spring-security-oauth2 中優雅的擴展自定義(短信驗證碼)登錄方式-系列3

發送驗證碼的Controller

首先我們需要創建一個發送驗證碼的 Controller, 至於如何實現,這里就不多說了,大家都會的,本篇重點說明驗證部分.
【注意】在認證服務器上增加自己的 Controller, 默認情況下訪問是返回403,有兩種辦法解決:

1. 把認證服務器也配制為資源服務器,既: 它既是認證服務器,也是資源服務器.並配制新增的Controller為任何人都能訪問
2. 關閉認證服務器的 csrf.

由於我在認證服務器上增加的都是認證相關的功能,任何人都能訪問,不需要資源保護,所以我選擇了第二種方法.

關閉認證服務器的 csrf

在配制認證服務器的時候,我們創建過一個org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter 的子類用於安全配制. 如果你當時沒有配制,增加一個就行.

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;

@Configuration
@EnableWebSecurity
public class SecurityConfiguration extends WebSecurityConfigurerAdapter {
	@Override
    protected void configure(HttpSecurity http) throws Exception {
        http.csrf().disable();  // 關閉 csrf
    }
}

　　

增加短信驗證碼的 TokenGranter

參考 org.springframework.security.oauth2.provider.password.ResourceOwnerPasswordTokenGranter 的代碼

import org.apache.commons.lang3.StringUtils;
import org.springframework.core.env.Environment;
import org.springframework.security.authentication.AbstractAuthenticationToken;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsChecker;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.oauth2.common.exceptions.InvalidGrantException;
import org.springframework.security.oauth2.provider.ClientDetails;
import org.springframework.security.oauth2.provider.ClientDetailsService;
import org.springframework.security.oauth2.provider.OAuth2Authentication;
import org.springframework.security.oauth2.provider.OAuth2Request;
import org.springframework.security.oauth2.provider.OAuth2RequestFactory;
import org.springframework.security.oauth2.provider.TokenRequest;
import org.springframework.security.oauth2.provider.token.AbstractTokenGranter;
import org.springframework.security.oauth2.provider.token.AuthorizationServerTokenServices;

public class SMSCodeTokenGranter extends AbstractTokenGranter {

    private static final String GRANT_TYPE = "sms_code";

    public SMSCodeLoginTokenGranter(AuthorizationServerTokenServices tokenServices,
        ClientDetailsService clientDetailsService, OAuth2RequestFactory requestFactory) {
    super(tokenServices, clientDetailsService, requestFactory, GRANT_TYPE);
    }

    @Override
    protected OAuth2Authentication getOAuth2Authentication(ClientDetails client,
        TokenRequest tokenRequest) {
    
    Map<String, String> parameters = new LinkedHashMap<String, String>(tokenRequest.getRequestParameters());
    String userMobileNo = parameters.get("username");  //客戶端提交的用戶名
    String smscode = parameters.get("smscode");  //客戶端提交的驗證碼
    
    // 從庫里查用戶
    UserDetails user = 從庫里查找用戶的代碼略;
    if(user == null) {
        throw new InvalidGrantException("用戶不存在");
    }
    
    驗證用戶狀態(是否警用等),代碼略

    // 驗證驗證碼
    String smsCodeCached = 獲取服務中保存的用戶驗證碼,代碼略.一般我們是在生成好后放到緩存中
    if(StringUtils.isBlank(smsCodeCached)) {
        throw new InvalidGrantException("用戶沒有發送驗證碼");
    }
    if(!smscode.equals(smsCodeCached)) {
        throw new InvalidGrantException("驗證碼不正確");
    }else {
        驗證通過后從緩存中移除驗證碼,代碼略
    }

    
    Authentication userAuth = new UsernamePasswordAuthenticationToken(user, null, user.getAuthorities());
    // 關於user.getAuthorities(): 我們的自定義用戶實體是實現了 
    // org.springframework.security.core.userdetails.UserDetails 接口的, 所以有 user.getAuthorities()
    // 當然該參數傳null也行
    ((AbstractAuthenticationToken) userAuth).setDetails(parameters);
    
    OAuth2Request storedOAuth2Request = getRequestFactory().createOAuth2Request(client, tokenRequest);        
    return new OAuth2Authentication(storedOAuth2Request, userAuth);
    }

}

把 SMSCodeTokenGranter 加入到 CompositeTokenGranter 需要的 List 中

在上一篇中我們修改了 OAuth2AuthorizationServerConfig類,現在繼續修改:
我們在 getDefaultTokenGranters 方法中加入: getDefaultTokenGranters 的完整代碼:

private List<TokenGranter> getDefaultTokenGranters() {
	ClientDetailsService clientDetails = clientDetailsService();
	AuthorizationServerTokenServices tokenServices = tokenServices();
	AuthorizationCodeServices authorizationCodeServices = authorizationCodeServices();
	OAuth2RequestFactory requestFactory = requestFactory();

	List<TokenGranter> tokenGranters = new ArrayList<TokenGranter>();
	tokenGranters.add(new AuthorizationCodeTokenGranter(tokenServices,
		authorizationCodeServices, clientDetails, requestFactory));
	tokenGranters.add(new RefreshTokenGranter(tokenServices, clientDetails, requestFactory));
	ImplicitTokenGranter implicit = new ImplicitTokenGranter(tokenServices, clientDetails,
		requestFactory);
	tokenGranters.add(implicit);
	tokenGranters.add(
		new ClientCredentialsTokenGranter(tokenServices, clientDetails, requestFactory));
	if (authenticationManager != null) {
	    tokenGranters.add(new ResourceOwnerPasswordTokenGranter(authenticationManager,
		    tokenServices, clientDetails, requestFactory));
	}
	
	tokenGranters.add(new SMSCodeLoginTokenGranter(tokenServices, clientDetails, requestFactory, userDetailsService));
	return tokenGranters;
    }

　　

其他代碼不用修改

如何使用我們新增的短信驗證碼方式?

我們調用 /oauth/token 進行認證的時候,有一個 grant_type 參數,我們把它的值改為 sms_code
password 參數可以不要了,新增一個 smscode 參數
當然,上面的 “sms_code” 和 “smscode” 也是可以修改的:
“sms_code” 對應 SMSCodeTokenGranter 中的靜態常量 GRANT_TYPE
“smscode” 對應 SMSCodeTokenGranter.getOAuth2Authentication 方法中的 parameters.get(“smscode”);