package cn.gistack.auth.config;
|
|
import cn.gistack.auth.granter.PhoneTokenGranter;
|
import cn.gistack.auth.utils.TokenUtil;
|
import cn.gistack.common.cache.CacheNames;
|
import com.alibaba.nacos.common.utils.StringUtils;
|
import lombok.SneakyThrows;
|
import org.springblade.core.redis.cache.BladeRedis;
|
import org.springblade.core.tool.utils.DigestUtil;
|
import org.springblade.core.tool.utils.Func;
|
import org.springblade.core.tool.utils.WebUtil;
|
import org.springframework.beans.factory.annotation.Autowired;
|
import org.springframework.security.authentication.BadCredentialsException;
|
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
|
import org.springframework.security.authentication.dao.DaoAuthenticationProvider;
|
import org.springframework.security.core.AuthenticationException;
|
import org.springframework.security.core.userdetails.UserDetails;
|
import org.springframework.security.core.userdetails.UserDetailsService;
|
import org.springframework.security.core.userdetails.UsernameNotFoundException;
|
import org.springframework.security.oauth2.common.exceptions.UserDeniedAuthorizationException;
|
import org.springframework.stereotype.Component;
|
import javax.servlet.http.HttpServletRequest;
|
import java.time.Duration;
|
|
/**
|
* 自定义安全认证
|
* @author zhongrj
|
* @time 2022-9-2
|
*/
|
@Component
|
public class MyAuthenticationProvider extends DaoAuthenticationProvider {
|
|
/**
|
* 免密常量
|
*/
|
public static final String CUSTOM_LOGIN_SMS = "CUSTOM_LOGIN_SMS";
|
public static final String CUSTOM_LOGIN_WX = "CUSTOM_LOGIN_WX";
|
|
public static final String CUSTOM_LOGIN_OAUTH = "CUSTOM_LOGIN_OAUTH";
|
|
public static final String OAUTH = "oauth";
|
public static final String PHONE = "phone";
|
public static final String WX = "wx";
|
|
@Autowired
|
private BladeRedis bladeRedis;
|
|
/**
|
* 设置 userDetailsService
|
* @param userDetailsService
|
*/
|
public MyAuthenticationProvider(UserDetailsService userDetailsService) {
|
super();
|
setUserDetailsService(userDetailsService);
|
}
|
|
/**
|
* 自定义处理密码校验逻辑
|
* @param userDetails 用户信息
|
* @param authentication 认证对象信息
|
* @throws AuthenticationException 认证异常对象信息
|
*/
|
@SneakyThrows
|
@Override
|
protected void additionalAuthenticationChecks(UserDetails userDetails, UsernamePasswordAuthenticationToken authentication) throws AuthenticationException {
|
if (authentication.getCredentials() == null) {
|
this.logger.debug("Authentication failed: no credentials provided");
|
throw new BadCredentialsException(this.messages.getMessage("AbstractUserDetailsAuthenticationProvider.badCredentials", "Bad credentials"));
|
} else {
|
String password = authentication.getCredentials().toString();
|
|
HttpServletRequest request = WebUtil.getRequest();
|
String grantType = request.getParameter(TokenUtil.GRANT_TYPE_KEY);
|
// 获取租户ID
|
String headerTenant = request.getHeader(TokenUtil.TENANT_HEADER_KEY);
|
String paramTenant = request.getParameter(TokenUtil.TENANT_PARAM_KEY);
|
// 指定租户ID
|
String tenantId = StringUtils.isBlank(headerTenant) ? paramTenant : headerTenant;
|
|
// 手机号短信登录时不验证密码、微信登录时不验证密码、单点登录时不验证密码
|
if (grantType.equals(PHONE) || grantType.equals(WX) || grantType.equals(OAUTH)) {
|
// 成功则清除登录错误次数
|
delFailCount(tenantId, userDetails.getUsername());
|
return;
|
}
|
|
String detailsPassword = userDetails.getPassword().substring(7);
|
if (!detailsPassword.equals(DigestUtil.hex(password))) {
|
int count = getFailCount(tenantId, userDetails.getUsername());
|
// 用户存在但密码错误,超过次数则锁定账号
|
if (grantType != null && !grantType.equals(TokenUtil.REFRESH_TOKEN_KEY)) {
|
setFailCount(tenantId, userDetails.getUsername(), count);
|
throw new UserDeniedAuthorizationException(TokenUtil.USER_NOT_FOUND);
|
}
|
this.logger.debug("Failed to authenticate since password does not match stored value");
|
throw new BadCredentialsException(this.messages.getMessage("AbstractUserDetailsAuthenticationProvider.badCredentials", "Bad credentials"));
|
}
|
// 成功则清除登录错误次数
|
delFailCount(tenantId, userDetails.getUsername());
|
}
|
}
|
|
/**
|
* 获取账号错误次数
|
*
|
* @param tenantId 租户id
|
* @param username 账号
|
* @return int
|
*/
|
private int getFailCount(String tenantId, String username) {
|
return Func.toInt(bladeRedis.get(CacheNames.tenantKey(tenantId, CacheNames.USER_FAIL_KEY, username)), 0);
|
}
|
|
/**
|
* 设置账号错误次数
|
*
|
* @param tenantId 租户id
|
* @param username 账号
|
* @param count 次数
|
*/
|
private void setFailCount(String tenantId, String username, int count) {
|
bladeRedis.setEx(CacheNames.tenantKey(tenantId, CacheNames.USER_FAIL_KEY, username), count + 1, Duration.ofMinutes(30));
|
}
|
|
/**
|
* 清空账号错误次数
|
*
|
* @param tenantId 租户id
|
* @param username 账号
|
*/
|
private void delFailCount(String tenantId, String username) {
|
bladeRedis.del(CacheNames.tenantKey(tenantId, CacheNames.USER_FAIL_KEY, username));
|
}
|
}
|
