From c648dae172f041d5e9d8bac9ed9ba54db595ff9a Mon Sep 17 00:00:00 2001 From: chenjun Date: Thu, 31 Oct 2019 23:23:00 +0800 Subject: [PATCH 1/2] fix #663 --- .../PigxUserAuthenticationConverter.java | 28 ++++++++++++++++++- .../exception/ForbiddenException.java | 6 ++-- .../exception/PigxAuth2Exception.java | 4 +++ 3 files changed, 35 insertions(+), 3 deletions(-) diff --git a/pigx-common/pigx-common-security/src/main/java/com/pig4cloud/pigx/common/security/component/PigxUserAuthenticationConverter.java b/pigx-common/pigx-common-security/src/main/java/com/pig4cloud/pigx/common/security/component/PigxUserAuthenticationConverter.java index cac995c21..3a9f1a862 100644 --- a/pigx-common/pigx-common-security/src/main/java/com/pig4cloud/pigx/common/security/component/PigxUserAuthenticationConverter.java +++ b/pigx-common/pigx-common-security/src/main/java/com/pig4cloud/pigx/common/security/component/PigxUserAuthenticationConverter.java @@ -17,7 +17,10 @@ package com.pig4cloud.pigx.common.security.component; +import cn.hutool.core.util.StrUtil; +import com.pig4cloud.pigx.common.core.constant.CommonConstants; import com.pig4cloud.pigx.common.core.constant.SecurityConstants; +import com.pig4cloud.pigx.common.security.exception.ForbiddenException; import com.pig4cloud.pigx.common.security.service.PigxUser; import org.springframework.security.authentication.UsernamePasswordAuthenticationToken; import org.springframework.security.core.Authentication; @@ -25,10 +28,14 @@ import org.springframework.security.core.GrantedAuthority; import org.springframework.security.core.authority.AuthorityUtils; import org.springframework.security.oauth2.provider.token.UserAuthenticationConverter; import org.springframework.util.StringUtils; +import org.springframework.web.context.request.RequestContextHolder; +import org.springframework.web.context.request.ServletRequestAttributes; +import javax.servlet.http.HttpServletRequest; import java.util.Collection; import java.util.LinkedHashMap; import java.util.Map; +import java.util.Optional; /** * @author lengleng @@ -64,8 +71,8 @@ public class PigxUserAuthenticationConverter implements UserAuthenticationConver @Override public Authentication extractAuthentication(Map map) { if (map.containsKey(USERNAME)) { + validateTenantId(map); Collection authorities = getAuthorities(map); - String username = (String) map.get(USERNAME); Integer id = (Integer) map.get(SecurityConstants.DETAILS_USER_ID); Integer deptId = (Integer) map.get(SecurityConstants.DETAILS_DEPT_ID); @@ -88,4 +95,23 @@ public class PigxUserAuthenticationConverter implements UserAuthenticationConver } throw new IllegalArgumentException("Authorities must be either a String or a Collection"); } + + private void validateTenantId(Map map){ + String headerValue = getCurrentTenantId(); + Integer userValue = (Integer) map.get(SecurityConstants.DETAILS_TENANT_ID); + if(StrUtil.isNotBlank(headerValue) && !userValue.toString().equals(headerValue)){ + // TODO: 不要提示租户ID不对，避免被穷举 + throw new ForbiddenException("bad tenant id"); + } + } + + public static Optional getCurrentHttpRequest() { + return Optional.ofNullable(RequestContextHolder.getRequestAttributes()) + .filter(requestAttributes -> ServletRequestAttributes.class.isAssignableFrom(requestAttributes.getClass())) + .map(requestAttributes -> ((ServletRequestAttributes) requestAttributes)) + .map(ServletRequestAttributes::getRequest); + } + public static String getCurrentTenantId() { + return