Spring Security如何实现手机号或者邮箱多种方式登录认证

在 Spring Security 中实现手机号或邮箱多种方式登录认证涉及到自定义认证逻辑，以支持不同的认证方式（如邮箱、手机号）而不仅仅是传统的用户名和密码。以下是实现这种功能的详细步骤，包括如何配置自定义认证提供者、如何处理认证请求、以及如何更新用户详情服务。

1. **自定义认证提供者**

创建一个自定义的 `AuthenticationProvider` 来处理多种登录方式的认证。

**步骤：**

1. **创建自定义认证提供者**

   自定义 `AuthenticationProvider` 用于处理基于手机号或邮箱的登录请求。   ```java
   

import org.springframework.security.core.Authentication;
   import org.springframework.security.core.AuthenticationException;
   import org.springframework.security.core.userdetails.UserDetails;
   import org.springframework.security.core.userdetails.UserDetailsService;
   import org.springframework.security.core.userdetails.UsernameNotFoundException;
   import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
   import org.springframework.security.authentication.AuthenticationProvider;
   import org.springframework.security.authentication.BadCredentialsException;

   public class CustomAuthenticationProvider implements AuthenticationProvider {

       private final UserDetailsService userDetailsService;

       public CustomAuthenticationProvider(UserDetailsService userDetailsService) {
           this.userDetailsService = userDetailsService;
       }

       @Override
       public Authentication authenticate(Authentication authentication) throws AuthenticationException {
           String principal = authentication.getName();
           String credentials = (String) authentication.getCredentials();

           // Determine if the principal is an email or phone number
           UserDetails userDetails;
           if (isEmail(principal)) {
               userDetails = userDetailsService.loadUserByUsername(principal);
           } else if (isPhoneNumber(principal)) {
               userDetails = userDetailsService.loadUserByUsername(principal);
           } else {
               throw new BadCredentialsException("Invalid credentials");
           }

           if (userDetails != null && credentials.equals("your_password_check_logic")) {
               return new UsernamePasswordAuthenticationToken(userDetails, credentials, userDetails.getAuthorities());
           }

           throw new BadCredentialsException("Invalid credentials");
       }

       @Override
       public boolean supports(Class<?> authentication) {
           return UsernamePasswordAuthenticationToken.class.isAssignableFrom(authentication);
       }

       private boolean isEmail(String principal) {
           return principal.contains("@"); // Simplified email check
       }

       private boolean isPhoneNumber(String principal) {
           return principal.matches("\\d{10}"); // Simplified phone number check
       }
   }

   ```

2. **配置 Spring Security 使用自定义认证提供者**

   在 `SecurityConfig` 中配置 Spring Security 使用自定义认证提供者。   ```java

   import org.springframework.context.annotation.Bean;
   import org.springframework.context.annotation.Configuration;
   import org.springframework.security.config.annotation.web.builders.HttpSecurity;
   import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
   import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
   import org.springframework.security.core.userdetails.UserDetailsService;
   import org.springframework.security.authentication.AuthenticationManager;
   import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;

   @Configuration
   @EnableWebSecurity
   public class SecurityConfig extends WebSecurityConfigurerAdapter {

       @Bean
       public UserDetailsService userDetailsService() {
           return new CustomUserDetailsService(); // Implement this service to load user details
       }

       @Bean
       public CustomAuthenticationProvider customAuthenticationProvider(UserDetailsService userDetailsService) {
           return new CustomAuthenticationProvider(userDetailsService);
       }

       @Override
       protected void configure(AuthenticationManagerBuilder auth) throws Exception {
           auth.authenticationProvider(customAuthenticationProvider(userDetailsService()));
       }

       @Override
       protected void configure(HttpSecurity http) throws Exception {
           http
               .authorizeRequests()
               .anyRequest().authenticated()
               .and()
               .formLogin()
               .and()
               .httpBasic();
       }
   }

   ```

