diff --git a/pigx-common/pigx-common-security/src/main/java/com/pig4cloud/pigx/common/security/component/PigxPreAuthenticationChecks.java b/pigx-common/pigx-common-security/src/main/java/com/pig4cloud/pigx/common/security/component/PigxPreAuthenticationChecks.java index 4eedb3aab..be30c7c73 100644 --- a/pigx-common/pigx-common-security/src/main/java/com/pig4cloud/pigx/common/security/component/PigxPreAuthenticationChecks.java +++ b/pigx-common/pigx-common-security/src/main/java/com/pig4cloud/pigx/common/security/component/PigxPreAuthenticationChecks.java @@ -17,12 +17,12 @@ package com.pig4cloud.pigx.common.security.component; +import com.pig4cloud.pigx.common.security.util.PigxSecurityMessageSourceUtil; import lombok.extern.slf4j.Slf4j; import org.springframework.context.support.MessageSourceAccessor; import org.springframework.security.authentication.AccountExpiredException; import org.springframework.security.authentication.DisabledException; import org.springframework.security.authentication.LockedException; -import org.springframework.security.core.SpringSecurityMessageSource; import org.springframework.security.core.userdetails.UserDetails; import org.springframework.security.core.userdetails.UserDetailsChecker; @@ -33,7 +33,7 @@ import org.springframework.security.core.userdetails.UserDetailsChecker; @Slf4j public class PigxPreAuthenticationChecks implements UserDetailsChecker { - private MessageSourceAccessor messages = SpringSecurityMessageSource.getAccessor(); + private MessageSourceAccessor messages = PigxSecurityMessageSourceUtil.getAccessor(); @Override public void check(UserDetails user) { diff --git a/pigx-common/pigx-common-security/src/main/java/com/pig4cloud/pigx/common/security/component/PigxResourceServerConfigurerAdapter.java b/pigx-common/pigx-common-security/src/main/java/com/pig4cloud/pigx/common/security/component/PigxResourceServerConfigurerAdapter.java index a80257059..db7e859af 100644 --- a/pigx-common/pigx-common-security/src/main/java/com/pig4cloud/pigx/common/security/component/PigxResourceServerConfigurerAdapter.java +++ b/pigx-common/pigx-common-security/src/main/java/com/pig4cloud/pigx/common/security/component/PigxResourceServerConfigurerAdapter.java @@ -28,6 +28,7 @@ import org.springframework.security.oauth2.provider.authentication.TokenExtracto import org.springframework.security.oauth2.provider.token.DefaultAccessTokenConverter; import org.springframework.security.oauth2.provider.token.RemoteTokenServices; import org.springframework.security.oauth2.provider.token.UserAuthenticationConverter; +import org.springframework.security.web.AuthenticationEntryPoint; import org.springframework.web.client.RestTemplate; /** @@ -40,7 +41,7 @@ import org.springframework.web.client.RestTemplate; public class PigxResourceServerConfigurerAdapter extends ResourceServerConfigurerAdapter { @Autowired - protected ResourceAuthExceptionEntryPoint resourceAuthExceptionEntryPoint; + protected AuthenticationEntryPoint resourceAuthExceptionEntryPoint; @Autowired protected RemoteTokenServices remoteTokenServices; diff --git a/pigx-common/pigx-common-security/src/main/java/com/pig4cloud/pigx/common/security/component/PigxSecurityInnerAspect.java b/pigx-common/pigx-common-security/src/main/java/com/pig4cloud/pigx/common/security/component/PigxSecurityInnerAspect.java index 90894835a..69474cc6a 100644 --- a/pigx-common/pigx-common-security/src/main/java/com/pig4cloud/pigx/common/security/component/PigxSecurityInnerAspect.java +++ b/pigx-common/pigx-common-security/src/main/java/com/pig4cloud/pigx/common/security/component/PigxSecurityInnerAspect.java @@ -20,6 +20,7 @@ package com.pig4cloud.pigx.common.security.component; import cn.hutool.core.util.StrUtil; import com.pig4cloud.pigx.common.core.constant.SecurityConstants; import