模块化 Spring 安全 SecurityWebFilterChain

Question

我们的 Spring 安全配置文件越来越大，我们想将它分解成更小的部分。现在我们有以下内容：

public SecurityWebFilterChain securityWebFilterChain(ServerHttpSecurity http) {
    http.securityMatcher(ServerWebExchangeMatchers.pathMatchers("/api/**"))
            .authenticationManager(this.authenticationManager);

    http.authorizeExchange()
            .pathMatchers(HttpMethod.GET, "/api/serviceA/**")
            .hasAuthority("PROP_A");

    http.authorizeExchange()
            .pathMatchers(HttpMethod.GET, "/api/serviceB/**")
            .hasAuthority("PROP_B");

    http.authorizeExchange().pathMatchers(HttpMethod.POST, "/api/login", "/api/logout", "/api/forgotPassword", "/api/confirmForgotPassword").permitAll();

    http.csrf()
            .disable()
            .formLogin()
            .authenticationEntryPoint(new HttpStatusServerEntryPoint(HttpStatus.UNAUTHORIZED))
            .requiresAuthenticationMatcher(
                    ServerWebExchangeMatchers.pathMatchers(HttpMethod.POST, "/api/login"))
            .authenticationFailureHandler(CustomSpringSecurity::onAuthenticationFailure)
            .authenticationSuccessHandler(CustomSpringSecurity::onAuthenticationSuccess)
            .and()
            .logout()
            .logoutUrl("/api/logout")
            .logoutSuccessHandler(new CustomLogoutSuccessHandler(HttpStatus.OK));

    final SecurityWebFilterChain build = http.build();

    build
            .getWebFilters()
            .collectList()
            .subscribe(
                    webFilters -> {
                        for (WebFilter filter : webFilters) {
                            if (filter instanceof AuthenticationWebFilter) {
                                AuthenticationWebFilter awf = (AuthenticationWebFilter) filter;
                                awf.setServerAuthenticationConverter(CustomSpringSecurity::convert);
                            }
                        }
                    });

    return build;
}

我们想用 securityMatcher 来突破 /api/seviceA/** 和 /api/seviceB/** 到自己的 SecurityWebFilterChain @Beans.

但是，我们遇到的问题是配置中存在额外的配置。我们希望最终结果如下所示。

    public SecurityWebFilterChain securityWebFilterChainForServiceA(ServerHttpSecurity http) {
        http.securityMatcher(ServerWebExchangeMatchers.pathMatchers("/api/serviceA/**"));

        http.authorizeExchange()
                .pathMatchers(HttpMethod.GET, "/api/serviceA/**")
                .hasAuthority("PROP_A");
        return http.build();
    }

并且我们希望端点的所有其他配置都是隐式的。

如何在 Spring 安全性中进行这样的模块化？

Answer 1

您可以像这样指定一个接口：

    public interface HttpSecurityConfig {
        Consumer<ServerHttpSecurity> configuration();
    }

然后创建一个 class 为您可以作为 bean 注入的每个端点实现此功能：

    @Component
    public class ServiceASecurityConfig implements HttpSecurityConfig {
        @Override
        public Consumer<ServerHttpSecurity> configuration() {
            return (http) -> {

                http.authorizeExchange()
                        .pathMatchers(HttpMethod.GET, "/api/serviceA/**")
                        .hasAuthority("PROP_A");
            };
        }
    }

    @Component
    public class ServiceBSecurityConfig implements HttpSecurityConfig {
        @Override
        public Consumer<ServerHttpSecurity> configuration() {
            return (http) -> {

                http.authorizeExchange()
                        .pathMatchers(HttpMethod.GET, "/api/serviceB/**")
                        .hasAuthority("PROP_B");
            };
        }
    }

最后修改您的 SecurityWebFilterChain，使其注入所有 HttpSecurityConfig 类型的 bean 并应用配置，如下所示：

public SecurityWebFilterChain securityWebFilterChain(ServerHttpSecurity http, final List<HttpSecurityConfig> httpConfigurations) {
    http.securityMatcher(ServerWebExchangeMatchers.pathMatchers("/api/**"))
            .authenticationManager(this.authenticationManager);

    // This line replaces the individual configurations in your original question
    httpConfigurations.forEach(config -> config.configuration().accept(http));

    http.authorizeExchange().pathMatchers(HttpMethod.POST, "/api/login", "/api/logout", "/api/forgotPassword", "/api/confirmForgotPassword").permitAll();

    http.csrf()
            .disable()
            .formLogin()
            .authenticationEntryPoint(new HttpStatusServerEntryPoint(HttpStatus.UNAUTHORIZED))
            .requiresAuthenticationMatcher(
                    ServerWebExchangeMatchers.pathMatchers(HttpMethod.POST, "/api/login"))
            .authenticationFailureHandler(CustomSpringSecurity::onAuthenticationFailure)
            .authenticationSuccessHandler(CustomSpringSecurity::onAuthenticationSuccess)
            .and()
            .logout()
            .logoutUrl("/api/logout")
            .logoutSuccessHandler(new CustomLogoutSuccessHandler(HttpStatus.OK));

    final SecurityWebFilterChain build = http.build();

    build
            .getWebFilters()
            .collectList()
            .subscribe(
                    webFilters -> {
                        for (WebFilter filter : webFilters) {
                            if (filter instanceof AuthenticationWebFilter) {
                                AuthenticationWebFilter awf = (AuthenticationWebFilter) filter;
                                awf.setServerAuthenticationConverter(CustomSpringSecurity::convert);
                            }
                        }
                    });

    return build;
}

模块化 Spring 安全 SecurityWebFilterChain

Modularizing Spring Security SecurityWebFilterChain

java

spring

spring-security

spring-webflux