🔖 Releasing / Version tags. 2.6.0 . 鄙视某些人的分享/盗窃,持续开源！

pigx-common/pigx-common-security/src/main/java/com/pig4cloud/pigx/common/security/annotation/EnablePigxResourceServer.java

@@ -31,20 +31,13 @@ import java.lang.annotation.*;
  * <p>
  * 资源服务注解
  */
-@Target({ElementType.TYPE})
-@Retention(RetentionPolicy.RUNTIME)
 @Documented
 @Inherited
 @EnableResourceServer
+@Target({ElementType.TYPE})
+@Retention(RetentionPolicy.RUNTIME)
 @EnableGlobalMethodSecurity(prePostEnabled = true)
 @Import({PigxResourceServerAutoConfiguration.class, PigxSecurityBeanDefinitionRegistrar.class})
 public @interface EnablePigxResourceServer {
 
-	/**
-	 * false：上下文获取用户名
-	 * true： 上下文获取全部用户信息
-	 *
-	 * @return
-	 */
-	boolean details() default false;
 }

pigx-common/pigx-common-security/src/main/java/com/pig4cloud/pigx/common/security/component/PigxResourceServerConfigurerAdapter.java

@@ -17,18 +17,16 @@
 
 package com.pig4cloud.pigx.common.security.component;
 
-import lombok.Setter;
 import lombok.SneakyThrows;
 import lombok.extern.slf4j.Slf4j;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
 import org.springframework.security.config.annotation.web.configurers.ExpressionUrlAuthorizationConfigurer;
-import org.springframework.security.core.userdetails.UserDetailsService;
 import org.springframework.security.oauth2.config.annotation.web.configuration.ResourceServerConfigurerAdapter;
 import org.springframework.security.oauth2.config.annotation.web.configurers.ResourceServerSecurityConfigurer;
 import org.springframework.security.oauth2.provider.token.DefaultAccessTokenConverter;
-import org.springframework.security.oauth2.provider.token.DefaultUserAuthenticationConverter;
 import org.springframework.security.oauth2.provider.token.RemoteTokenServices;
+import org.springframework.security.oauth2.provider.token.UserAuthenticationConverter;
 import org.springframework.web.client.RestTemplate;
 
 /**
@@ -45,13 +43,9 @@ public class PigxResourceServerConfigurerAdapter extends ResourceServerConfigure
 	@Autowired
 	protected RemoteTokenServices remoteTokenServices;
 	@Autowired
-	protected UserDetailsService userDetailsService;
-	@Autowired
 	private PermitAllUrlProperties permitAllUrlProperties;
 	@Autowired
 	private RestTemplate lbRestTemplate;
-	@Setter
-	private boolean details;
 
 	/**
 	 * 默认的配置，对外暴露
@@ -72,58 +66,15 @@ public class PigxResourceServerConfigurerAdapter extends ResourceServerConfigure
 			.and().csrf().disable();
 	}
 
-	/**
-	 * 提供子类重写
-	 * <p>
-	 * 1. 不重写，默认支持获取用户名
-	 * 2. 重写notGetUser，提供性能
-	 * <p>
-	 * see codegen ResourceServerConfigurer
-	 *
-	 * @param resources
-	 */
 	@Override
 	public void configure(ResourceServerSecurityConfigurer resources) {
-		if (details) {
-			canGetUser(resources);
-		} else {
-			notGetUser(resources);
-		}
-	}
-
-
-	/**
-	 * 不获取用户详细 只有用户名
-	 *
-	 * @param resources
-	 */
-	protected void notGetUser(ResourceServerSecurityConfigurer resources) {
 		DefaultAccessTokenConverter accessTokenConverter = new DefaultAccessTokenConverter();
-		DefaultUserAuthenticationConverter userTokenConverter = new DefaultUserAuthenticationConverter();
+		UserAuthenticationConverter userTokenConverter = new PigxUserAuthenticationConverter();
 		accessTokenConverter.setUserTokenConverter(userTokenConverter);
 
 		remoteTokenServices.setRestTemplate(lbRestTemplate);
 		remoteTokenServices.setAccessTokenConverter(accessTokenConverter);
 		resources.authenticationEntryPoint(resourceAuthExceptionEntryPoint)
-			.tokenServices(remoteTokenServices);
+				.tokenServices(remoteTokenServices);
 	}
-
-
-	/**
-	 * 上下文中获取用户全部信息，两次调用userDetailsService，影响性能
-	 *
-	 * @param resources
-	 */
-	private void canGetUser(ResourceServerSecurityConfigurer resources) {
-		DefaultAccessTokenConverter accessTokenConverter = new DefaultAccessTokenConverter();
-		DefaultUserAuthenticationConverter userTokenConverter = new DefaultUserAuthenticationConverter();
-		userTokenConverter.setUserDetailsService(userDetailsService);
-		accessTokenConverter.setUserTokenConverter(userTokenConverter);
-
-		remoteTokenServices.setRestTemplate(lbRestTemplate);
-		remoteTokenServices.setAccessTokenConverter(accessTokenConverter);
-		resources.authenticationEntryPoint(resourceAuthExceptionEntryPoint)
-			.tokenServices(remoteTokenServices);
-	}
-
 }

pigx-common/pigx-common-security/src/main/java/com/pig4cloud/pigx/common/security/component/PigxSecurityBeanDefinitionRegistrar.java

