Spring Security与RBAC用户模型-六虎

我报名参加金石计划1期应战——瓜分10万奖池，这是我的第1篇文章，点击检查活动详情

版本 Java (1.8+) Spring Boot (2.7.3) Spring Security (5.7.3)

一、介绍Security

官方原话“Spring Security is a framework that provides authentication, authorization, and protection against common attacks”即”Spring Security 是一个供给身份验证、授权和避免常见攻击的框架”。它是Spring供给的一个安全框架，能够依据运用者需要定制相关验证授权操作，配合Spring Boot能够快速开发一套完善的权限系统。

二、快速上手

创立一个Spring Boot项目并导入如下依赖或点击下载示例代码

		<dependency>
			<groupId>org.springframework.boot</groupId>
			<artifactId>spring-boot-starter-security</artifactId>
		</dependency>
		<dependency>
			<groupId>org.springframework.boot</groupId>
			<artifactId>spring-boot-starter-web</artifactId>
		</dependency>

运行 Spring Boot 应用程序

若是正确发动了，能够看到 Spring Security 生成了一段默许暗码。

...
2022-09-13 23:56:07.841  WARN 19924 --- [           main] .s.s.UserDetailsServiceAutoConfiguration : 
Using generated security password: 70a36ac6-70c1-4f72-822c-71165988c56e
...

拜访 http://localhost:8080/ 会跳转到/login登录页面，输入账号(user)暗码(操控台自动生成的暗码)以持续拜访。

Srping Security主要解决的问题是安全拜访操控，其完成原理是通过Filter对进入系统的恳求进行拦截。当初始化Spring Security时，它创立了一个名为 springSecurityFilterChain的Servlet 过滤器，负责程序中的所以安全操控。

三、基本原理

DelegatingFilterProxy

从必要常识里咱们知道了Filter的作业原理，在Spring中运用自定义的Filter有个问题那便是Filter有必要在Servlet容器发动前就注册好，但是Spring运用ContextLoaderListener来加载Spring Bean，所以规划了DelegatingFilterProxy。本质上来说DelegatingFilterProxy便是一个Filter，其直接完成了Filter接口，它嵌入在Servlet Filter Chain中，但是在doFilter中其实调用的从Spring 容器中获取到的代理Filter的完成类delegate。

FilterChainProxy和SecurityFilterChain

FilterChainProxy 是 Spring Security 供给的一个特殊 Filter，DelegatingFilterProxy并不是直接实例化和调用Spring Security Filter，而是构建了一个FilterChainProxy，当有恳求进来就会去履行doFilter办法调用SecurityFilterChain所包含的各个Filter，一起这些Filter作为Bean被Spring办理，它是Spring Security运用的核心。

此外，SecurityFilterChain 供给了更大的灵活性，Servlet容器中，仅依据URL调用过滤器。但是，FilterChainProxy能够使用RequestMatcher接口，依据HttpServletRequest中的任何内容确定调用，比原生的Servlet更灵活，此外，FilterChainProxy能够构建多条SecurityFilterChain，你的应用程序能够为不同的状况供给完全独立的装备，如下图所示。

过滤器链中主要的几个过滤器及其效果

SecurityContextPersistenceFilter ：这个Filter是整个拦截过程的进口，会在恳求开始时从装备好的 SecurityContextRepository 中获取 SecurityContext，然后把它设置给 SecurityContextHolder。在恳求完成后将 SecurityContextHolder 持有的 SecurityContext 再保存到装备好的 SecurityContextRepository，一起铲除 securityContextHolder 所持有的 SecurityContext。
UsernamePasswordAuthenticationFilter ：用于处理来自表单提交的认证。该表单有必要供给对应的用户名和暗码，其内部还有登录成功或失利后进行处理的 AuthenticationSuccessHandler 和 AuthenticationFailureHandler，这些都能够依据需求做相关改动；。
LogoutFilter：用来处理完成用户登出和铲除认证信息作业，登出成功后履行LogoutSuccessHandler，这儿能够自定义完成一些功用。
FilterSecurityInterceptor：是用于维护web资源的，运用AccessDecisionManager对当时用户进行授权拜访
ExceptionTranslationFilter：能够捕获来自 FilterChain 一切的反常，并进行处理。但是它只会处理两类反常： AuthenticationException 和 AccessDeniedException，其它的反常它会持续抛出。

