項(xiàng)目地址:https://github.com/liangjinquan17/spring-security-demo
簡要:新增校驗(yàn)方式主要是通過實(shí)現(xiàn)TokenGranter、AuthenticationProvider和Authentication接口轮锥。當(dāng)然他們都有現(xiàn)成的抽象類或者具體類，你也可以選擇分別繼承他們?nèi)缓笾貙懖糠址椒?/p>

1.第一步實(shí)現(xiàn)校驗(yàn)類（實(shí)現(xiàn)Authentication接口，這類貫穿TokenGranter和AuthenticationProvider）

import java.util.Collection;
import java.util.List;

import org.springframework.security.core.Authentication;
import org.springframework.security.core.GrantedAuthority;

public class MyAuthentication implements Authentication {
    
    private static final long serialVersionUID = -9095353071305602273L;
    
    public MyAuthentication(String name, List<GrantedAuthority> authenrities, Object credentials, Object details, Object principal, boolean isAuthenticated) {
        this.name = name;
        this.authenrities = authenrities;
        this.credentials = credentials;
        this.details = details;
        this.principal = principal;
        this.isAuthenticated = isAuthenticated;
    }
    
    private String name;
    private List<GrantedAuthority> authenrities;
    private Object credentials;
    private Object details;
    private Object principal;
    private boolean isAuthenticated = false;
    

    @Override
    public String getName() {
        // TODO Auto-generated method stub
        return name;
    }

    @Override
    public Collection<? extends GrantedAuthority> getAuthorities() {
        // TODO Auto-generated method stub
        return authenrities;
    }

    @Override
    public Object getCredentials() {
        // TODO Auto-generated method stub
        return credentials;
    }

    @Override
    public Object getDetails() {
        // TODO Auto-generated method stub
        return details;
    }

    @Override
    public Object getPrincipal() {
        // TODO Auto-generated method stub
        return principal;
    }

    @Override
    public boolean isAuthenticated() {
        // TODO Auto-generated method stub
        return isAuthenticated;
    }

    @Override
    public void setAuthenticated(boolean isAuthenticated) throws IllegalArgumentException {
        // TODO Auto-generated method stub
        this.isAuthenticated = isAuthenticated;
    }

}

2.第二步實(shí)現(xiàn)TokenGranter,并且添加到配置里面去。
2.1 我們新建一個MyTokenGranter類實(shí)現(xiàn)驗(yàn)證碼登錄功能,校驗(yàn)方式為：verificationCode肉盹，如圖:

image.png

import java.util.LinkedHashMap;
import java.util.Map;

import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.core.Authentication;
import org.springframework.security.oauth2.common.OAuth2AccessToken;
import org.springframework.security.oauth2.provider.OAuth2Authentication;
import org.springframework.security.oauth2.provider.OAuth2Request;
import org.springframework.security.oauth2.provider.TokenGranter;
import org.springframework.security.oauth2.provider.TokenRequest;
import org.springframework.security.oauth2.provider.token.AuthorizationServerTokenServices;

public class MyTokenGranter implements TokenGranter{
    
    private String grantType = "verificationCode";
    
    private AuthenticationManager authenticationManager;
    private AuthorizationServerTokenServices tokenServices;
    
    public MyTokenGranter(AuthenticationManager authenticationManager, AuthorizationServerTokenServices tokenServices) {
        this.authenticationManager = authenticationManager;
        this.tokenServices = tokenServices;
    }

    @SuppressWarnings("deprecation")
    @Override
    public OAuth2AccessToken grant(String grantType, TokenRequest tokenRequest) {
        if(!this.grantType.equals(grantType)) {
            return null;
        }
        
        Map<String, String> parameters = new LinkedHashMap<String, String>(tokenRequest.getRequestParameters());
        String username = parameters.get("username");
        String code = parameters.get("code");
        
        if(!"123456".equals(code)) {return null;}
        
        // todo 調(diào)用校驗(yàn)列表校驗(yàn)登錄數(shù)據(jù)
        Authentication authentication = new MyAuthentication(username, null, username, null, null, false);
        authentication = authenticationManager.authenticate(authentication);
        if(null == authentication) {
            return null;
        }
        // todo 校驗(yàn)成功后罕扎，通過tokenservice生成token
        return tokenServices.createAccessToken(new OAuth2Authentication(
                new OAuth2Request(null, "client", null, true, null, null, null, null, null), authentication));
    }
}

2.2 添加校驗(yàn)方式到配置類里面去。

image.png

3.第三步沪么，增加校驗(yàn)提供類，來驗(yàn)證新增的校驗(yàn)方式锌半，
其中方法authenticate的邏輯可以自定義

image.png

截圖框柱的表示用這個校驗(yàn)類來校驗(yàn)

import org.springframework.security.authentication.AuthenticationProvider;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.AuthenticationException;

public class MyAuthenticationProvider implements AuthenticationProvider {
    

    @Override
    public Authentication authenticate(Authentication authentication) throws AuthenticationException {
        // TODO Auto-generated method stub
        // todo 要經(jīng)過UserDetailsService的校驗(yàn)禽车，這里就不寫了？刊殉！
        // todo 返回校驗(yàn)成功案例
        authentication.setAuthenticated(true);
        return authentication;
    }

    @Override
    public boolean supports(Class<?> authentication) {
        // TODO Auto-generated method stub
        return MyAuthentication.class.isAssignableFrom(authentication);
    }

}

新增完后添加到校驗(yàn)組合里面去殉摔。

image.png

然后啟動項(xiàng)目，調(diào)用verificationCode校驗(yàn)方式來登錄就可以了

image.png