### 2. **自定义用户详情服务**

实现 `UserDetailsService` 以根据不同的标识符（手机号或邮箱）加载用户信息。

**步骤：**

1. **实现 `UserDetailsService`**   ```java
   

import org.springframework.security.core.userdetails.UserDetails;
   import org.springframework.security.core.userdetails.UsernameNotFoundException;
   import org.springframework.security.core.userdetails.UserDetailsService;
   import org.springframework.stereotype.Service;

   @Service
   public class CustomUserDetailsService implements UserDetailsService {

       @Override
       public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
           // Implement logic to load user details by username (email or phone number)
           // For example, query the database to find the user by email or phone number
           UserDetails user = findUserByEmailOrPhoneNumber(username);
           if (user == null) {
               throw new UsernameNotFoundException("User not found with username: " + username);
           }
           return user;
       }

       private UserDetails findUserByEmailOrPhoneNumber(String identifier) {
           // Implement your data fetching logic here
           return null; // Replace with actual user details retrieval
       }
   }

   ```

3. **自定义认证过滤器（可选）**

如果需要自定义请求的处理方式，可以创建自定义的认证过滤器。

**步骤：**

1. **创建自定义认证过滤器**   ```java
   

import org.springframework.security.core.Authentication;
   import org.springframework.security.core.AuthenticationException;
   import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;

   import javax.servlet.http.HttpServletRequest;
   import javax.servlet.http.HttpServletResponse;

   public class CustomAuthenticationFilter extends UsernamePasswordAuthenticationFilter {

       @Override
       public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response) throws AuthenticationException {
           String username = request.getParameter("username");
           String password = request.getParameter("password");

           // Create an authentication token based on the credentials
           UsernamePasswordAuthenticationToken authRequest = new UsernamePasswordAuthenticationToken(username, password);

           return this.getAuthenticationManager().authenticate(authRequest);
       }
   }

   ```

2. **配置自定义认证过滤器**   ```java
 

 @Configuration
   @EnableWebSecurity
   public class SecurityConfig extends WebSecurityConfigurerAdapter {

       @Override
       protected void configure(HttpSecurity http) throws Exception {
           CustomAuthenticationFilter customFilter = new CustomAuthenticationFilter();
           customFilter.setAuthenticationManager(authenticationManager());

           http
               .addFilterAt(customFilter, UsernamePasswordAuthenticationFilter.class)
               .authorizeRequests()
               .anyRequest().authenticated()
               .and()
               .formLogin()
               .and()
               .httpBasic();
       }
   }

   ```

4. **处理用户注册和认证**

确保用户注册过程能够处理手机号和邮箱，并在认证时能够验证这些信息。

1. **用户注册示例**

   在用户注册时，将邮箱和手机号存储在数据库中，以供认证使用。   ```java

   public class UserRegistrationService {

       @Autowired
       private UserRepository userRepository;

       public void registerUser(String email, String phoneNumber, String password) {
           User user = new User();
           user.setEmail(email);
           user.setPhoneNumber(phoneNumber);
           user.setPassword(password);
           userRepository.save(user);
       }
   }

   ```

2. **更新用户登录逻辑**

   确保用户的登录信息（手机号或邮箱）与存储在数据库中的数据一致，并且能够正确地进行验证。

### 总结

要在 Spring Security 中实现基于手机号或邮箱的多种方式登录认证，通常涉及以下几个步骤：

1. **自定义认证提供者**：实现 `AuthenticationProvider`，根据输入的认证信息（手机号或邮箱）进行用户认证。
2. **自定义用户详情服务**：实现 `UserDetailsService`，根据邮箱或手机号加载用户详细信息。
3. **自定义认证过滤器（可选）**：创建自定义过滤器，以处理特定的认证请求格式。
4. **处理用户注册**：确保用户的注册信息能够支持手机号和邮箱，并正确存储和验证。

通过这些步骤，你可以实现一个灵活的认证系统，支持多种登录方式，并能够适应不同的业务需求。