是否可以拆分spring的SecurityConfig？

• Z时代
• 2024-01-10
• 分类：问答

我有一个与childA和的项目childB。

我想在中配置childA控制器childA和中的childB控制器的安全性childB。

到目前为止，我有以下内容SecurityConfig：

@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class SecurityConfig extends WebSecurityConfigurerAdapter {
    @Autowired
    private CookieProperties cookieProperties;
    @Autowired
    private LdapUserDetailsManager userDetailsService;
    @Autowired
    private AuthenticationSuccessHandler authenticationSuccessHandler;
    @Autowired
    private AuthenticationEntryPoint authenticationEntryPoint;
    @Autowired
    private AuthenticationFailureHandler authenticationFailureHandler;
    @Autowired
    private AccessDeniedHandler accessDeniedHandler;
    @Autowired
    private LogoutSuccessHandler logoutSuccessHandler;
    @Autowired
    private LdapProperties ldapProperties;
    @Autowired
    private Environment environment;
    @Bean(name = BeanIds.AUTHENTICATION_MANAGER)
    @Override
    public AuthenticationManager authenticationManagerBean() throws Exception {
        return super.authenticationManagerBean();
    }
    @Bean
    public LdapDaoAuthenticationProvider ldapDaoAuthenticationProvider(LdapProperties ldapProperties) {
        LdapDaoAuthenticationProvider provider = new LdapDaoAuthenticationProvider();
        provider.setUserDetailsService(userDetailsService);
        provider.setLdapProperties(ldapProperties);
        provider.setPasswordEncoder(passwordEncoder());
        return provider;
    }
    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
            auth.authenticationProvider(ldapDaoAuthenticationProvider(ldapProperties));
    }
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
            .requestMatcher(
                // how to move this in another file ?
                new OrRequestMatcher(
                    new AntPathRequestMatcher(ChildAHttpPathStore.PATH_SOMETHING),
                    new AntPathRequestMatcher(ChildBHttpPathStore.PATH_SOMETHING),
                )
            )
            .sessionManagement()
                .sessionCreationPolicy(SessionCreationPolicy.NEVER)
                .and()
            .csrf()
                .csrfTokenRepository(corsCookieCsrfTokenRepository())
                .and()
            .authorizeRequests()
                .antMatchers(HttpMethod.GET, CoreHttpPathStore.PING).permitAll()
                .anyRequest().hasAnyAuthority(
                        UserManagement.ROLE_AUTH_SERVICE
                )
            .and()
                .exceptionHandling()
                .accessDeniedHandler(accessDeniedHandler)
                .authenticationEntryPoint(authenticationEntryPoint)
            .and()
                .formLogin()
                .loginProcessingUrl(CoreHttpPathStore.LOGIN)
                .successHandler(authenticationSuccessHandler)
                .failureHandler(authenticationFailureHandler)
                .permitAll()
            .and()
                .logout()
                .logoutUrl(CoreHttpPathStore.LOGOUT)
                .logoutSuccessUrl(CoreHttpPathStore.LOGIN_FROM_LOGOUT)
                .logoutSuccessHandler(logoutSuccessHandler)
                .permitAll()
            .and()
                .headers().cacheControl().disable();
    }
    @Bean(name = "userPasswordEncoder")
    public LdapShaPasswordEncoder passwordEncoder() {
        return new LdapShaPasswordEncoder();
    }
    @Bean
    public CookieSerializer cookieSerializer() {
        DefaultCookieSerializer serializer = new DefaultCookieSerializer();
        if (null != cookieProperties.getName()) { serializer.setCookieName(cookieProperties.getName()); }
        if (null != cookieProperties.getPath()) { serializer.setCookiePath(cookieProperties.getPath()); }
        if (null != cookieProperties.getHttpOnly()) { serializer.setUseHttpOnlyCookie(cookieProperties.getHttpOnly()); }
        if (null != cookieProperties.getMaxAge()) { serializer.setCookieMaxAge(cookieProperties.getMaxAge()); }
        if (null != cookieProperties.getSecure()) { serializer.setUseSecureCookie(cookieProperties.getSecure()); }
        if (null != cookieProperties.getDomain()) { serializer.setDomainName(cookieProperties.getDomain()); }
        return serializer;
    }
    @Bean
    public CorsCookieCsrfTokenRepository corsCookieCsrfTokenRepository(){
        CorsCookieCsrfTokenRepository repository = new CorsCookieCsrfTokenRepository();
        repository.setCookieHttpOnly(false);
        repository.setHeaderName("X-XSRF-TOKEN");
        repository.setCookiePath(cookieProperties.getPath());
        repository.setCookieDomain(cookieProperties.getDomain());
        repository.setCookieName("XSRF-TOKEN");
        return repository;
    }
}

是否可以拆分此配置？

回答：

如果由于spring安全性文档而需要编写Multiple HttpSecurity ，最简单的方法是使用一些内部

类创建用于配置HttpSecurity 的常规配置。

@EnableWebSecurity
public class MultiHttpSecurityConfig {
    @Bean
    public UserDetailsService userDetailsService() throws Exception {
        InMemoryUserDetailsManager manager = new InMemoryUserDetailsManager();
        manager.createUser(User.withUsername("user").password("password").roles("USER").build());
        manager.createUser(User.withUsername("admin").password("password").roles("USER","ADMIN").build());
        return manager;
    }
    @Configuration
    @Order(1)                                                        
    public static class ApiWebSecurityConfigurationAdapter extends WebSecurityConfigurerAdapter {
        protected void configure(HttpSecurity http) throws Exception {
            http
                .antMatcher("/api/**")                               
                .authorizeRequests()
                    .anyRequest().hasRole("ADMIN")
                    .and()
                .httpBasic();
        }
    }
    @Configuration                                                  
    public static class FormLoginWebSecurityConfigurerAdapter extends WebSecurityConfigurerAdapter {
        @Override
        protected void configure(HttpSecurity http) throws Exception {
            http
                .authorizeRequests()
                    .anyRequest().authenticated()
                    .and()
                .formLogin();
        }
    }
}

以上是 是否可以拆分spring的SecurityConfig？ 的全部内容， 来源链接： utcz.com/qa/399589.html