package com.kidgrow.authclient.config;
|
|
import com.kidgrow.authclient.properties.SecurityProperties;
|
import org.springframework.beans.factory.annotation.Autowired;
|
import org.springframework.context.annotation.Import;
|
import org.springframework.http.HttpMethod;
|
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
|
import org.springframework.security.config.annotation.web.configurers.ExpressionUrlAuthorizationConfigurer;
|
import org.springframework.security.config.http.SessionCreationPolicy;
|
import org.springframework.security.oauth2.config.annotation.web.configuration.ResourceServerConfigurerAdapter;
|
import org.springframework.security.oauth2.config.annotation.web.configurers.ResourceServerSecurityConfigurer;
|
import org.springframework.security.oauth2.provider.error.OAuth2AccessDeniedHandler;
|
import org.springframework.security.oauth2.provider.expression.OAuth2WebSecurityExpressionHandler;
|
import org.springframework.security.oauth2.provider.token.TokenStore;
|
import org.springframework.security.web.AuthenticationEntryPoint;
|
|
import javax.annotation.Resource;
|
|
/**
|
* 石家庄喜高科技有限责任公司 版权所有 © Copyright 2020<br>
|
*
|
* @Description: 资源服务默认配置<br>
|
* @Project: <br>
|
* @CreateDate: Created in 2020/2/13 11:20 <br>
|
* @Author: <a href="4345453@kidgrow.com">liuke</a>
|
*/
|
@Import(DefaultSecurityHandlerConfig.class)
|
public class DefaultResourceServerConf extends ResourceServerConfigurerAdapter {
|
@Autowired
|
private TokenStore tokenStore;
|
|
@Resource
|
private AuthenticationEntryPoint authenticationEntryPoint;
|
|
@Resource
|
private OAuth2WebSecurityExpressionHandler expressionHandler;
|
|
@Resource
|
private OAuth2AccessDeniedHandler oAuth2AccessDeniedHandler;
|
|
@Autowired
|
private SecurityProperties securityProperties;
|
|
@Override
|
public void configure(ResourceServerSecurityConfigurer resources) {
|
resources.tokenStore(tokenStore)
|
.stateless(true)
|
.authenticationEntryPoint(authenticationEntryPoint)
|
.expressionHandler(expressionHandler)
|
.accessDeniedHandler(oAuth2AccessDeniedHandler);
|
}
|
|
@Override
|
public void configure(HttpSecurity http) throws Exception {
|
ExpressionUrlAuthorizationConfigurer<HttpSecurity>.AuthorizedUrl authorizedUrl = setHttp(http)
|
.authorizeRequests()
|
.antMatchers(securityProperties.getIgnore().getUrls()).permitAll()
|
.antMatchers(HttpMethod.OPTIONS).permitAll()
|
.anyRequest();
|
setAuthenticate(authorizedUrl);
|
|
http.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.IF_REQUIRED)
|
.and()
|
.httpBasic().disable()
|
.headers()
|
.frameOptions().disable()
|
.and()
|
.csrf().disable();
|
}
|
|
/**
|
* url权限控制，默认是认证就通过，可以重写实现个性化
|
* @param authorizedUrl
|
*/
|
public HttpSecurity setAuthenticate(ExpressionUrlAuthorizationConfigurer<HttpSecurity>.AuthorizedUrl authorizedUrl) {
|
return authorizedUrl.authenticated().and();
|
}
|
|
/**
|
* 留给子类重写扩展功能
|
* @param http
|
*/
|
public HttpSecurity setHttp(HttpSecurity http) {
|
return http;
|
}
|
}
|
