Spring Boot + Spring Security + Spring Session + Spring Session Hazelcast 整合

超、凢脫俗 2022-05-27 12:16 223阅读 0赞

Spring Boot + Spring Security + Spring Session + Spring Session Hazelcast 整合随笔

Spring Boot 采用2.0.2.RELEASE版本，Hazelcast 采用同步的3.9.3版本

1.Spring Boot + Spring Security

@EnableWebSecurity
    public class SecurityConfig extends WebSecurityConfigurerAdapter {
        
        @Override
        protected void configure(HttpSecurity http) throws Exception {
            http.csrf().disable().authorizeRequests().antMatchers("/common/**","/login").permitAll().anyRequest().authenticated()
                    .and()
                    .formLogin().loginPage("/login").failureUrl("/login-error").defaultSuccessUrl("/index").usernameParameter("username")
                    .passwordParameter("password").permitAll()
                    .and()
                    .logout().permitAll()
                    .and()
                    .sessionManagement().maximumSessions(1).expiredUrl("/login");
        }
    
        @Autowired
        public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
            auth.userDetailsService(getUserDetailsServiceImpl()).passwordEncoder(new PasswordEncoder() {
                @Override
                public String encode(CharSequence charSequence) {
                    return Tools.getMD5((String)charSequence);
                }
    
                @Override
                public boolean matches(CharSequence charSequence, String s) {
                    return s.equals(Tools.getMD5((String)charSequence));
                }
            });//.passwordEncoder(new Md5PasswordEncoder());
        }
        @Bean
        public CustomUserDetailsServiceImpl getUserDetailsServiceImpl() {
            return new CustomUserDetailsServiceImpl();
        }
    }

1.1 CustomUserDetailsServiceImpl实现类，省略Mybatis配置

public class CustomUserDetailsServiceImpl implements UserDetailsService {
        private static final Logger LOGGER = LoggerFactory.getLogger(CustomUserDetailsServiceImpl.class);
        @Autowired
        private LoginMapper lMapper;
        @Autowired
        private HttpSession session;
        @Override
        public UserDetails loadUserByUsername(String s) throws UsernameNotFoundException {
            LOGGER.error(session.getId());
            UserSession userSession = lMapper.getUserSessionInfoByUser(s);
            ProUser user = new ProUser(userSession.getGuid(), userSession.getUser(), userSession.getPassword(), "1".equals(userSession.getEnable()) ? true : false);
            session.setAttribute("user", user);
            return user;
        }
    }

2.Hazelcast配置

@Configuration
    @EnableHazelcastHttpSession(maxInactiveIntervalInSeconds = 60)
    public class HazelcastHttpSessionConfig {
        @Bean
        public HazelcastInstance hazelcastInstance() {
            MapAttributeConfig attributeConfig = new MapAttributeConfig()
                    .setName(HazelcastSessionRepository.PRINCIPAL_NAME_ATTRIBUTE)
                    .setExtractor(PrincipalNameExtractor.class.getName());
            Config config = new Config();
            config.getMapConfig(HazelcastSessionRepository.DEFAULT_SESSION_MAP_NAME)
                    .addMapAttributeConfig(attributeConfig)
                    .addMapIndexConfig(new MapIndexConfig(
                            HazelcastSessionRepository.PRINCIPAL_NAME_ATTRIBUTE, false));
            return Hazelcast.newHazelcastInstance(config);
        }
    }

3.增加Hazelcast+Security配置

@EnableWebSecurity
    public class SecurityConfig extends WebSecurityConfigurerAdapter {
        @Autowired
        private HazelcastSessionRepository sessionRepository;
        @Bean
        SpringSessionBackedSessionRegistry sessionRegistry() {
            return new SpringSessionBackedSessionRegistry<>(sessionRepository);
        }
        @Override
        protected void configure(HttpSecurity http) throws Exception {
            http.csrf().disable().authorizeRequests().antMatchers("/common/**","/login").permitAll().anyRequest().authenticated()
                    .and()
                    .formLogin().loginPage("/login").failureUrl("/login-error").defaultSuccessUrl("/index").usernameParameter("username")
                    .passwordParameter("password").permitAll()
                    .and()
                    .logout().permitAll()
                    .and()
                    .sessionManagement().maximumSessions(1).expiredUrl("/login").sessionRegistry(sessionRegistry());
        }
    
        @Autowired
        public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
            auth.userDetailsService(getUserDetailsServiceImpl()).passwordEncoder(new PasswordEncoder() {
                @Override
                public String encode(CharSequence charSequence) {
                    return Tools.getMD5((String)charSequence);
                }
    
                @Override
                public boolean matches(CharSequence charSequence, String s) {
                    return s.equals(Tools.getMD5((String)charSequence));
                }
            });//.passwordEncoder(new Md5PasswordEncoder());
        }
        @Bean
        public CustomUserDetailsServiceImpl getUserDetailsServiceImpl() {
            return new CustomUserDetailsServiceImpl();
        }
    }

注意，Spring Session官网，

HazelcastSessionRepository是FindByIndexNameSessionRepository的实现类

@Autowired
        private HazelcastSessionRepository sessionRepository;
        @Bean
        SpringSessionBackedSessionRegistry sessionRegistry() {
            return new SpringSessionBackedSessionRegistry<>(sessionRepository);
        }