反常处理

首要，ExceptionTranslationFilter 调用 FilterChain.doFilter(request, response) 来调用应用程序的其余部分。
如果用户未通过身份验证或者是 AuthenticationException，则发动身份验证。
- SecurityContextHolder 被铲除
- HttpServletRequest 保存在 RequestCache 中。当用户成功认证后，RequestCache 用于重放原始恳求。
- AuthenticationEntryPoint 用于发动身份验证。例如，它可能重定向到登录页面或BASIC认证等。
- 否则，如果是 AccessDeniedException，则回绝拜访。调用 AccessDeniedHandler 来处理回绝拜访。

表单登录

以上示例在未授权的状况下拜访会通过以下安全过滤器：

Security filter chain: [
  DisableEncodeUrlFilter
  WebAsyncManagerIntegrationFilter
  SecurityContextPersistenceFilter
  HeaderWriterFilter
  CsrfFilter
  LogoutFilter
  UsernamePasswordAuthenticationFilter
  DefaultLoginPageGeneratingFilter
  DefaultLogoutPageGeneratingFilter
  BasicAuthenticationFilter
  RequestCacheAwareFilter
  SecurityContextHolderAwareRequestFilter
  AnonymousAuthenticationFilter
  SessionManagementFilter
  ExceptionTranslationFilter
  FilterSecurityInterceptor
]

当没有登录的时分默许是anonymousUser匿名用户，通过一些列过滤器处理后，最后由FilterSecurityInterceptor进行权限校验授权，AccessDecisionManager进行授权投票，匿名用户不允许拜访该接口，恳求被回绝重定向到登录页面，接着由DefaultLoginPageGeneratingFilter（自定义表单则不会初始化这个Filter）生成默许登录界面输出到浏览器。登录时通过UsernamePasswordAuthenticationFilter，只需用户恳求满足该过滤器要求，则认证成功，接着是授权成功拜访通过。

每个过滤器都有不同的功用，组织在一起形成了强大的安全系统，你能够在过滤链中自定义过滤器，里边的逻辑我就不一一细说了没啥好讲的，官方文档中都有介绍。下面讲讲我自己的一些完成吧。

四、我完成思路是什么，我是怎样完成的

背景：拓宽Spring Security完成根据Token的API认证授权基础程序

选用的广为熟知的RBAC 模型，根据人物的拜访操控(Role-Based Access Control)

拓宽点：

禁用CSRF（有个过滤器校验会报错）、会话办理设置为无状况STATELESS（因为咱们要自定义处理登录刊出逻辑）
自定义UserDetailsService 重写loadUserByUsername办法，从数据库中读取账号信息
添加自定义Token认证过滤器
自定义登录成功和失利处理器successHandler与failureHandler
自定义刊出处理器LogoutSuccessHandler
自定义反常处理器AuthenticationEntryPoint与AccessDeniedHandler
自定义AuthorizationManager

开发调试能够设置一下日志输出等级，这样能助于咱们更快的剖析和排查问题：

logging:
  level:
    org.springframework.web: trace
    org.springframework.security: trace

