Java Spring Security 自定义登录逻辑实现

Spring Security是一个强大的安全框架，用于保护Spring应用程序。默认情况下，Spring Security提供了许多开箱即用的功能，包括登录、注销、会话管理等。然而，在某些情况下，我们可能需要自定义登录逻辑以满足特定的业务需求。本文将详细介绍如何使用Spring Security实现自定义登录逻辑。

一、基本配置

首先，需要引入Spring Security相关的依赖。以下是Maven依赖配置：

<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-security</artifactId>
</dependency>
<dependency>
    <groupId>org.springframework.security</groupId>
    <artifactId>spring-security-test</artifactId>
    <scope>test</scope>
</dependency>

二、创建用户详情服务

我们需要创建一个自定义的 UserDetailsService，用于加载用户的认证信息。

import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.core.userdetails.UsernameNotFoundException;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.User;

@Service
public class CustomUserDetailsService implements UserDetailsService {

    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        // 模拟从数据库加载用户
        if ("user".equals(username)) {
            return User.withUsername("user")
                    .password("{noop}password") // {noop} 表示不使用加密
                    .roles("USER")
                    .build();
        } else {
            throw new UsernameNotFoundException("User not found");
        }
    }
}

三、配置安全过滤链

通过扩展 WebSecurityConfigurerAdapter 来配置自定义的安全过滤链。

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Bean
    @Override
    protected UserDetailsService userDetailsService() {
        return new CustomUserDetailsService();
    }

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
            .authorizeRequests()
                .antMatchers("/login").permitAll() // 允许所有人访问登录页面
                .anyRequest().authenticated() // 其他请求需要认证
                .and()
            .formLogin()
                .loginPage("/login") // 自定义登录页面
                .loginProcessingUrl("/perform_login") // 登录表单提交的URL
                .defaultSuccessUrl("/home", true) // 登录成功后跳转的URL
                .failureUrl("/login?error=true") // 登录失败后跳转的URL
                .and()
            .logout()
                .logoutUrl("/perform_logout") // 注销URL
                .deleteCookies("JSESSIONID") // 注销后删除的Cookie
                .logoutSuccessUrl("/login"); // 注销成功后跳转的URL
    }
}

四、创建自定义登录页面

创建一个自定义的登录页面，该页面应包含登录表单。

<!-- src/main/resources/templates/login.html -->
<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <title>Login</title>
</head>
<body>
    <h1>Login</h1>
    <form method="post" action="/perform_login">
        <div>
            <label for="username">Username:</label>
            <input type="text" id="username" name="username" required>
        </div>
        <div>
            <label for="password">Password:</label>
            <input type="password" id="password" name="password" required>
        </div>
        <div>
            <button type="submit">Login</button>
        </div>
    </form>
    <p th:if="${param.error}" style="color:red;">Invalid username or password.</p>
</body>
</html>

五、实现自定义登录逻辑

通过实现 AuthenticationProvider 接口来自定义登录逻辑。

import org.springframework.security.authentication.AuthenticationProvider;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.AuthenticationException;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.stereotype.Component;

@Component
public class CustomAuthenticationProvider implements AuthenticationProvider {

    private final UserDetailsService userDetailsService;
    private final PasswordEncoder passwordEncoder;

    public CustomAuthenticationProvider(UserDetailsService userDetailsService, PasswordEncoder passwordEncoder) {
        this.userDetailsService = userDetailsService;
        this.passwordEncoder = passwordEncoder;
    }

    @Override
    public Authentication authenticate(Authentication authentication) throws AuthenticationException {
        String username = authentication.getName();
        String password = authentication.getCredentials().toString();

        UserDetails user = userDetailsService.loadUserByUsername(username);

        if (passwordEncoder.matches(password, user.getPassword())) {
            return new UsernamePasswordAuthenticationToken(username, password, user.getAuthorities());
        } else {
            throw new BadCredentialsException("Invalid username or password");
        }
    }

    @Override
    public boolean supports(Class<?> authentication) {
        return UsernamePasswordAuthenticationToken.class.isAssignableFrom(authentication);
    }
}

六、注册自定义的 AuthenticationProvider

在 SecurityConfig 中注册自定义的 AuthenticationProvider。

import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    private final CustomAuthenticationProvider customAuthenticationProvider;

    public SecurityConfig(CustomAuthenticationProvider customAuthenticationProvider) {
        this.customAuthenticationProvider = customAuthenticationProvider;
    }

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.authenticationProvider(customAuthenticationProvider);
    }

    // 其他配置保持不变
}

七、总结

通过以上步骤，我们实现了Spring Security的自定义登录逻辑。首先，我们创建了自定义的 UserDetailsService，然后配置了安全过滤链，并实现了自定义的 AuthenticationProvider 来处理登录逻辑。最后，通过注册自定义的 AuthenticationProvider，我们完成了自定义登录逻辑的集成。

思维导图

Spring Security 自定义登录逻辑实现
│
├── 依赖配置
│   └── spring-boot-starter-security
│
├── 自定义UserDetailsService
│   └── loadUserByUsername
│
├── 安全过滤链配置
│   ├── loginPage
│   ├── loginProcessingUrl
│   ├── defaultSuccessUrl
│   └── failureUrl
│
├── 自定义登录页面
│   └── login.html
│
├── 自定义AuthenticationProvider
│   ├── authenticate
│   └── supports
│
└── 注册AuthenticationProvider
    └── configure(AuthenticationManagerBuilder)

通过本文的讲解，您应该已经掌握了如何使用Spring Security实现自定义登录逻辑。希望这能帮助您在实际项目中更好地应用Spring Security。