1.目錄結構

2.配置自定義登入頁

通過配置SecurityProperties,MyProperties,SecurityCoreConfig來讀取resources資料夾下application.properties中相關配置項。

SecurityProperties：

package com.security.properties;

import lombok.Data;
import org.springframework.boot.context.properties.ConfigurationProperties;

/**
 * @author ShotMoon
 */
@Data
@ConfigurationProperties(prefix = "shotmoon.security")//讀取application.properties中以"shotmoon.security"開頭的配置項，並寫入myProperties物件中
public class SecurityProperties {
    
    //注意，物件名myProperties要跟application.properties中shotmoon.security（即prefix）後面相同
    private MyProperties myProperties = new MyProperties();

}
 

MyProperties：

package com.security.properties;

import lombok.Data;

/**
 * @author ShotMoon
 */
@Data
public class MyProperties {
    //注意，屬性名loginPage跟application.properties相應配置名務必保持一致
    private String loginPage = "/default-login.html";
}

SecurityCoreConfig：

package com.security;

import com.security.properties.SecurityProperties;
import org.springframework.boot.context.properties.EnableConfigurationProperties;
import org.springframework.context.annotation.Configuration;

/**
 * @author ShotMoon
 */
@Configuration
@EnableConfigurationProperties(SecurityProperties.class)
public class SecurityCoreConfig {

}
 

application.properties：

spring.datasource.driver-class-name = com.mysql.jdbc.Driver
spring.datasource.url=jdbc:mysql://127.0.0.1:3306/security?useUnicode=yes&characterEncoding=UTF-8
spring.datasource.username=root
spring.datasource.password=qwe123

security.basic.enabled=false

spring.session.store-type=none

//對應MyProperties中相關同名屬性
shotmoon.security.myProperties.loginPage = /myLoginPage.html
 

配置後，初次訪問服務會自動跳轉到我們配置的自定義登入頁（隨便寫的，略醜）

3.自定義認證成功/失敗處理

Spring Security預設的認證處理方式有時候並不能滿足我們的需求，尤其當下前後端分離開發已成趨勢的情況下，認證完成後返回html的形式並不利於我們分離開發，下面我們研究下如何用Spring Security自帶的AuthenticationSuccessHandler，AuthenticationFailureHandler來解決這個問題。

MyAuthenticationSuccessHandler：

package com.security.authentication;

import com.fasterxml.jackson.databind.ObjectMapper;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.core.Authentication;
import org.springframework.security.web.authentication.AuthenticationSuccessHandler;
import org.springframework.stereotype.Component;

import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;

/**
 * @author ShotMoon
 */
@Component
public class MyAuthenticationSuccessHandler implements AuthenticationSuccessHandler {

    private Logger logger = LoggerFactory.getLogger(getClass());

    @Autowired
    private ObjectMapper objectMapper;

    @Override
    public void onAuthenticationSuccess(HttpServletRequest request, HttpServletResponse response, Authentication authentication) throws IOException, ServletException {

        logger.info("登入成功");

        response.setContentType("application/json;charset=UTF-8");
        response.getWriter().write(objectMapper.writeValueAsString(authentication));//將java物件轉成json字串寫入response，Authtication引數中包含我們的認證資訊  
    }
}

AuthenticationFailureHandler：

package com.security.authentication;


import com.fasterxml.jackson.databind.ObjectMapper;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.http.HttpStatus;
import org.springframework.security.core.AuthenticationException;
import org.springframework.security.web.authentication.AuthenticationFailureHandler;
import org.springframework.stereotype.Component;

import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;

@Component
public class MyAuthenticationFailureHandler implements AuthenticationFailureHandler {
    private Logger logger = LoggerFactory.getLogger(getClass());

    @Autowired
    private ObjectMapper objectMapper;
    
    @Override
    public void onAuthenticationFailure(HttpServletRequest request, HttpServletResponse response, AuthenticationException exception) throws IOException, ServletException {

        logger.info("登陸失敗");

        response.setStatus(HttpStatus.INTERNAL_SERVER_ERROR.value());
        response.setContentType("application/json;charset=UTF-8");
        response.getWriter().write(objectMapper.writeValueAsString(exception));//將異常寫入response中,顯示在頁面上
    }
}

然後在SecurityConfig中進行配置使其生效：

SecurityConfig：

package com.security.config;

import com.security.authentication.MyAuthenticationFailureHandler;
import com.security.authentication.MyAuthenticationSuccessHandler;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;

/**
 * @author ShotMoon
 */
@Configuration
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Bean
    public PasswordEncoder passwordEncoder(){
        return new BCryptPasswordEncoder();
    }

    @Autowired
    private MyAuthenticationSuccessHandler myAuthenticationSuccessHandler;

    @Autowired
    private MyAuthenticationFailureHandler myAuthenticationFailureHandler;

    /**
     * @description :
     * @param : [http]
     * @return : void
     * @date : 2018/5/13 13:41
     */
    @Override
    protected void configure(HttpSecurity http) throws Exception {

        http.formLogin()
                .loginPage("/authentication/require")
                .loginProcessingUrl("/authentication/form")
                .successHandler(myAuthenticationSuccessHandler)//配置successHandler
                .failureHandler(myAuthenticationFailureHandler)//配置failureHandler
                .and()
                .authorizeRequests()
                .antMatchers(
                        "/loginPage.html",
                        "/myLoginPage.html",
                        "/authentication/require"

                ).permitAll()
                .anyRequest()
                .authenticated()
                .and()
                .csrf().disable();
    }
}

完成，看下效果：

登陸成功，顯示認證資訊：

登陸失敗，顯示異常資訊：

這樣我們就可以自定義認證完成處理機制了，快試試吧。