com.pig4cloud.pigx.common.security.annotation.Inner; +import com.pig4cloud.pigx.common.security.util.PigxSecurityMessageSourceUtil; import lombok.AllArgsConstructor; import lombok.SneakyThrows; import lombok.extern.slf4j.Slf4j; @@ -48,8 +49,9 @@ public class PigxSecurityInnerAspect { public Object around(ProceedingJoinPoint point, Inner inner) { String header = request.getHeader(SecurityConstants.FROM); if (inner.value() && !StrUtil.equals(SecurityConstants.FROM_IN, header)) { - log.warn("访问接口 {} 没有权限", point.getSignature().getName()); - throw new AccessDeniedException("Access is denied"); + log.warn("访问接口 {} 没有权限", inner.value()); + throw new AccessDeniedException(PigxSecurityMessageSourceUtil.getAccessor().getMessage( + "AbstractAccessDecisionManager.accessDenied", new Object[] { inner.value() }, "access denied")); } return point.proceed(); } diff --git a/pigx-common/pigx-common-security/src/main/java/com/pig4cloud/pigx/common/security/component/PigxUserAuthenticationConverter.java b/pigx-common/pigx-common-security/src/main/java/com/pig4cloud/pigx/common/security/component/PigxUserAuthenticationConverter.java index 9f29c7635..4bbbb7018 100644 --- a/pigx-common/pigx-common-security/src/main/java/com/pig4cloud/pigx/common/security/component/PigxUserAuthenticationConverter.java +++ b/pigx-common/pigx-common-security/src/main/java/com/pig4cloud/pigx/common/security/component/PigxUserAuthenticationConverter.java @@ -23,11 +23,11 @@ import com.pig4cloud.pigx.common.core.constant.CommonConstants; import com.pig4cloud.pigx.common.core.constant.SecurityConstants; import com.pig4cloud.pigx.common.security.exception.PigxAuth2Exception; import com.pig4cloud.pigx.common.security.service.PigxUser; +import com.pig4cloud.pigx.common.security.util.PigxSecurityMessageSourceUtil; import lombok.extern.slf4j.Slf4j; import org.springframework.security.authentication.UsernamePasswordAuthenticationToken; import org.springframework.security.core.Authentication; import org.springframework.security.core.GrantedAuthority; -import org.springframework.security.core.SpringSecurityMessageSource; import org.springframework.security.core.authority.AuthorityUtils; import org.springframework.security.oauth2.provider.token.UserAuthenticationConverter; import org.springframework.util.StringUtils; @@ -110,8 +110,9 @@ public class PigxUserAuthenticationConverter implements UserAuthenticationConver if (StrUtil.isNotBlank(headerValue) && !userValue.toString().equals(headerValue)) { log.warn("请求头中的租户ID({})和用户的租户ID({})不一致", headerValue, userValue); // TODO: 不要提示租户ID不对，可能被穷举 - throw new PigxAuth2Exception(SpringSecurityMessageSource.getAccessor() - .getMessage("AbstractUserDetailsAuthenticationProvider.badTenantId", "Bad tenant ID")); + throw new PigxAuth2Exception(PigxSecurityMessageSourceUtil.getAccessor().getMessage( + "AbstractUserDetailsAuthenticationProvider.badTenantId", new Object[] { headerValue }, + "Bad tenant ID")); } } diff --git a/pigx-common/pigx-common-security/src/main/java/com/pig4cloud/pigx/common/security/component/PigxWebResponseExceptionTranslator.java b/pigx-common/pigx-common-security/src/main/java/com/pig4cloud/pigx/common/security/component/PigxWebResponseExceptionTranslator.java index 324a0a8ed..8d94a925a 100644 --- a/pigx-common/pigx-common-security/src/main/java/com/pig4cloud/pigx/common/security/component/PigxWebResponseExceptionTranslator.java +++ b/pigx-common/pigx-common-security/src/main/java/com/pig4cloud/pigx/common/security/component/PigxWebResponseExceptionTranslator.java @@ -18,13 +18,13 @@ package com.pig4cloud.pigx.common.security.component; import com.pig4cloud.pigx.common.security.exception.