另外 @EnableWebSecurity 这个注解debug特点设置为true也能看到更多的日志信息，这对咱们很有帮助。

SecurityConfiguration 核心装备类

@EnableWebSecurity(debug = false)
public class SecurityConfiguration {
	private final AppUserDetailsService userDetailsService;
	private final AbstractStringCacheStore cacheStore;
	private final AuthenticationTokenFilter authenticationTokenFilter;
	private final PermissionAuthorizationManager<RequestAuthorizationContext> permissionAuthorizationManager;
	public SecurityConfiguration(AppUserDetailsService userDetailsService, AbstractStringCacheStore cacheStore, PermissionAuthorizationManager<RequestAuthorizationContext> permissionAuthorizationManager) {
		this.userDetailsService = userDetailsService;
		this.cacheStore = cacheStore;
		this.permissionAuthorizationManager = permissionAuthorizationManager;
		this.authenticationTokenFilter = new AuthenticationTokenFilter(cacheStore, userDetailsService);
	}
	@Bean
	public WebSecurityCustomizer webSecurityCustomizer() {
		return (web) -> web.ignoring()
				// Spring Security should completely ignore URLs starting with /resources/
				.antMatchers("/resources/**");
	}
	@Bean
	public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
		http.authorizeHttpRequests()
				.antMatchers(HttpMethod.OPTIONS, "/**").permitAll()
				.antMatchers("/").permitAll()
				.antMatchers("/user/info").authenticated() // 需要认证
				.anyRequest().access(permissionAuthorizationManager) // 动态权限认证
				.and()
					.userDetailsService(userDetailsService)
					.formLogin()
					.permitAll()
					.successHandler(new CustomizeAuthenticationSuccessHandler(cacheStore))
					.failureHandler(new AuthenticationEntryPointFailureHandler(new CustomizeAuthenticationEntryPoint()))
				.and()
					.logout()
					.logoutSuccessHandler(new CustomizeLogoutSuccessHandler(cacheStore))
				.and()
					.exceptionHandling()
					.authenticationEntryPoint(new CustomizeAuthenticationEntryPoint())
					.accessDeniedHandler(new CustomizeAccessDeniedHandler())
				.and()
					.csrf().disable()
					.sessionManagement()
					.sessionCreationPolicy(SessionCreationPolicy.STATELESS)
				.and()
					.addFilterBefore(authenticationTokenFilter, UsernamePasswordAuthenticationFilter.class)
					.addFilterBefore(authenticationTokenFilter, LogoutFilter.class);
		return http.build();
	}

释义: AuthenticationTokenFilter-Token认证过滤器（除了自定义开放的接口外都会被调用） PermissionAuthorizationManager-动态权限授权办理器（根据人物与资源权限表） CustomizeAuthenticationSuccessHandler-登录处理器（登录成功后被调用用于生成Token） CustomizeLogoutSuccessHandler-刊出处理器（刊出成功后被调用用于铲除Toekn） CustomizeAuthenticationEntryPoint-认证失利处理器（认证出现反常被调用） CustomizeAccessDeniedHandler-授权失利处理器（授权出现反常被调用，如权限不足以拜访某接口） AbstractStringCacheStore-缓存类（用于缓存Token）

CustomizeAuthenticationSuccessHandler 登录处理器

@Slf4j
public class CustomizeAuthenticationSuccessHandler implements AuthenticationSuccessHandler {
	private final AbstractStringCacheStore cacheStore;
	/**
	 * Expired seconds.
	 */
	private static final int ACCESS_TOKEN_EXPIRED_SECONDS = 24 * 3600;
	private static final int REFRESH_TOKEN_EXPIRED_DAYS = 30;
	public CustomizeAuthenticationSuccessHandler(AbstractStringCacheStore cacheStore) {
		this.cacheStore = cacheStore;
	}
	@Override
	public void onAuthenticationSuccess(HttpServletRequest request, HttpServletResponse response, Authentication authentication) throws IOException {
		AppUserDetails userDetails = (AppUserDetails) SecurityContextHolder.getContext().getAuthentication().getPrincipal();
		// Generate new token
		AuthToken token = new AuthToken();
		token.setAccessToken(BottleUtils.randomUUIDWithoutDash());
		token.setExpiredIn(ACCESS_TOKEN_EXPIRED_SECONDS);
		token.setRefreshToken(BottleUtils.randomUUIDWithoutDash());
		// Cache those tokens, just for clearing
		cacheStore.putAny(SecurityUtils.buildAccessTokenKey(userDetails), token.getAccessToken(),
				ACCESS_TOKEN_EXPIRED_SECONDS, TimeUnit.SECONDS);
		cacheStore.putAny(SecurityUtils.buildRefreshTokenKey(userDetails), token.getRefreshToken(),
				REFRESH_TOKEN_EXPIRED_DAYS, TimeUnit.DAYS);
		// Cache those tokens with user id
		cacheStore.putAny(SecurityUtils.buildTokenAccessKey(token.getAccessToken()), userDetails.getUserId(),
				ACCESS_TOKEN_EXPIRED_SECONDS, TimeUnit.SECONDS);
		cacheStore.putAny(SecurityUtils.buildTokenRefreshKey(token.getRefreshToken()), userDetails.getUserId(),
				REFRESH_TOKEN_EXPIRED_DAYS, TimeUnit.DAYS);
		response.setCharacterEncoding("utf-8");
		response.setStatus(HttpServletResponse.SC_OK);
		response.setContentType(MediaType.APPLICATION_JSON_VALUE);
		response.getWriter().write(JsonUtils.objectToJson(BaseResponse.ok("登录成功！", token)));
	}

