Spring Security 实战干货：动态权限控制（下）实现

Spring Security 的 Java Configuration 不会公开它配置的每个 object 的每个 property。这简化了大多数用户的配置。
虽然有充分的理由不直接公开每个 property，但用户可能仍需要像本文一样的取实现个性化需求。为了解决这个问题，Spring Security 引入了 ObjectPostProcessor 的概念，它可用于修改或替换 Java Configuration 创建的许多 Object 实例。 FilterSecurityInterceptor 的替换配置正是通过这种方式来进行：

@Configuration
@ConditionalOnClass(WebSecurityConfigurerAdapter.class)
@ConditionalOnWebApplication(type = ConditionalOnWebApplication.Type.SERVLET)
public class CustomSpringBootWebSecurityConfiguration {
    private static final String LOGIN_PROCESSING_URL = "/process";

    
    @Bean
    public JsonLoginPostProcessor jsonLoginPostProcessor() {
 return new JsonLoginPostProcessor();
    }

    
    @Bean
    public PreLoginFilter preLoginFilter(Collection loginPostProcessors) {
 return new PreLoginFilter(LOGIN_PROCESSING_URL, loginPostProcessors);
    }

    
    @Bean
    public JwtAuthenticationFilter jwtAuthenticationFilter(JwtTokenGenerator jwtTokenGenerator, JwtTokenStorage jwtTokenStorage) {
 return new JwtAuthenticationFilter(jwtTokenGenerator, jwtTokenStorage);
    }

    
    @Configuration
    @Order(SecurityProperties.BASIC_AUTH_ORDER)
    static class DefaultConfigurerAdapter extends WebSecurityConfigurerAdapter {

 @Autowired
 private JwtAuthenticationFilter jwtAuthenticationFilter;
 @Autowired
 private PreLoginFilter preLoginFilter;
 @Autowired
 private AuthenticationSuccessHandler authenticationSuccessHandler;
 @Autowired
 private AuthenticationFailureHandler authenticationFailureHandler;
 @Autowired
 private FilterInvocationSecuritymetadataSource filterInvocationSecuritymetadataSource;
 @Autowired
 private AccessDecisionManager accessDecisionManager;

 @Override
 protected void configure(AuthenticationManagerBuilder auth) throws Exception {
     super.configure(auth);
 }

 @Override
 public void configure(WebSecurity web) {
     super.configure(web);
 }

 @Override
 protected void configure(HttpSecurity http) throws Exception {
     http.csrf().disable()
      .cors()
      .and()
      // session 生成策略用无状态策略
      .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS)
      .and()
      .exceptionHandling().accessDeniedHandler(new SimpleAccessDeniedHandler()).authenticationEntryPoint(new SimpleAuthenticationEntryPoint())
      .and()
      //   动态权限配置
      .authorizeRequests().anyRequest().authenticated().withObjectPostProcessor(filterSecurityInterceptorObjectPostProcessor())
      .and()
      .addFilterBefore(preLoginFilter, UsernamePasswordAuthenticationFilter.class)
      // jwt 必须配置于 UsernamePasswordAuthenticationFilter 之前
      .addFilterBefore(jwtAuthenticationFilter, UsernamePasswordAuthenticationFilter.class)
      // 登录  成功后返回jwt token  失败后返回 错误信息
      .formLogin().loginProcessingUrl(LOGIN_PROCESSING_URL).successHandler(authenticationSuccessHandler).failureHandler(authenticationFailureHandler)
      .and().logout().addLogoutHandler(new CustomLogoutHandler()).logoutSuccessHandler(new CustomLogoutSuccessHandler());

 }

 
 private ObjectPostProcessor filterSecurityInterceptorObjectPostProcessor() {
     return new ObjectPostProcessor() {
  @Override
  public  O postProcess(O object) {
      object.setAccessDecisionManager(accessDecisionManager);
      object.setSecuritymetadataSource(filterInvocationSecuritymetadataSource);
      return object;
  }
     };
 }

    }
}