniedHandler);
}
@Override
public void configure(HttpSecurity http) throws Exception {
Set<String> anonymous = getAnonymousUrl();
http.httpBasic()
.and()
.formLogin()
//.and().rememberMe()
//.authenticationSuccessHandler(new ....)
//密钥
//.key("unique-and-secret")
//cookie名
//.rememberMeCookieName("remember-me-cookie-name")
//生命周期，单位毫秒
//.tokenValiditySeconds(24 * 60 * 60)
/*.and()
.logout()
.logoutSuccessHandler(userLogoutSuccessHandler)*/
.and()
.authorizeRequests()
.antMatchers(anonymous.toArray(new String[0])).permitAll()
.antMatchers("/error").permitAll()
.antMatchers("/upload/files/**").permitAll()
.antMatchers("/docs.html").permitAll()
.antMatchers("/swagger-ui.html").permitAll()
.antMatchers("/swagger-resources/**").permitAll()
.antMatchers("/webjars/**").permitAll()
.antMatchers("/v2/api-docs").permitAll()
.antMatchers("/api-docs").permitAll()
// .antMatchers("/oauth/token").permitAll()
// .antMatchers("/oauth/check_token").permitAll()
.anyRequest()
//.permitAll()
.authenticated()
.and().csrf().disable().cors()
.and().exceptionHandling()
.authenticationEntryPoint(authExceptionEntryPoint)
.accessDeniedHandler(customAccessDeniedHandler);
//.and().sessionManagement().maximumSessions(1);
}
public Set<String> getAnonymousUrl() {
RequestMappingHandlerMapping mapping = applicationContext.getBean(RequestMappingHandlerMapping.class);
// 获取url与类和方法的对应信息
Map<RequestMappingInfo, HandlerMethod> map = mapping.getHandlerMethods();
Set<String> set = new HashSet<>();
for (Map.Entry<RequestMappingInfo, HandlerMethod> m : map.entrySet()) {
Map<String, String> map1 = new HashMap<String, String>();
RequestMappingInfo info = m.getKey();
HandlerMethod method = m.getValue();
Anonymous anonymous = method.getMethodAnnotation(Anonymous.class);
if (null != anonymous) {
PatternsRequestCondition p = info.getPatternsCondition();
for (String url : p.getPatterns()) {
set.add(url);
}
}
}
return set;
}
}