LogoutSuccessHandler 刊出处理器

@Slf4j
public class CustomizeLogoutSuccessHandler implements LogoutSuccessHandler {
	private final AbstractStringCacheStore cacheStore;
	public CustomizeLogoutSuccessHandler(AbstractStringCacheStore cacheStore) {
		this.cacheStore = cacheStore;
	}
	@Override
	public void onLogoutSuccess(HttpServletRequest request, HttpServletResponse response, Authentication authentication) throws IOException, ServletException {
		if (Objects.isNull(authentication)) {
			return;
		}
		AppUserDetails userDetails = (AppUserDetails) authentication.getPrincipal();
		// Clear access token
		cacheStore.getAny(SecurityUtils.buildAccessTokenKey(userDetails), String.class)
				.ifPresent(accessToken -> {
					// Delete token
					cacheStore.delete(SecurityUtils.buildTokenAccessKey(accessToken));
					cacheStore.delete(SecurityUtils.buildAccessTokenKey(userDetails));
				});
		// Clear refresh token
		cacheStore.getAny(SecurityUtils.buildRefreshTokenKey(userDetails), String.class)
				.ifPresent(refreshToken -> {
					cacheStore.delete(SecurityUtils.buildTokenRefreshKey(refreshToken));
					cacheStore.delete(SecurityUtils.buildRefreshTokenKey(userDetails));
				});
		response.setCharacterEncoding("utf-8");
		response.setStatus(HttpServletResponse.SC_OK);
		response.setContentType(MediaType.APPLICATION_JSON_VALUE);
		response.getWriter().write(JsonUtils.objectToJson(BaseResponse.ok("登出成功！", null)));
		log.info("You have been logged out, looking forward to your next visit!");
	}
}

AuthenticationTokenFilter Token认证过滤器

@Slf4j
public class AuthenticationTokenFilter extends OncePerRequestFilter {
	private static final String AUTHENTICATION_SCHEME_BEARER = "Bearer";
	private final AbstractStringCacheStore cacheStore;
	private final AppUserDetailsService appUserDetailsService;
	public AuthenticationTokenFilter(AbstractStringCacheStore cacheStore, AppUserDetailsService appUserDetailsService) {
		this.cacheStore = cacheStore;
		this.appUserDetailsService = appUserDetailsService;
	}
	@Override
	protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException {
		// Get token from request header
		String accessToken = request.getHeader(HttpHeaders.AUTHORIZATION);
		if (!StringUtils.hasText(accessToken)) {
			// Do filter
			filterChain.doFilter(request, response);
			return;
		}
		if (!StringUtils.startsWithIgnoreCase(accessToken, AUTHENTICATION_SCHEME_BEARER)) {
			throw new BadCredentialsException("Token 有必要以bearer开头");
		}
		if (accessToken.equalsIgnoreCase(AUTHENTICATION_SCHEME_BEARER)) {
			throw new BadCredentialsException("Token 不能为空");
		}
		// Get token body
		accessToken = accessToken.substring(AUTHENTICATION_SCHEME_BEARER.length() + 1);
		Optional<Long> optionalUserId = cacheStore.getAny(SecurityUtils.buildTokenAccessKey(accessToken), Long.class);
		if (!optionalUserId.isPresent()) {
			log.debug("Token 已过期或不存在 [{}]", accessToken);
			filterChain.doFilter(request, response);
			return;
		}
		UserDetails userDetails = appUserDetailsService.loadUserById(optionalUserId.get());
		UsernamePasswordAuthenticationToken authentication =
				new UsernamePasswordAuthenticationToken(userDetails, null, userDetails.getAuthorities());
		SecurityContextHolder.getContext().setAuthentication(authentication);
		// Do filter
		filterChain.doFilter(request, response);
	}
}

