史上最简单的Spring Security教程（三十四）：用户名密码验证码（记住我）登录与CA登录融合方案

本文链接：https://blog.csdn.net/liuminglei1987/article/details/109098859

在上一篇文章史上最简单的Spring Security教程（三十三）：用户名密码登录新增验证码和RememberMe（记住我）选项中，介绍了如何基于 Spring Security 框架默认的用户名密码登录，自定义 Filter 且添加验证码、记住我选项。如前面文章所述，一个系统的登录方式不止一种，本文即介绍一下如何基于 Spring Security 框架默认的用户名密码登录，自定义 Filter 且添加验证码、记住我选项。

废话不多说，直接看配置。

首先，改造一下登录页，在此前的基础上，新增 验证码、 CA登录 方式。

<div id="login" class="tab-pane active">
  <form th:action="@{/login}" method="post" th:method="post" class="mt-1">
    <div class="form-group">
      <input type="text" class="form-control" name="username" placeholder="用户名">
    </div>
    <div class="form-group">
      <input type="password" class="form-control" name="password" placeholder="密码">
    </div>
    <div class="form-row">
      <div class="form-group col-md-10">
        <input type="text" class="form-control" name="captcha" placeholder="验证码">
      </div>
      <div class="form-group col-md-2">
        <a href="####" id="captcha_link">
          <img id="captcha_img" src="../static/img/captcha.jpg" th:src="@{/captcha/generate}" /></a>
      </div>
    </div>
    <div class="checkbox">
      <label><input type="checkbox" name="remember-me"> 记住我</label>
    </div>
    <button type="submit" class="btn btn-primary btn-block mb-1 mt-1">登录</button>
    <p class="text-muted text-center"> <a href="login.html#">
      <small>忘记密码了？</small></a> | <a href="#">注册一个新账号</a>
    </p>
  </form>
</div>
<div id="ca_login" class="tab-pane">
  <form th:action="@{/certificate_authority_login}" method="post" th:method="post" class="mt-1">
    <div class="form-group">
      <input type="text" class="form-control" name="signature" value="3691308F2A4C2F6983F2880D32E29C84" readonly />
    </div>
    <button type="submit" class="btn btn-primary btn-block mb-1 mt-1">登录</button>
    <p class="text-muted text-center"> <a href="login.html#">
      <small>忘记密码了？</small></a> | <a href="#">注册一个新账号</a>
    </p>
  </form>
</div>

然后，修改 Spring Security 配置，添加自定义的 UsernamePasswordAuthenticationFilter 、 RememberMe 相关配置、及 CA登录 相关配置。

RememberMe 相关配置如下。

protected void configure(HttpSecurity http) throws Exception {
    http
        ......
        .rememberMe()
        .userDetailsService(userDetailsService())
        .tokenValiditySeconds(14 * 24 * 60 * 60)
        ......

}

token默认有效期为两周，即14天，与 Spring Security 默认配置相同。

添加自定义的 UsernamePasswordAuthenticationFilter 的相关配置如下。

protected void configure(HttpSecurity http) throws Exception {
    ......

        http.addFilterAt(usernamePasswordAuthenticationFilter(), UsernamePasswordAuthenticationFilter.class);

}

private UsernamePasswordCaptchaAuthenticationFilter usernamePasswordAuthenticationFilter() throws Exception {
    UsernamePasswordCaptchaAuthenticationFilter authenticationFilter = new UsernamePasswordCaptchaAuthenticationFilter();
    authenticationFilter.setRememberMeServices(tokenBasedRememberMeServices());
    authenticationFilter.setAuthenticationSuccessHandler(authenticationSuccessHandler());
    authenticationFilter.setAuthenticationFailureHandler(authenticationFailureHandler());
    authenticationFilter.setAuthenticationManager(authenticationManager());
    return authenticationFilter;
}
  
......

CA登录方式相关配置如下。

http.addFilterBefore(certificateAuthorityAuthenticationFilter(), UsernamePasswordAuthenticationFilter.class);

......
    
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
    auth
        .authenticationProvider(certificateAuthorityDaoAuthenticationProvider())
        .userDetailsService(customJdbcUserDetailsService())
        .passwordEncoder(new BCryptPasswordEncoder());
}

private AbstractAuthenticationProcessingFilter certificateAuthorityAuthenticationFilter() throws Exception {
    CertificateAuthorityAuthenticationFilter authorityAuthenticationFilter = new CertificateAuthorityAuthenticationFilter();
    authorityAuthenticationFilter.setAuthenticationSuccessHandler(certificateAuthorityAuthenticationSuccessHandler());
    authorityAuthenticationFilter.setAuthenticationFailureHandler(certificateAuthorityAuthenticationFailureHandler());
    authorityAuthenticationFilter.setAuthenticationManager(authenticationManager());
    return authorityAuthenticationFilter;
}

......

好了，准备工作基本就绪，启动系统，访问首页，跳转到登录页，我们先尝试用户名密码验证码登录方式。