Java 类org.springframework.security.web.authentication.rememberme.RememberMeAuthenticationFilter 实例源码

@Override
protected void customizeRememberMe(HttpSecurity http) throws Exception {
  UserDetailsService userDetailsService = lookup("userDetailsService");
  PersistentTokenRepository persistentTokenRepository = lookup("persistentTokenRepository");
  AbstractRememberMeServices rememberMeServices = lookup("rememberMeServices");
  RememberMeAuthenticationFilter rememberMeAuthenticationFilter =
      lookup("rememberMeAuthenticationFilter");

  http.rememberMe()
      .userDetailsService(userDetailsService)
      .tokenRepository(persistentTokenRepository)
      .rememberMeServices(rememberMeServices)
      .key(rememberMeServices.getKey())
      .and()
      .logout()
      .logoutUrl(LOGOUT_ENDPOINT)
      .and()
      .addFilterAt(rememberMeAuthenticationFilter, RememberMeAuthenticationFilter.class);
}

@Override
protected void configure(HttpSecurity http) throws Exception {
  AbstractPreAuthenticatedProcessingFilter accessTokenAuthenticationFilter = accessTokenAuthenticationFilter();

  http
    .addFilterBefore(accessTokenAuthenticationFilter, RememberMeAuthenticationFilter.class)
    .csrf().disable()
    .exceptionHandling().authenticationEntryPoint(getAuthenticationEntryPoint())
    .and()
    .authorizeRequests()
    .requestMatchers(request -> request.getRequestURI().startsWith(loginPath)).anonymous()
    .requestMatchers(request -> request.getRequestURI().equals(userPath) && request.getMethod().equalsIgnoreCase("POST")).anonymous()
    .requestMatchers(request -> request.getRequestURI().startsWith(passwordRequestPath)).permitAll()
    .requestMatchers(request -> request.getRequestURI().startsWith(apiBasePath + getPathFromResource(PasswordRequest.class))).anonymous()
    .requestMatchers(request -> request.getRequestURI().startsWith(apiBasePath)).authenticated()
    .and()
    .formLogin()
    .loginPage(loginPath)
    .usernameParameter("username")
    .passwordParameter("password")
    .successHandler(loginSuccessHandler())
    .failureHandler(loginFailureHandler())
    .permitAll()
    .and()
    .logout()
    .logoutUrl(logoutPath)
    .logoutSuccessHandler(logoutSuccessHandler())
    .permitAll();

  http.rememberMe().rememberMeServices(rememberMeServices()).key("token");
}

@Override
public void init(FilterConfig filterConfig) throws ServletException {
    ArtifactorySystemProperties properties =
            ((ArtifactoryHome) filterConfig.getServletContext().getAttribute(ArtifactoryHome.SERVLET_CTX_ATTR))
                    .getArtifactoryProperties();
    ConstantValues disableRememberMeProp = ConstantValues.securityDisableRememberMe;
    Boolean disableRememberMe = properties.getBooleanProperty(disableRememberMeProp);
    if (!disableRememberMe) {
        ServletContext servletContext = filterConfig.getServletContext();
        ArtifactoryContext context = RequestUtils.getArtifactoryContext(servletContext);
        rememberMeDelegateFilter = context.beanForType(RememberMeAuthenticationFilter.class);
        rememberMeDelegateFilter.init(filterConfig);
    }
}

@Bean
RememberMeAuthenticationFilter rememberMeAuthenticationFilter() throws Exception {
    return new RememberMeAuthenticationFilter(authenticationManager(), persistentTokenBasedRememberMeServices());
}

@Override
protected void configure(HttpSecurity http) throws Exception {
    /**
     * To keep readability, please do not use IDE's code organization feature for this code.
     *
     * Current format for security configuration is:
     *  .security feature() // Feature method to config
     *      .feature-specific configurations()
     *      .and() // And of the configuration for the feature
     *  .another security feature()
     *      .configuration()
     */
    http
        .authorizeRequests()
            .antMatchers("/api/session").permitAll()
            .antMatchers("/h2-console/**").permitAll()
            .antMatchers("/api/**").authenticated()
            .and()
        .headers()
            .frameOptions().disable() // for h2
            .and()
        .requestCache()
            .requestCache(new NullRequestCache())
            .and()
        .sessionManagement()
            .sessionCreationPolicy(SessionCreationPolicy.IF_REQUIRED)
            .and()
        .rememberMe()
            .rememberMeServices(rememberMeServices())
            .key(oSoonProperties.getRememberMeKey())
            .and()
        .csrf()
            .disable()
        .logout()
            .logoutRequestMatcher(r -> r.getMethod().equalsIgnoreCase("DELETE") && r.getRequestURI().equalsIgnoreCase("/api/session"))
            .logoutSuccessUrl("/")
            .clearAuthentication(true)
            .deleteCookies(oSoonProperties.getCookieName())
            .and()
        .addFilterBefore(rememberMeAuthenticationFilter(), RememberMeAuthenticationFilter.class);
}

@Bean
public RememberMeAuthenticationFilter rememberMeAuthenticationFilter(){
    return new RememberMeAuthenticationFilter(authenticationManager(),rememberMeServices());
}

/**
 * Configures the protected private resources.
 *
 * @param http HTTP sec object
 * @throws Exception ex
 */
@Override
protected void configure(HttpSecurity http) throws Exception {
    ConfigObject protectedResources = Config.getConfig().getObject("security.protected");
    ConfigValue apiSec = Config.getConfig().getValue("security.api_security");
    boolean enableRestFilter = apiSec != null && Boolean.TRUE.equals(apiSec.unwrapped());
    String signinPath = Config.getConfigParam("security.signin", "/signin");
    String signoutPath = Config.getConfigParam("security.signout", "/signout");
    String accessDeniedPath = Config.getConfigParam("security.access_denied", "/403");
    String signoutSuccessPath = Config.getConfigParam("security.signout_success", signinPath);

    // If API security is disabled don't add the API endpoint to the list of protected resources
    if (enableRestFilter) {
        http.authorizeRequests().requestMatchers(RestRequestMatcher.INSTANCE);
    }

    parseProtectedResources(http, protectedResources);

    if (Config.getConfigBoolean("security.csrf_protection", true)) {
        http.csrf().requireCsrfProtectionMatcher(CsrfProtectionRequestMatcher.INSTANCE).
                csrfTokenRepository(csrfTokenRepository);
    } else {
        http.csrf().disable();
    }

    http.sessionManagement().enableSessionUrlRewriting(false);
    http.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.NEVER);
    http.sessionManagement().sessionAuthenticationStrategy(new NullAuthenticatedSessionStrategy());
    http.exceptionHandling().authenticationEntryPoint(new SimpleAuthenticationEntryPoint(signinPath));
    http.exceptionHandling().accessDeniedHandler(new SimpleAccessDeniedHandler(accessDeniedPath));
    http.requestCache().requestCache(new SimpleRequestCache());
    http.logout().logoutUrl(signoutPath).logoutSuccessUrl(signoutSuccessPath);
    http.rememberMe().rememberMeServices(rememberMeServices);

    registerAuthFilters(http);

    if (enableRestFilter) {
        if (jwtFilter != null) {
            jwtFilter.setAuthenticationManager(authenticationManager());
            http.addFilterBefore(jwtFilter, RememberMeAuthenticationFilter.class);
        }
        RestAuthFilter restFilter = new RestAuthFilter();
        http.addFilterAfter(restFilter, JWTRestfulAuthFilter.class);
    }
}