Spring Security OAuth2使用攔截器實現多用戶類型認證

Spring Security OAuth2實現多用戶類型認證

 

          用OAuth2想實現一個認證服務器能夠認證多種用戶類型，如前台普通用戶、后台管理員用戶（分了不同的表了），想在請求token、刷新token的時候通過一個字段區分用戶類型，但是OAuth2默認提供的UserDetailsService只允許傳入一個參數，這樣就區分不了用戶類型了

public interface UserDetailsService {
    UserDetails loadUserByUsername(String var1) throws UsernameNotFoundException;
}

 

實現

1 登陸獲取token

1.1 新增CustomUserDetailsService extends UserDetailsService，新增自定義的方法

/**
 * 繼承原來的UserDetailsService新增自定義方法
 */
public interface CustomUserDetailsService extends UserDetailsService {

    UserDetails loadUserByUsername(String var1, String var2) throws UsernameNotFoundException;

}

然后根據自己需要實現它，這里就不放出來了

public class UserDetailsServiceImpl implements CustomUserDetailsService {
    @Override
    public UserDetails loadUserByUsername(String username, String userType) throws UsernameNotFoundException {
        // 根據自己需要進行實現
        // 1.獲取用戶
        // 2.獲取用戶可訪問權限信息
        // 3.構造UserDetails信息並返回
        return userDetail;
    }
}

從現在開始，所有需要用到userDetailsService的，全部都要替換成自定義CustomUserDetailsService

1.2 復制org.springframework.security.authentication.dao.DaoAuthenticationProvider 的代碼，自定義 CustomAuthenticationProvider，然后進行修改retrieveUser()方法，其他不需要動

記得將自定義的CustomAuthenticationProvider中的userDetailsService替換成自定義的CustomUserDetailsService

protected final UserDetails retrieveUser(String username, UsernamePasswordAuthenticationToken authentication) throws AuthenticationException {
        this.prepareTimingAttackProtection();
        Map<String,String> map = (Map<String, String>) authentication.getDetails(); // 自定義添加
        try {
            String userType = map.get("userType"); // 自定義添加
            UserDetails loadedUser = this.getUserDetailsService().loadUserByUsername(username, userType); // 自定義添加userType參數
            if (loadedUser == null) {
                throw new InternalAuthenticationServiceException("UserDetailsService returned null, which is an interface contract violation");
            } else {
                return loadedUser;
            }
        } catch (UsernameNotFoundException var4) {
            this.mitigateAgainstTimingAttack(authentication);
            throw var4;
        } catch (InternalAuthenticationServiceException var5) {
            throw var5;
        } catch (Exception var6) {
            throw new InternalAuthenticationServiceException(var6.getMessage(), var6);
        }
    }

 

1.3 到WebSecurityConfig配置上面的CustomAuthenticationProvider

@Bean(name="customAuthenticationProvider")
    public AuthenticationProvider customAuthenticationProvider() {
        CustomAuthenticationProvider customAuthenticationProvider= new CustomAuthenticationProvider();
        customAuthenticationProvider.setUserDetailsService(userDetailsService);
        customAuthenticationProvider.setHideUserNotFoundExceptions(false);
        customAuthenticationProvider.setPasswordEncoder(passwordEncoder());
        return customAuthenticationProvider;
    }
    
    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.authenticationProvider(customAuthenticationProvider());
    }

到這里，就可以去獲取token試試了

 

 

 

 

 

參考：

https://blog.csdn.net/weixin_43909881/article/details/104925068