一文助您成为Java.Net双平台高手

 1 //iauthenticationfilter 认证，认证是否合法用户
 2 public class adminauthenticationfilter : actionfilterattribute, iauthenticationfilter
 3 {
 4     public void onauthentication(authenticationcontext filtercontext)
 5     {
 6         iprincipal user = filtercontext.principal;
 7         if (user == null || !user.identity.isauthenticated)
 8         {
 9             httpcookie authcookie = filtercontext.httpcontext.request.cookies[formsauthentication.formscookiename];
10             if (authcookie != null)
11             {
12                 formsauthenticationticket ticket = formsauthentication.decrypt(authcookie.value);
13                 if (ticket != null && !string.isnullorempty(ticket.userdata))
14                 {
15                     var userid = convert.toint32(ticket.userdata);
16                     user = enginecontext.resolve<pfmanagerservice>().getmanager(userid);
17                     filtercontext.principal = user; //后续会传递给httpcontext.current.user
18                 }
19             }
20         }
21     }
22 
23     public void onauthenticationchallenge(authenticationchallengecontext filtercontext)
24     {
25         // 认证失败执行
26     }
27 }

 1 public class adminauthorizationfilter : authorizeattribute
 2 {        
 3     public override void onauthorization(authorizationcontext filtercontext)
 4     {
 5         //childaction不用授权
 6         if (filtercontext.ischildaction)
 7             return;
 8 
 9         if (!filtercontext.actiondescriptor.isdefined(typeof(allowanonymousattribute), true) && !filtercontext.actiondescriptor.controllerdescriptor.isdefined(typeof(allowanonymousattribute), true))
10         {           
11             if (filtercontext.httpcontext.user != null && filtercontext.httpcontext.user.identity.isauthenticated)
12             {
13                 var controllername = filtercontext.routedata.values["controller"].tostring().tolower();
14                 var actionname = filtercontext.routedata.values["action"].tostring().tolower();
15                 //只要登录，则都能访问工作台
16                 if (controllername.tolower() == "home" && actionname.tolower() == "index")
17                     this.roles = string.empty;
18                 else
19                 {
20                     var roleids = enginecontext.resolve<bemoduleservice>().getroleidshasmoduleauthorization(controllername, actionname, masonplatformtype.adminplatform);
21                     if (roleids == null)
22                     {
23                         filtercontext.result = new httpnotfoundresult();
24                         return;
25                     }
26                     //将资源所需权限赋给成员变量roles
27                     this.roles = string.join(",", roleids);
28                 }
29             }
30         }
31 
32         base.onauthorization(filtercontext);
33     }
34 }

 1 @configuration
 2 @enablewebsecurity
 3 @enableglobalmethodsecurity(prepostenabled = true)
 4 public class websecurityconfig extends websecurityconfigureradapter {
 5     @autowired
 6     private jwtauthenticationentrypoint unauthorizedhandler;
 7 
 8     @autowired
 9     private userdetailsservice userdetailsservice;
10 
11     @autowired
12     private custompostprocessor postprocessor;
13 
14     @autowired
15     public void configureauthentication(authenticationmanagerbuilder authenticationmanagerbuilder) throws exception {
16         authenticationmanagerbuilder
17                 .userdetailsservice(this.userdetailsservice)
18                 .passwordencoder(passwordencoder());
19     }
20 
21     @bean
22     public passwordencoder passwordencoder() {
23         return new bcryptpasswordencoder();
24     }
25 
26     @bean
27     public jwtauthenticationtokenfilter authenticationtokenfilterbean() throws exception {
28         return new jwtauthenticationtokenfilter();
29     }
30 
31     @override
32     protected void configure(httpsecurity httpsecurity) throws exception {
33         httpsecurity
34                 // we don't need csrf because our token is invulnerable
35                 .csrf().disable()
36                 .exceptionhandling().authenticationentrypoint(unauthorizedhandler).and()
37                 // don't create session
38                 .sessionmanagement().sessioncreationpolicy(sessioncreationpolicy.stateless).and()
39                 .authorizerequests()
40                 .antmatchers(httpmethod.options, "/**").permitall()
41                 .anyrequest().authenticated().withobjectpostprocessor(postprocessor);
42 
43         // custom jwt based security filter
44         httpsecurity
45                 .addfilterbefore(authenticationtokenfilterbean(), usernamepasswordauthenticationfilter.class);
46     }
47 }

 1 @component
 2 public class custompostprocessor implements objectpostprocessor<filtersecurityinterceptor> {
 3     @autowired
 4     private customfiltersecuritymetadatasource customfiltersecuritymetadatasource;
 5 
 6     @autowired
 7     private customaccessdecisionmanager customaccessdecisionmanager;
 8 
 9     @override
10     public <t extends filtersecurityinterceptor> t postprocess(t fsi) {
11         fsi.setsecuritymetadatasource(customfiltersecuritymetadatasource); //1.路径（资源）拦截处理
12         fsi.setaccessdecisionmanager(customaccessdecisionmanager); //2.权限决策处理类
13         return fsi;
14     }
15 }

 1 @service
 2 public class jwtuserdetailsserviceimpl implements userdetailsservice {
 3 
 4     @autowired
 5     private userrepository userrepository;
 6 
 7     @override
 8     public userdetails loaduserbyusername(string username) throws usernamenotfoundexception {
 9         user user = userrepository.findbyusername(username);
10 
11         if (user == null) {
12             throw new usernamenotfoundexception(string.format("no user found with username '%s'.", username));
13         } else {
14             return jwtuserfactory.create(user);
15         }
16     }
17 }