CustomizeAuthenticationEntryPoint 认证反常处理器

@Slf4j
public class CustomizeAuthenticationEntryPoint implements AuthenticationEntryPoint {
	@Override
	public void commence(HttpServletRequest request, HttpServletResponse response, AuthenticationException authException) throws IOException, ServletException {
		BaseResponse<Object> errorDetail = handleBaseException(authException);
		errorDetail.setData(Collections.singletonMap("uri", request.getRequestURI()));
		response.setCharacterEncoding("utf-8");
		response.setStatus(HttpStatus.UNAUTHORIZED.value());
		response.setContentType(MediaType.APPLICATION_JSON_VALUE);
		response.getWriter().write(JsonUtils.objectToJson(errorDetail));
	}
	private BaseResponse<Object> handleBaseException(Throwable t) {
		Assert.notNull(t, "Throwable must not be null");
		BaseResponse<Object> errorDetail = new BaseResponse<>();
		errorDetail.setStatus(HttpStatus.UNAUTHORIZED.value());
		if (log.isDebugEnabled()) {
			errorDetail.setDevMessage(ExceptionUtils.getStackTrace(t));
		}
		if (t instanceof AccountExpiredException){
			errorDetail.setMessage("账户过期");
		} else if (t instanceof DisabledException){
			errorDetail.setMessage("账号被禁用");
		} else if (t instanceof LockedException){
			errorDetail.setMessage("账户被锁定");
		} else if (t instanceof AuthenticationCredentialsNotFoundException){
			errorDetail.setMessage("用户身份凭证未找到");
		} else if (t instanceof AuthenticationServiceException){
			errorDetail.setMessage("用户身份认证服务反常");
		} else if (t instanceof BadCredentialsException){
			errorDetail.setMessage(t.getMessage());
		} else {
			errorDetail.setMessage("拜访未授权");
		}
		return errorDetail;
	}
}

CustomizeAccessDeniedHandler 授权反常

public class CustomizeAccessDeniedHandler implements AccessDeniedHandler {
	@Override
	public void handle(HttpServletRequest request, HttpServletResponse response, AccessDeniedException accessDeniedException) throws IOException, ServletException {
		BaseResponse<Object> errorDetail = new BaseResponse<>();
		errorDetail.setStatus(HttpStatus.FORBIDDEN.value());
		errorDetail.setMessage("制止拜访");
		response.setCharacterEncoding("utf-8");
		response.setStatus(HttpServletResponse.SC_FORBIDDEN);
		response.setContentType(MediaType.APPLICATION_JSON_VALUE);
		response.getWriter().write(JsonUtils.objectToJson(errorDetail));
	}
}

PermissionAuthorizationManager 动态权限授权办理

@Slf4j
@Component
public class PermissionAuthorizationManager<T> implements AuthorizationManager<T> {
	private final AuthenticationTrustResolver trustResolver = new AuthenticationTrustResolverImpl();
	private final PermissionService permissionService;
	public PermissionAuthorizationManager(PermissionService permissionService) {
		this.permissionService = permissionService;
	}
	@Override
	public AuthorizationDecision check(Supplier<Authentication> authentication, T object) {
		// Determines if the current user is authorized by evaluating if the
		boolean granted = isGranted(authentication.get());
		if (!granted) {
			return new AuthorizationDecision(false);
		}
		Collection<? extends GrantedAuthority> authorities = authentication.get().getAuthorities();
		Set<String> authority = authorities
				.stream()
				.map(GrantedAuthority::getAuthority)
				.collect(Collectors.toSet());
		log.debug("username [{}] hav roles:[{}]", authentication.get().getName(), authority);
		RequestAuthorizationContext requestAuthorizationContext = (RequestAuthorizationContext)object;
		String servletPath = requestAuthorizationContext.getRequest().getRequestURI();
		log.debug("access url:{}", servletPath);
		AppUserDetails userDetails = (AppUserDetails)authentication.get().getPrincipal();
		List<Long> roleIds = userDetails.getRoles().stream().map(Role::getId).collect(Collectors.toList());
		List<Permission> permissions = permissionService.listByRoleIds(roleIds);
		boolean agreeFlag = permissions.stream()
				.anyMatch(permission -> isRouter(permission) && permission.getUrl().equals(servletPath));
		log.debug("check result:{}", agreeFlag);
		return new AuthorizationDecision(agreeFlag);
	}
	private boolean isGranted(Authentication authentication) {
		return authentication != null && isNotAnonymous(authentication) && authentication.isAuthenticated();
	}
	private boolean isNotAnonymous(Authentication authentication) {
		return !this.trustResolver.isAnonymous(authentication);
	}
	private boolean isRouter(Permission permission) {
		return "1".equals(permission.getType());
	}
}