*; +import com.pig4cloud.pigx.common.security.util.PigxSecurityMessageSourceUtil; import lombok.extern.slf4j.Slf4j; import org.springframework.http.HttpHeaders; import org.springframework.http.HttpStatus; import org.springframework.http.ResponseEntity; import org.springframework.security.access.AccessDeniedException; import org.springframework.security.core.AuthenticationException; -import org.springframework.security.core.SpringSecurityMessageSource; import org.springframework.security.oauth2.common.DefaultThrowableAnalyzer; import org.springframework.security.oauth2.common.OAuth2AccessToken; import org.springframework.security.oauth2.common.exceptions.ClientAuthenticationException; @@ -67,7 +67,7 @@ public class PigxWebResponseExceptionTranslator implements WebResponseExceptionT ase = (InvalidGrantException) throwableAnalyzer.getFirstThrowableOfType(InvalidGrantException.class, causeChain); if (ase != null) { - String msg = SpringSecurityMessageSource.getAccessor().getMessage( + String msg = PigxSecurityMessageSourceUtil.getAccessor().getMessage( "AbstractUserDetailsAuthenticationProvider.badCredentials", ase.getMessage(), Locale.CHINA); return handleOAuth2Exception(new InvalidException(msg, ase)); } diff --git a/pigx-common/pigx-common-security/src/main/java/com/pig4cloud/pigx/common/security/mobile/MobileAuthenticationProvider.java b/pigx-common/pigx-common-security/src/main/java/com/pig4cloud/pigx/common/security/mobile/MobileAuthenticationProvider.java index 15627f458..a10f7fa97 100644 --- a/pigx-common/pigx-common-security/src/main/java/com/pig4cloud/pigx/common/security/mobile/MobileAuthenticationProvider.java +++ b/pigx-common/pigx-common-security/src/main/java/com/pig4cloud/pigx/common/security/mobile/MobileAuthenticationProvider.java @@ -19,6 +19,7 @@ package com.pig4cloud.pigx.common.security.mobile; import com.pig4cloud.pigx.common.security.component.PigxPreAuthenticationChecks; import com.pig4cloud.pigx.common.security.service.PigxUserDetailsService; +import com.pig4cloud.pigx.common.security.util.PigxSecurityMessageSourceUtil; import lombok.Getter; import lombok.Setter; import lombok.SneakyThrows; @@ -27,7 +28,6 @@ import org.springframework.context.support.MessageSourceAccessor; import org.springframework.security.authentication.AuthenticationProvider; import org.springframework.security.authentication.BadCredentialsException; import org.springframework.security.core.Authentication; -import org.springframework.security.core.SpringSecurityMessageSource; import org.springframework.security.core.userdetails.UserDetails; import org.springframework.security.core.userdetails.UserDetailsChecker; @@ -38,7 +38,7 @@ import org.springframework.security.core.userdetails.UserDetailsChecker; @Slf4j public class MobileAuthenticationProvider implements AuthenticationProvider { - private MessageSourceAccessor messages = SpringSecurityMessageSource.getAccessor(); + private MessageSourceAccessor messages = PigxSecurityMessageSourceUtil.getAccessor(); private UserDetailsChecker detailsChecker = new PigxPreAuthenticationChecks(); diff --git a/pigx-common/pigx-common-security/src/main/java/com/pig4cloud/pigx/common/security/mobile/MobileSecurityConfigurer.java b/pigx-common/pigx-common-security/src/main/java/com/pig4cloud/pigx/common/security/mobile/MobileSecurityConfigurer.java index 94a0bdbba..dff52c7aa 100644 --- a/pigx-common/pigx-common-security/src/main/java/com/pig4cloud/pigx/common/security/mobile/MobileSecurityConfigurer.java +++ b/pigx-common/pigx-common-security/src/main/java/com/pig4cloud/pigx/common/security/mobile/MobileSecurityConfigurer.java @@ -18,7 +18,7 @@ package com.pig4cloud.pigx.common.security.mobile; import com.fasterxml.jackson.databind.ObjectMapper; -import com.pig4cloud.pigx.common.security.component.ResourceAuthExceptionEntryPoint; +import com.pig4cloud.pigx.common.security.component.PigxCommenceAuthExceptionEntryPoint; import