Spring OAuth2提供了一个框架，可以使我们很容易地实现
短信验证码登录。下面是实现该功能的简单步骤：
1. 添加依赖
在pom.xml文件中添加以下依赖项：
```
<dependency>
<groupId>org.
springframework.boot</groupId>
<artifactId>
spring-boot-starter-security</artifactId>
</dependency>
<dependency>
<groupId>org.
springframework.security.
oauth.boot</groupId>
<artifactId>
spring-security-
oauth2-autoconfigure</artifactId>
<version>2.1.0.RELEASE</version>
</dependency>
```
2. 配置Security
在
Spring Security配置文件中添加以下配置：
```
@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {
@Autowired
private UserDetailsService userDetailsService;
@Override
protected void configure(
AuthenticationManagerBuilder auth) throws Exception {
auth.userDetailsService(userDetailsService).passwordEncoder(passwordEncoder());
}
@Bean
public PasswordEncoder passwordEncoder(){
return new BCryptPasswordEncoder();
}
@Override
protected void configure(HttpSecurity http) throws Exception {
http.csrf().disable()
.authorizeRequests()
.antMatchers("/
oauth/
token").permitAll()
.anyRequest().authenticated()
.and()
.formLogin().permitAll()
.and()
.logout().permitAll();
}
}
```
这将启用Web安全性，并配置
Spring Security以使用我们提供的用户详细信息服务和密码编码器。它还允许所有人访问
OAuth2令牌端点（/
oauth/
token）。
3. 实现用户详细信息服务
我们需要实现UserDetailsService接口来从我们的数据库或其他数据源中获取用户详细信息。以下是一个示例：
```
@Service
public class UserDetailsServiceImpl implements UserDetailsService {
@Autowired
private UserRepository userRepository;
@Override
public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
User user = userRepository.findByUsername(username);
if(user == null){
throw new UsernameNotFoundException("User not found with username: " + username);
}
return new org.
springframework.security.core.userdetails.User(user.getUsername(), user.getPassword(),
new ArrayList<>());
}
}
```
此服务返回
Spring Security的UserDetails对象，该对象包含有关用户的详细信息。
4. 实现
自定义的
短信验证码登录过滤器
我们需要实现一个
自定义的过滤器来处理
短信验证码登录。以下是一个示例：
```
public class
SmsCode
AuthenticationFilter extends Abstract
AuthenticationProcessingFilter {
public static final String
SPRING_SECURITY_FORM_MOBILE_KEY = "mobile";
public static final String
SPRING_SECURITY_FORM_CODE_KEY = "code";
private String mobileParameter =
SPRING_SECURITY_FORM_MOBILE_KEY;
private String codeParameter =
SPRING_SECURITY_FORM_CODE_KEY;
private boolean postOnly = true;
public
SmsCode
AuthenticationFilter() {
super(new AntPathRequestMatcher("/login/mobile", "POST"));
}
@Override
public
Authentication attempt
Authentication(HttpServletRequest request, HttpServletResponse response)
throws
AuthenticationException, IOException, ServletException {
if (postOnly && !request.getMethod().equals("POST")) {
throw new
AuthenticationServiceException(
"
Authentication method not supported: " + request.getMethod());
}
String mobile = obtainMobile(request);
String code = obtainCode(request);
if (mobile == null) {
mobile = "";
}
if (code == null) {
code = "";
}
mobile = mobile.trim();
SmsCode
AuthenticationToken authRequest = new
SmsCode
AuthenticationToken(mobile, code);
setDetails(request, authRequest);
return this.get
AuthenticationManager().authenticate(authRequest);
}
protected String obtainMobile(HttpServletRequest request) {
return request.getParameter(mobileParameter);
}
protected String obtainCode(HttpServletRequest request) {
return request.getParameter(codeParameter);
}
protected void setDetails(HttpServletRequest request,
SmsCode
AuthenticationToken authRequest) {
authRequest.setDetails(
authenticationDetailsSource.buildDetails(request));
}
public void setMobileParameter(String mobileParameter) {
Assert.hasText(mobileParameter, "Mobile parameter must not be empty or null");
this.mobileParameter = mobileParameter;
}
public void setPostOnly(boolean postOnly) {
this.postOnly = postOnly;
}
public final String getMobileParameter() {
return mobileParameter;
}
public String getCodeParameter() {
return codeParameter;
}
public void setCodeParameter(String codeParameter) {
Assert.hasText(codeParameter, "Code parameter must not be empty or null");
this.codeParameter = codeParameter;
}
}
```
此过滤器将处理POST请求，其中包含用户的手机号码和
短信验证码。它将创建一个
SmsCode
AuthenticationToken对象，该对象将包含有关用户的信息。在这里，我们还可以设置其他详细信息，例如IP地址和请求的时间戳等。
5. 配置认证管理器
在
Spring Security配置文件中添加以下配置：
```
@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {
@Autowired
private UserDetailsService userDetailsService;
@Autowired
private
SmsCode
AuthenticationProvider
smsCode
AuthenticationProvider;
@Override
protected void configure(
AuthenticationManagerBuilder auth) throws Exception {
auth.userDetailsService(userDetailsService).passwordEncoder(passwordEncoder());
auth.