getCurrentHttpRequest().map(httpServletRequest -> httpServletRequest.getHeader(CommonConstants.TENANT_ID)).orElse(null); + } } diff --git a/pigx-common/pigx-common-security/src/main/java/com/pig4cloud/pigx/common/security/exception/ForbiddenException.java b/pigx-common/pigx-common-security/src/main/java/com/pig4cloud/pigx/common/security/exception/ForbiddenException.java index f9541bb65..9cbe6a55f 100644 --- a/pigx-common/pigx-common-security/src/main/java/com/pig4cloud/pigx/common/security/exception/ForbiddenException.java +++ b/pigx-common/pigx-common-security/src/main/java/com/pig4cloud/pigx/common/security/exception/ForbiddenException.java @@ -27,10 +27,12 @@ import org.springframework.http.HttpStatus; */ @JsonSerialize(using = PigxAuth2ExceptionSerializer.class) public class ForbiddenException extends PigxAuth2Exception { - - public ForbiddenException(String msg, Throwable t) { + public ForbiddenException(String msg) { super(msg); } + public ForbiddenException(String msg, Throwable t) { + super(msg,t); + } @Override public String getOAuth2ErrorCode() { diff --git a/pigx-common/pigx-common-security/src/main/java/com/pig4cloud/pigx/common/security/exception/PigxAuth2Exception.java b/pigx-common/pigx-common-security/src/main/java/com/pig4cloud/pigx/common/security/exception/PigxAuth2Exception.java index 780f9eb68..bd6b6cd05 100644 --- a/pigx-common/pigx-common-security/src/main/java/com/pig4cloud/pigx/common/security/exception/PigxAuth2Exception.java +++ b/pigx-common/pigx-common-security/src/main/java/com/pig4cloud/pigx/common/security/exception/PigxAuth2Exception.java @@ -36,6 +36,10 @@ public class PigxAuth2Exception extends OAuth2Exception { super(msg); } + public PigxAuth2Exception(String msg, Throwable t) { + super(msg,t); + } + public PigxAuth2Exception(String msg, String errorCode) { super(msg); this.errorCode = errorCode; From a2b36e94794f293500d4586a8ccccf83ccaf4f38 Mon Sep 17 00:00:00 2001 From: jclazz Date: Fri, 1 Nov 2019 13:33:35 +0800 Subject: [PATCH 2/2] =?UTF-8?q?=E5=BC=82=E5=B8=B8=E6=B6=88=E6=81=AF?= =?UTF-8?q?=E5=9B=BD=E9=99=85=E5=8C=96=E6=94=AF=E6=8C=81?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../PigxUserAuthenticationConverter.java | 20 ++++++++++--------- .../security/messages_zh_CN.properties | 1 + 2 files changed, 12 insertions(+), 9 deletions(-) diff --git a/pigx-common/pigx-common-security/src/main/java/com/pig4cloud/pigx/common/security/component/PigxUserAuthenticationConverter.java b/pigx-common/pigx-common-security/src/main/java/com/pig4cloud/pigx/common/security/component/PigxUserAuthenticationConverter.java index 3a9f1a862..626624b7d 100644 --- a/pigx-common/pigx-common-security/src/main/java/com/pig4cloud/pigx/common/security/component/PigxUserAuthenticationConverter.java +++ b/pigx-common/pigx-common-security/src/main/java/com/pig4cloud/pigx/common/security/component/PigxUserAuthenticationConverter.java @@ -20,11 +20,13 @@ package com.pig4cloud.pigx.common.security.component; import cn.hutool.core.util.StrUtil; import com.pig4cloud.pigx.common.core.constant.CommonConstants; import com.pig4cloud.pigx.common.core.constant.SecurityConstants; -import com.pig4cloud.pigx.common.security.exception.ForbiddenException; +import com.pig4cloud.pigx.common.security.exception.PigxAuth2Exception; import com.pig4cloud.pigx.common.security.service.PigxUser; +import lombok.extern.slf4j.Slf4j; import org.springframework.security.authentication.UsernamePasswordAuthenticationToken; import