 1 /**
 2  * 路径拦截处理类
 3  * <p>
 4  * 如果路径属于允许访问列表，则不做拦截，放开访问；
 5  * <p>
 6  * 否则，获得路径访问所需角色，并返回；如果没有找到该路径所需角色，则拒绝访问。
 7  */
 8 @component
 9 public class customfiltersecuritymetadatasource implements filterinvocationsecuritymetadatasource {
10     @autowired
11     private apirepository apirepository;
12 
13     @override
14     public collection<configattribute> getattributes(object object) throws illegalargumentexception {
15         filterinvocation fi = (filterinvocation) object; //当前请求对象
16 
17         list<configattribute> configattributes = getmatcherconfigattribute(fi.getrequesturl(), fi.getrequest().getmethod()); // 获得访问当前路径所需要的角色
18 
19         return configattributes.size() > 0 ? configattributes : deniedrequest(); //返回当前路径所需角色，如果路径没有对应角色，则拒绝访问
20     }
21 
22     @override
23     public collection<configattribute> getallconfigattributes() {
24         return null;
25     }
26 
27     @override
28     public boolean supports(class<?> clazz) {
29         return filterinvocation.class.isassignablefrom(clazz);
30     }
31 
32     /**
33      * 获取当前路径以及请求方式获得所需要的角色
34      *
35      * @param url 当前路径
36      * @return 所需角色集合
37      */
38     private list<configattribute> getmatcherconfigattribute(string url, string method) {
39         set<authority> authorities = new hashset<>();
40         // 1.根据url的开头去数据库模糊查询相应的api
41 
42         string prefix = url.substring(0, url.lastindexof("/"));
43 
44         prefix = stringutil.isempty(prefix) ? url : prefix + "%";
45 
46         list<api> apis = apirepository.findbyurilikeandmethod(prefix, method);
47 
48         // 2.查找完全匹配的api，如果没有，比对pathmatcher是否有匹配的结果
49         apis.foreach(api -> {
50             string pattern = api.geturi();
51 
52             if (new antpathmatcher().match(pattern, url)) {
53                 list<resource> resources = api.getresources();
54 
55                 resources.foreach(resource -> {
56                     authorities.addall(resource.getauthorities());
57                 });
58             }
59         });
60 
61         return authorities.stream().map(authority -> new securityconfig(authority.getid().tostring())).collect(collectors.tolist());
62     }
63 
64     /**
65      * @return 默认拒绝访问配置
66      */
67     private list<configattribute> deniedrequest() {
68         return collections.singletonlist(new securityconfig("role_denied"));
69     }
70 }

 1 /**
 2  * 权限决策处理类
 3  *
 4  * 判断用户的角色，如果为空，则拒绝访问；
 5  *
 6  * 判断用户所有的角色中是否有一个包含在 访问路径允许的角色集合中；
 7  *
 8  * 如果有，则放开；否则拒绝访问；
 9  */
10 @component
11 public class customaccessdecisionmanager implements accessdecisionmanager {
12     @override
13     public void decide(authentication authentication, object object, collection<configattribute> configattributes) throws accessdeniedexception, insufficientauthenticationexception {
14         if (authentication == null) {
15             throw new accessdeniedexception("permission denied");
16         }
17 
18         //当前用户拥有的角色集合
19         list<string> rolecodes = authentication.getauthorities().stream().map(grantedauthority::getauthority).collect(collectors.tolist());
20 
21         //访问路径所需要的角色集合
22         list<string> configrolecodes = configattributes.stream().map(configattribute::getattribute).collect(collectors.tolist());
23         for (string rolecode : rolecodes) {
24             if (configrolecodes.contains(rolecode)) {
25                 return;
26             }
27         }
28 
29         throw new accessdeniedexception("permission denied");
30     }
31 
32     @override
33     public boolean supports(configattribute attribute) {
34         return true;
35     }
36 
37     @override
38     public boolean supports(class<?> clazz) {
39         return true;
40     }
41 }

 1 public class jwtauthenticationtokenfilter extends onceperrequestfilter {
 2 
 3     private final log logger = logfactory.getlog(this.getclass());
 4 
 5     @autowired
 6     private userdetailsservice userdetailsservice;
 7 
 8     @autowired
 9     private jwttokenutil jwttokenutil;
10 
11     @value("${jwt.header}")
12     private string tokenheader;
13 
14     @override
15     protected void dofilterinternal(httpservletrequest request, httpservletresponse response, filterchain chain) throws servletexception, ioexception {
16         final string requestheader = request.getheader(this.tokenheader);
17 
18         string username = null;
19         string authtoken = null;
20         if (requestheader != null && requestheader.startswith("bearer ")) {
21             authtoken = requestheader.substring(7);
22             try {
23                 username = jwttokenutil.getusernamefromtoken(authtoken);
24             } catch (illegalargumentexception e) {
25                 logger.error("an error occured during getting username from token", e);
26             } catch (exception e1) {
27                 logger.error(e1.getmessage());
28             }
29         }
30 
31         if (username != null && securitycontextholder.getcontext().getauthentication() == null) {
32 
33             // it is not compelling necessary to load the use details from the database. you could also store the information
34             // in the token and read it from it. it's up to you ;)
35             userdetails userdetails = this.userdetailsservice.loaduserbyusername(username);
36 
37             // for simple validation it is completely sufficient to just check the token integrity. you don't have to call
38             // the database compellingly. again it's up to you ;)
39             if (jwttokenutil.validatetoken(authtoken, userdetails)) {
40                 usernamepasswordauthenticationtoken authentication = new usernamepasswordauthenticationtoken(userdetails, null, userdetails.getauthorities());
41                 authentication.setdetails(new webauthenticationdetailssource().builddetails(request));
42                 logger.info("authenticated user " + username + ", setting security context");
43                 securitycontextholder.getcontext().setauthentication(authentication);
44             }
45         }
46 
47         chain.dofilter(request, response);
48     }
49 }