authenticationProvider(
smsCode
AuthenticationProvider);
}
@Bean
public PasswordEncoder passwordEncoder(){
return new BCryptPasswordEncoder();
}
@Override
protected void configure(HttpSecurity http) throws Exception {
http.csrf().disable()
.authorizeRequests()
.antMatchers("/
oauth/
token").permitAll()
.antMatchers("/login/mobile").permitAll()
.anyRequest().authenticated()
.and()
.formLogin().permitAll()
.and()
.logout().permitAll();
http.addFilterBefore(
smsCode
AuthenticationFilter(), UsernamePassword
AuthenticationFilter.class);
}
@Bean
public
SmsCode
AuthenticationFilter
smsCode
AuthenticationFilter() throws Exception {
SmsCode
AuthenticationFilter filter = new
SmsCode
AuthenticationFilter();
filter.set
AuthenticationManager(
authenticationManagerBean());
return filter;
}
@Bean
public
SmsCode
AuthenticationProvider
smsCode
AuthenticationProvider(){
return new
SmsCode
AuthenticationProvider();
}
@Bean
@Override
public
AuthenticationManager
authenticationManagerBean() throws Exception {
return super.
authenticationManagerBean();
}
}
```
这将配置我们的认证管理器，并告诉
Spring Security使用我们
自定义的
SmsCode
AuthenticationProvider来验证
短信验证码。我们还需要将
自定义的
SmsCode
AuthenticationFilter添加到过滤器链中。
6. 实现
自定义的
短信验证码认证提供程序
我们需要实现一个
自定义的认证提供程序来验证
短信验证码。以下是一个示例：
```
public class
SmsCode
AuthenticationProvider implements
AuthenticationProvider {
@Autowired
private UserDetailsService userDetailsService;
@Override
public
Authentication authenticate(
Authentication authentication) throws
AuthenticationException {
SmsCode
AuthenticationToken authenticationToken = (
SmsCode
AuthenticationToken)
authentication;
UserDetails userDetails = userDetailsService.loadUserByUsername((String)
authenticationToken.getPrincipal());
if(userDetails == null){
throw new Internal
AuthenticationServiceException("无法获取用户信息");
}
SmsCode
smsCode = (
SmsCode)
authenticationToken.getCredentials();
if(!
smsCode.getCode().equals("123456")){
throw new BadCredentialsException("
短信验证码不正确");
}
SmsCode
AuthenticationToken authenticationResult = new
SmsCode
AuthenticationToken(userDetails, userDetails.getAuthorities());
authenticationResult.setDetails(
authenticationToken.getDetails());
return
authenticationResult;
}
@Override
public boolean supports(Class<?>
authentication) {
return
SmsCode
AuthenticationToken.class.isAssignableFrom(
authentication);
}
}
```
此提供程序将验证提供的
短信验证码，并返回一个已验证的
SmsCode
AuthenticationToken对象。
最后，我们就可以使用
短信验证码登录了。用户只需在登录页面上输入其手机号码和收到的
短信验证码即可成功登录。
本文介绍了如何在Spring OAuth2中实现自定义的短信验证码授权模式。通过继承AbstractTokenGranter并修改grantType为'sms_code'，创建自定义的SmsAuthenticationToken。同时，需要实现AuthenticationProvider来设定短信验证码的校验规则。最后，将自定义的TokenGranter和AuthenticationProvider添加到系统中，并确保数据库中grant_type字段包含'sms_code'。通过POSTMAN请求验证，整个流程完成。
最低0.47元/天 解锁文章
1973
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