org.springframework.security.core.Authentication; import org.springframework.security.core.GrantedAuthority; +import org.springframework.security.core.SpringSecurityMessageSource; import org.springframework.security.core.authority.AuthorityUtils; import org.springframework.security.oauth2.provider.token.UserAuthenticationConverter; import org.springframework.util.StringUtils; @@ -32,10 +34,7 @@ import org.springframework.web.context.request.RequestContextHolder; import org.springframework.web.context.request.ServletRequestAttributes; import javax.servlet.http.HttpServletRequest; -import java.util.Collection; -import java.util.LinkedHashMap; -import java.util.Map; -import java.util.Optional; +import java.util.*; /** * @author lengleng @@ -43,6 +42,7 @@ import java.util.Optional; *

* 根据checktoken 的结果转化用户信息 */ +@Slf4j public class PigxUserAuthenticationConverter implements UserAuthenticationConverter { private static final String N_A = "N/A"; @@ -100,18 +100,20 @@ public class PigxUserAuthenticationConverter implements UserAuthenticationConver String headerValue = getCurrentTenantId(); Integer userValue = (Integer) map.get(SecurityConstants.DETAILS_TENANT_ID); if(StrUtil.isNotBlank(headerValue) && !userValue.toString().equals(headerValue)){ - // TODO: 不要提示租户ID不对，避免被穷举 - throw new ForbiddenException("bad tenant id"); + log.warn("请求头中的租户ID({})和用户的租户ID({})不一致",headerValue,userValue); + // TODO: 不要提示租户ID不对，可能被穷举 + throw new PigxAuth2Exception(SpringSecurityMessageSource.getAccessor().getMessage("AbstractUserDetailsAuthenticationProvider.badTenantId","Bad tenant ID")); } } - public static Optional getCurrentHttpRequest() { + private Optional getCurrentHttpRequest() { return Optional.ofNullable(RequestContextHolder.getRequestAttributes()) .filter(requestAttributes -> ServletRequestAttributes.class.isAssignableFrom(requestAttributes.getClass())) .map(requestAttributes -> ((ServletRequestAttributes) requestAttributes)) .map(ServletRequestAttributes::getRequest); } - public static String getCurrentTenantId() { + + private String getCurrentTenantId() { return getCurrentHttpRequest().map(httpServletRequest -> httpServletRequest.getHeader(CommonConstants.TENANT_ID)).orElse(null); } } diff --git a/pigx-common/pigx-common-security/src/main/resources/org/springframework/security/messages_zh_CN.properties b/pigx-common/pigx-common-security/src/main/resources/org/springframework/security/messages_zh_CN.properties index af3326c35..86d66087f 100644 --- a/pigx-common/pigx-common-security/src/main/resources/org/springframework/security/messages_zh_CN.properties +++ b/pigx-common/pigx-common-security/src/main/resources/org/springframework/security/messages_zh_CN.properties @@ -24,6 +24,7 @@ AbstractUserDetailsAuthenticationProvider.disabled=\u7528\u6237\u672A\u6FC0\u6D3 AbstractUserDetailsAuthenticationProvider.expired=\u7528\u6237\u5E10\u53F7\u5DF2\u8FC7\u671F AbstractUserDetailsAuthenticationProvider.locked=\u7528\u6237\u5E10\u53F7\u5DF2\u88AB\u9501\u5B9A AbstractUserDetailsAuthenticationProvider.onlySupports=\u4EC5\u4EC5\u652F\u6301UsernamePasswordAuthenticationToken +AbstractUserDetailsAuthenticationProvider.badTenantId=\u65E0\u6548\u7684TenantId AccountStatusUserDetailsChecker.credentialsExpired=\u7528\u6237\u51ED\u8BC1\u5DF2\u8FC7\u671F AccountStatusUserDetailsChecker.disabled=\u7528\u6237\u672A\u6FC0\u6D3B AccountStatusUserDetailsChecker.expired=\u7528\u6237\u5E10\u53F7\u5DF2\u8FC7\u671F