SpringSecurity学习之自定义过滤器的实现代码

package com.bdqn.lyrk.security.study.web.filter;

import com.bdqn.lyrk.security.study.web.authentication.userjointimeauthentication;

import org.springframework.security.authentication.authenticationmanager;

import org.springframework.security.core.authentication;

import org.springframework.security.core.authenticationexception;

import org.springframework.security.web.authentication.abstractauthenticationprocessingfilter;

import org.springframework.security.web.util.matcher.antpathrequestmatcher;

import javax.servlet.servletexception;

import javax.servlet.http.httpservletrequest;

import javax.servlet.http.httpservletresponse;

import java.io.ioexception;

public class customerauthfilter extends abstractauthenticationprocessingfilter {

   private authenticationmanager authenticationmanager;

   public customerauthfilter(authenticationmanager authenticationmanager) {

     super ( new antpathrequestmatcher( "/login" , "post" ));

     this .authenticationmanager = authenticationmanager;

   }

   @override

   public authentication attemptauthentication(httpservletrequest request, httpservletresponse response) throws authenticationexception, ioexception, servletexception {

     string username = request.getparameter( "username" );

     userjointimeauthentication usernamepasswordauthenticationtoken = new userjointimeauthentication(username);

     authentication authentication = this .authenticationmanager.authenticate(usernamepasswordauthenticationtoken);

     if (authentication != null ) {

       super .setcontinuechainbeforesuccessfulauthentication( true );

     }

     return authentication;

   }

}

package com.bdqn.lyrk.security.study.web.authentication;

import org.springframework.security.authentication.abstractauthenticationtoken;

public class userjointimeauthentication extends abstractauthenticationtoken {

   private string username;

   public userjointimeauthentication(string username) {

     super ( null );

     this .username = username;

   }

   @override

   public object getcredentials() {

     return null ;

   }

   @override

   public object getprincipal() {

     return username;

   }

}

package com.bdqn.lyrk.security.study.web.authentication;

import com.bdqn.lyrk.security.study.app.pojo.student;

import org.springframework.security.authentication.authenticationprovider;

import org.springframework.security.core.authentication;

import org.springframework.security.core.authenticationexception;

import org.springframework.security.core.userdetails.userdetails;

import org.springframework.security.core.userdetails.userdetailsservice;

import java.util.date;

/**

  * 基本的验证方式

  *

  * @author chen.nie

  * @date 2018/6/12

  **/

public class userjointimeauthenticationprovider implements authenticationprovider {

   private userdetailsservice userdetailsservice;

   public userjointimeauthenticationprovider(userdetailsservice userdetailsservice) {

     this .userdetailsservice = userdetailsservice;

   }

   /**

    * 认证授权，如果jointime在当前时间之后则认证通过

    * @param authentication

    * @return

    * @throws authenticationexception

    */

   @override

   public authentication authenticate(authentication authentication) throws authenticationexception {

     string username = (string) authentication.getprincipal();

     userdetails userdetails = this .userdetailsservice.loaduserbyusername(username);

     if (!(userdetails instanceof student)) {

       return null ;

     }

     student student = (student) userdetails;

     if (student.getjointime().after( new date()))

       return new userjointimeauthentication(username);

     return null ;

   }

   /**

    * 只处理userjointimeauthentication的认证

    * @param authentication

    * @return

    */

   @override

   public boolean supports( class <?> authentication) {

     return authentication.getname().equals(userjointimeauthentication. class .getname());

   }

}

package com.bdqn.lyrk.security.study.app.config;

import com.bdqn.lyrk.security.study.app.service.userservice;

import com.bdqn.lyrk.security.study.web.authentication.userjointimeauthenticationprovider;

import com.bdqn.lyrk.security.study.web.filter.customerauthfilter;

import org.springframework.beans.factory.annotation.autowired;

import org.springframework.security.config.annotation.authentication.builders.authenticationmanagerbuilder;

import org.springframework.security.config.annotation.web.builders.httpsecurity;

import org.springframework.security.config.annotation.web.builders.websecurity;

import org.springframework.security.config.annotation.web.configuration.enablewebsecurity;

import org.springframework.security.config.annotation.web.configuration.websecurityconfigureradapter;

import org.springframework.security.web.authentication.usernamepasswordauthenticationfilter;

/**

  * spring-security的相关配置

  *

  * @author chen.nie

  * @date 2018/6/7

  **/

@enablewebsecurity

public class websecurityconfig extends websecurityconfigureradapter {

   @autowired

   private userservice userservice;

   @override

   protected void configure(httpsecurity http) throws exception {

     /*

       1.配置静态资源不进行授权验证

       2.登录地址及跳转过后的成功页不需要验证

       3.其余均进行授权验证

      */

     http.

         authorizerequests().antmatchers( "/static/**" ).permitall().

         and().authorizerequests().antmatchers( "/user/**" ).hasrole( "7022" ).

         and().authorizerequests().anyrequest().authenticated().

         and().formlogin().loginpage( "/login" ).successforwardurl( "/toindex" ).permitall()

         .and().logout().logouturl( "/logout" ).invalidatehttpsession( true ).deletecookies().permitall()

     ;

     http.addfilterbefore( new customerauthfilter(authenticationmanager()), usernamepasswordauthenticationfilter. class );

   }

   @override

   protected void configure(authenticationmanagerbuilder auth) throws exception {

     //设置自定义userservice

     auth.userdetailsservice(userservice);

     auth.authenticationprovider( new userjointimeauthenticationprovider(userservice));

   }

   @override

   public void configure(websecurity web) throws exception {

     super .configure(web);

   }

}