程序包 top.dcenter.ums.security.common.api.config

接口 HttpSecurityAware

  • public interface HttpSecurityAware
    对 WebSecurityConfigurerAdapter 的扩展，使其能跨模块的灵活的添加 HttpSecurity 配置, WebSecurity 配置, AuthenticationManagerBuilder 配置.

    注意：

    1. 需要要在 WebSecurityConfigurerAdapter#configure(http) 方法中放在最后处理的配置。实现 postConfigure(HttpSecurity http) 方法。

    2. 需要要在 WebSecurityConfigurerAdapter#configure(http) 方法中放在前面处理的配置。实现 preConfigure(HttpSecurity http) 方法。

    3. WebSecurityConfigurerAdapter 多个配置类继承此类是会报错，且 authorizeRequests 配置时候要 authorizeRequests().anyRequest().authenticate 放到最后，不然在之后配置的都不会生效。实现 getAuthorizeRequestMap() 方法。

    最终在：SecurityCoreAutoConfigurer 中配置.

    版本:
    V1.0 Created by 2020/5/12 12:22
    作者:
    YongWu zheng

    • 方法详细资料

      • configure

        void configure​(org.springframework.security.config.annotation.web.builders.WebSecurity web)
        Override this method to configure WebSecurity. For example, if you wish to ignore certain requests. Endpoints specified in this method will be ignored by Spring Security, meaning it will not protect them from CSRF, XSS, Clickjacking, and so on. Instead, if you want to protect endpoints against common vulnerabilities, then see WebSecurityConfigurerAdapter#configure(HttpSecurity) and the HttpSecurity.authorizeRequests() configuration method.
        参数:
        web - the WebSecurity to use

      • configure

        void configure​(org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder auth)
        throws Exception
        Used by the default implementation of WebSecurityConfigurerAdapter#authenticationManager() to attempt to obtain an AuthenticationManager. If overridden, the AuthenticationManagerBuilder should be used to specify the AuthenticationManager.

        The WebSecurityConfigurerAdapter#authenticationManagerBean() method can be used to expose the resulting AuthenticationManager as a Bean. The WebSecurityConfigurerAdapter#userDetailsServiceBean() can be used to expose the last populated UserDetailsService that is created with the AuthenticationManagerBuilder as a Bean. The UserDetailsService will also automatically be populated on AbstractConfiguredSecurityBuilder.getSharedObject(Class) for use with other SecurityContextConfigurer (i.e. RememberMeConfigurer )

        For example, the following configuration could be used to register in memory authentication that exposes an in memory UserDetailsService: 

         @Override
 protected void configure(AuthenticationManagerBuilder auth) {
        auth
        // enable in memory based authentication with a user named
        // "user" and "admin"
        .inMemoryAuthentication().withUser("user").password("password").roles("USER").and()
                        .withUser("admin").password("password").roles("USER", "ADMIN");
 }

 // Expose the UserDetailsService as a Bean
 @Bean
 @Override
 public UserDetailsService userDetailsServiceBean() throws Exception {
        return super.userDetailsServiceBean();
 }
        参数:
        auth - the AuthenticationManagerBuilder to use
        抛出:
        Exception - Exception

      • preConfigure

        void preConfigure​(org.springframework.security.config.annotation.web.builders.HttpSecurity http)
           throws Exception
        需要要在 WebSecurityConfigurerAdapter#configure(http) 方法中放在前面处理的配置。

        最终在：SecurityCoreAutoConfigurer 中配置
        参数:
        http - HttpSecurity
        抛出:
        Exception - exception

      • postConfigure

        void postConfigure​(org.springframework.security.config.annotation.web.builders.HttpSecurity http)
            throws Exception
        需要要在 WebSecurityConfigurerAdapter#configure(http) 方法中放在最后处理的配置。

        最终在：SecurityCoreAutoConfigurer 中配置
        参数:
        http - HttpSecurity
        抛出:
        Exception - exception

      • permitUrlsFillingPermitAllMap

        default void permitUrlsFillingPermitAllMap​(@NonNull
                                           Set<String> permitUrls,
                                           @NonNull
                                           Map<UriHttpMethodTuple,​Set<String>> permitAllMap)
        permitUrls 注入到 permitAllMap
        参数:
        permitUrls - permitUrls 在 application.yml 配置文件上的 url(带 HttpMethod 后缀; 用 : 分隔)
        permitAllMap - permitAllMap

      • permitUrlFillingPermitAllMap

        default void permitUrlFillingPermitAllMap​(@NonNull
                                          String permitUrl,
                                          @NonNull
                                          Map<UriHttpMethodTuple,​Set<String>> permitAllMap)
        permitUrl 注入到 permitAllMap
        参数:
        permitUrl - permitUrl 在 application.yml 配置文件上的 url(带 HttpMethod 后缀; 用 : 分隔)
        permitAllMap - permitAllMap