com.pig4cloud.pigx.common.security.service.PigxUserDetailsService; import lombok.Getter; import lombok.Setter; @@ -57,7 +57,7 @@ public class MobileSecurityConfigurer extends SecurityConfigurerAdapter + * @see org.springframework.security.core.SpringSecurityMessageSource pigx 框架自身异常处理， + * 建议所有异常都使用此工具类型 避免无法复写 SpringSecurityMessageSource + */ +public class PigxSecurityMessageSourceUtil extends ReloadableResourceBundleMessageSource { + + // ~ Constructors + // =================================================================================================== + + public PigxSecurityMessageSourceUtil() { + setBasename("classpath:messages/messages"); + setDefaultLocale(Locale.CHINA); + } + + // ~ Methods + // ======================================================================================================== + + public static MessageSourceAccessor getAccessor() { + return new MessageSourceAccessor(new PigxSecurityMessageSourceUtil()); + } + +} \ No newline at end of file diff --git a/pigx-common/pigx-common-security/src/main/resources/org/springframework/security/messages_zh_CN.properties b/pigx-common/pigx-common-security/src/main/resources/messages/messages_zh_CN.properties similarity index 94% rename from pigx-common/pigx-common-security/src/main/resources/org/springframework/security/messages_zh_CN.properties rename to pigx-common/pigx-common-security/src/main/resources/messages/messages_zh_CN.properties index 86d66087f..590e44a53 100644 --- a/pigx-common/pigx-common-security/src/main/resources/org/springframework/security/messages_zh_CN.properties +++ b/pigx-common/pigx-common-security/src/main/resources/messages/messages_zh_CN.properties @@ -13,18 +13,21 @@ # contributors may be used to endorse or promote products derived from # this software without specific prior written permission. # Author: lengleng (wangiegie@gmail.com) +# -------------------------------------- +# PIGX \u4E2D\u7684\u5F02\u5E38\u4FE1\u606F\u4F7F\u7528\u6B64\u6587\u4EF6\u5B9A\u4E49 # -AbstractAccessDecisionManager.accessDenied=\u6743\u9650\u4E0D\u8DB3,\u4E0D\u5141\u8BB8\u8BBF\u95EE +AbstractAccessDecisionManager.accessDenied=\u6743\u9650\u4E0D\u8DB3,\u4E0D\u5141\u8BB8\u8BBF\u95EE{0} AbstractLdapAuthenticationProvider.emptyPassword=\u5BC6\u7801\u4E0D\u80FD\u4E3A\u7A7A AbstractSecurityInterceptor.authenticationNotFound=\u672A\u5728SecurityContext\u4E2D\u67E5\u627E\u5230\u8BA4\u8BC1\u5BF9\u8C61 AbstractUserDetailsAuthenticationProvider.badCredentials=\u7528\u6237\u540D\u4E0D\u5B58\u5728\u6216\u8005\u5BC6\u7801\u9519\u8BEF +AbstractUserDetailsAuthenticationProvider.badClientCredentials=\u5BA2\u6237\u7AEF\u4FE1\u606F\u9519\u8BEF\uFF0CBasic\u8BA4\u8BC1\u5931\u8D25 AbstractUserDetailsAuthenticationProvider.noopBindAccount=\u672A\u7ED1\u5B9A\u767B\u5F55\u8D26\u53F7\uFF0C\u8BF7\u4F7F\u7528\u5BC6\u7801\u767B\u5F55\u540E\u7ED1\u5B9A AbstractUserDetailsAuthenticationProvider.credentialsExpired=\u7528\u6237\u51ED\u8BC1\u5DF2\u8FC7\u671F AbstractUserDetailsAuthenticationProvider.disabled=\u7528\u6237\u672A\u6FC0\u6D3B AbstractUserDetailsAuthenticationProvider.expired=\u7528\u6237\u5E10\u53F7\u5DF2\u8FC7\u671F AbstractUserDetailsAuthenticationProvider.locked=\u7528\u6237\u5E10\u53F7\u5DF2\u88AB\u9501\u5B9A AbstractUserDetailsAuthenticationProvider.onlySupports=\u4EC5\u4EC5\u652F\u6301UsernamePasswordAuthenticationToken -AbstractUserDetailsAuthenticationProvider.badTenantId=\u65E0\u6548\u7684TenantId +AbstractUserDetailsAuthenticationProvider.badTenantId=\u65E0\u6548\u7684\u79DF\u6237\u7F16\u53F7:{0} AccountStatusUserDetailsChecker.credentialsExpired=\u7528\u6237\u51ED\u8BC1\u5DF2\u8FC7\u671F AccountStatusUserDetailsChecker.disabled=\u7528\u6237\u672A\u6FC0\u6D3B AccountStatusUserDetailsChecker.expired=\u7528\u6237\u5E10\u53F7\u5DF2\u8FC7\u671F