五、示例

登录成功

POST /login?username=user&password=123456
Host: localhost:8080
response:
{
    "status": 200,
    "message": "登录成功！",
    "devMessage": null,
    "data": {
        "access_token": "8430064e7d9b497c8b786a33b0524bc5",
        "expired_in": 86400,
        "refresh_token": "8d2c6fb3489b47389a65cbf79f732f9a"
    }
}

登录失利

POST /login?username=user&password=123
Host: localhost:8080
response:
{
    "status": 401,
    "message": "用户名或暗码过错",
    "devMessage": "org.springframework.security.authentication.BadCredentialsException: 用户名或暗码过错...",
    "data": {
        "uri": "/login"
    }
}

登录刊出

POST /logout
Host: localhost:8080
Authorization: Bearer b6422e3462224126a67f876b5f1b3a1e
response:
{
    "status": 200,
    "message": "登出成功！",
    "devMessage": null,
    "data": null
}

未登录或Token过期

POST /logout
Host: localhost:8080
Authorization: Bearer b6422e3462224126a67f876b5f1b3a1e
response:
{
    "status": 401,
    "message": "拜访未授权",
    "devMessage": "org.springframework.security.authentication.InsufficientAuthenticationException: Full authentication is required to access this resource...",
    "data": {
        "uri": "/user/info"
    }
}

权限不足

GET /admin
Host: localhost:8080
Authorization: Bearer f7a542c4899a4e6ea5039002a8f19110
response:
{
    "status": 403,
    "message": "制止拜访",
    "devMessage": null,
    "data": null
}

六、小结

好了，就分享到这儿了，希望对大家有所帮助，另外如有理解过错的地方请多多指教。 Spring Security还有很多值得探索的功用，持续学习吧~

官方文档：spring-security 项目地址：gitee

Spring Security与RBAC用户模型

一、介绍Security

二、快速上手

三、基本原理

DelegatingFilterProxy

FilterChainProxy和SecurityFilterChain

过滤器链中主要的几个过滤器及其效果

反常处理

表单登录

四、我完成思路是什么，我是怎样完成的

SecurityConfiguration 核心装备类

CustomizeAuthenticationSuccessHandler 登录处理器

LogoutSuccessHandler 刊出处理器

AuthenticationTokenFilter Token认证过滤器

CustomizeAuthenticationEntryPoint 认证反常处理器

CustomizeAccessDeniedHandler 授权反常

PermissionAuthorizationManager 动态权限授权办理

五、示例

登录失利

登录刊出

未登录或Token过期

权限不足

六、小结

作者信息

推广

Spring Security与RBAC用户模型

一、介绍Security

二、快速上手

三、基本原理

DelegatingFilterProxy

FilterChainProxy和SecurityFilterChain

过滤器链中主要的几个过滤器及其效果

反常处理

表单登录

四、我完成思路是什么，我是怎样完成的

SecurityConfiguration 核心装备类

CustomizeAuthenticationSuccessHandler 登录处理器

LogoutSuccessHandler 刊出处理器

AuthenticationTokenFilter Token认证过滤器

CustomizeAuthenticationEntryPoint 认证反常处理器

CustomizeAccessDeniedHandler 授权反常

PermissionAuthorizationManager 动态权限授权办理

五、示例

登录失利

登录刊出

未登录或Token过期

权限不足

六、小结

相关文章

是时候使用nvim来代替VSCode了

JVM系列-Java agent超详细知识梳理

Python 使用xlwings库操作excel的简明实践分享之表格操作

Rust HTTP 框架设计 – 以 Axum 0.6 为例

作者信息

推广