SpringSecurity项目中如何在多个模块中配置认证信息

⒈在SpringSecurity项目中创建AuthorizeConfigProvider接口用于配置认证信息

package cn.coreqi.ssoserver.authorize;

import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configurers.ExpressionUrlAuthorizationConfigurer;

public interface AuthorizeConfigProvider {
    void config(ExpressionUrlAuthorizationConfigurer<HttpSecurity>.ExpressionInterceptUrlRegistry config);
}

⒉我们实现此接口

package cn.coreqi.ssoserver.authorize.impl;

import cn.coreqi.ssoserver.authorize.AuthorizeConfigProvider;
import org.springframework.http.HttpMethod;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configurers.ExpressionUrlAuthorizationConfigurer;
import org.springframework.stereotype.Component;

@Component
public class CoreqiAuthorizeConfigProvider implements AuthorizeConfigProvider {
    @Override
    public void config(ExpressionUrlAuthorizationConfigurer<HttpSecurity>.ExpressionInterceptUrlRegistry config) {
          config.antMatchers("/oauth/*","/login/*").permitAll()
                .antMatchers(HttpMethod.GET,"/auth/*").hasRole("admin")
                .anyRequest().authenticated();  //任何请求都需要身份认证
    }
}

⒊在SpringSecurity项目中创建AuthorizeConfigManager接口用于调用系统中所有的配置信息

package cn.coreqi.ssoserver.authorize;

import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configurers.ExpressionUrlAuthorizationConfigurer;

public interface AuthorizeConfigManager {
    void config(ExpressionUrlAuthorizationConfigurer<HttpSecurity>.ExpressionInterceptUrlRegistry config);
}

⒋我们实现此接口

package cn.coreqi.ssoserver.authorize.impl;

import cn.coreqi.ssoserver.authorize.AuthorizeConfigManager;
import cn.coreqi.ssoserver.authorize.AuthorizeConfigProvider;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configurers.ExpressionUrlAuthorizationConfigurer;
import org.springframework.stereotype.Component;

import java.util.Set;

@Component
public class CoreqiAuthorizeConfigManager implements AuthorizeConfigManager {
    /**
     * 将系统中所有的AuthorizeConfigProvider收集起来
     */
    @Autowired
    private Set<AuthorizeConfigProvider> authorizeConfigProviders;
    @Override
    public void config(ExpressionUrlAuthorizationConfigurer<HttpSecurity>.ExpressionInterceptUrlRegistry config) {
        for (AuthorizeConfigProvider authorizeConfigProvider : authorizeConfigProviders ){
            authorizeConfigProvider.config(config);
        }
        config.anyRequest().authenticated();
    }
}

⒌在SpringSecurity配置中进行如下配置

@EnableWebSecurity
public class SsoWebSecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired
    private AuthorizeConfigManager authorizeConfigManager;
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.formLogin()
                .and()
                .csrf().disable();    //禁用CSRF

        authorizeConfigManager.config(http.authorizeRequests());
    }
}