@@ -18,16 +18,12 @@
 package com.pig4cloud.pigx.common.security.component;
 
 import com.pig4cloud.pigx.common.core.constant.SecurityConstants;
-import com.pig4cloud.pigx.common.security.annotation.EnablePigxResourceServer;
 import lombok.extern.slf4j.Slf4j;
-import org.springframework.beans.MutablePropertyValues;
 import org.springframework.beans.factory.support.BeanDefinitionRegistry;
 import org.springframework.beans.factory.support.GenericBeanDefinition;
 import org.springframework.context.annotation.ImportBeanDefinitionRegistrar;
 import org.springframework.core.type.AnnotationMetadata;
 
-import java.util.Map;
-
 /**
  * @author lengleng
  * @date 2018-11-24
@@ -49,12 +45,6 @@ public class PigxSecurityBeanDefinitionRegistrar implements ImportBeanDefinition
 
 		GenericBeanDefinition beanDefinition = new GenericBeanDefinition();
 		beanDefinition.setBeanClass(PigxResourceServerConfigurerAdapter.class);
-		MutablePropertyValues mpv = new MutablePropertyValues();
-		Map<String, Object> annotationAttributes = metadata.getAnnotationAttributes(
-			EnablePigxResourceServer.class.getName());
-		Object details = annotationAttributes.get("details");
-		mpv.add("details", details);
-		beanDefinition.setPropertyValues(mpv);
 		registry.registerBeanDefinition(SecurityConstants.RESOURCE_SERVER_CONFIGURER, beanDefinition);
 
 	}

pigx-common/pigx-common-security/src/main/java/com/pig4cloud/pigx/common/security/component/PigxUserAuthenticationConverter.java

@@ -0,0 +1,93 @@
+/*
+ *    Copyright (c) 2018-2025, lengleng All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ * Redistributions of source code must retain the above copyright notice,
+ * this list of conditions and the following disclaimer.
+ * Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ * Neither the name of the pig4cloud.com developer nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ * Author: lengleng (wangiegie@gmail.com)
+ */
+
+package com.pig4cloud.pigx.common.security.component;
+
+import com.pig4cloud.pigx.common.security.service.PigxUser;
+import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
+import org.springframework.security.core.Authentication;
+import org.springframework.security.core.GrantedAuthority;
+import org.springframework.security.core.authority.AuthorityUtils;
+import org.springframework.security.oauth2.provider.token.UserAuthenticationConverter;
+import org.springframework.util.StringUtils;
+
+import java.util.Collection;
+import java.util.LinkedHashMap;
+import java.util.Map;
+
+/**
+ * @author lengleng
+ * @date 2019-03-07
+ * <p>
+ * 根据checktoken 的结果转化用户信息
+ */
+public class PigxUserAuthenticationConverter implements UserAuthenticationConverter {
+	private static final String USER_ID = "user_id";
+	private static final String DEPT_ID = "dept_id";
+	private static final String TENANT_ID = "tenant_id";
+	private static final String N_A = "N/A";
+
+	/**
+	 * Extract information about the user to be used in an access token (i.e. for resource servers).
+	 *
+	 * @param authentication an authentication representing a user
+	 * @return a map of key values representing the unique information about the user
+	 */
+	@Override
+	public Map<String, ?> convertUserAuthentication(Authentication authentication) {
+		Map<String, Object> response = new LinkedHashMap<>();
+		response.put(USERNAME, authentication.getName());
+		if (authentication.getAuthorities() != null && !authentication.getAuthorities().isEmpty()) {
+			response.put(AUTHORITIES, AuthorityUtils.authorityListToSet(authentication.getAuthorities()));
+		}
+		return response;
+	}
+
+	/**
+	 * Inverse of {@link #convertUserAuthentication(Authentication)}. Extracts an Authentication from a map.
+	 *
+	 * @param map a map of user information
+	 * @return an Authentication representing the user or null if there is none
+	 */
+	@Override
+	public Authentication extractAuthentication(Map<String, ?> map) {
+		if (map.containsKey(USERNAME)) {
+			Collection<? extends GrantedAuthority> authorities = getAuthorities(map);
+
+			String username = (String) map.get(USERNAME);
+			Integer id = (Integer) map.get(USER_ID);
+			Integer deptId = (Integer) map.get(DEPT_ID);
+			Integer tenantId = (Integer) map.get(TENANT_ID);
+			PigxUser user = new PigxUser(id, deptId, tenantId, username, N_A, true
+					, true, true, true, authorities);
+			return new UsernamePasswordAuthenticationToken(user, N_A, authorities);
+		}
+		return null;
+	}
+
+	private Collection<? extends GrantedAuthority> getAuthorities(Map<String, ?> map) {
+		Object authorities = map.get(AUTHORITIES);
+		if (authorities instanceof String) {
+			return AuthorityUtils.commaSeparatedStringToAuthorityList((String) authorities);
+		}
+		if (authorities instanceof Collection) {
+			return AuthorityUtils.commaSeparatedStringToAuthorityList(StringUtils
+					.collectionToCommaDelimitedString((Collection<?>) authorities));
+		}
+		throw new IllegalArgumentException("Authorities must be either a String or a Collection");
+	}
+}