首頁>網絡編程教程>Java教程

Spring Security OAuth2集成短信驗證碼登錄以及第三方登錄

作者：Eve Cole 更新時間：2025-08-04 08:16:01

前言

基於SpringCloud做微服務架構分佈式系統時，OAuth2.0作為認證的業內標準，Spring Security OAuth2也提供了全套的解決方案來支持在Spring Cloud/Spring Boot環境下使用OAuth2.0，提供了開箱即用的組件。但是在開發過程中我們會發現由於Spring Security OAuth2的組件特別全面，這樣就導致了擴展很不方便或者說是不太容易直指定擴展的方案，例如：

  1. 圖片驗證碼登錄
  2. 短信驗證碼登錄
  3. 微信小程序登錄
  4. 第三方系統登錄
  5. CAS單點登錄

在面對這些場景的時候，預計很多對Spring Security OAuth2不熟悉的人恐怕會無從下手。基於上述的場景要求，如何優雅的集成短信驗證碼登錄及第三方登錄，怎麼樣才算是優雅集成呢？有以下要求：

  1. 不侵入Spring Security OAuth2的原有代碼
  2. 對於不同的登錄方式不擴展新的端點，使用/oauth/token可以適配所有的登錄方式
  3. 可以對所有登錄方式進行兼容，抽像一套模型只要簡單的開發就可以集成登錄

基於上述的設計要求，接下來將會在文章種詳細介紹如何開發一套集成登錄認證組件開滿足上述要求。

閱讀本篇文章您需要了解OAuth2.0認證體系、SpringBoot、SpringSecurity以及Spring Cloud等相關知識

思路

我們來看下Spring Security OAuth2的認證流程：

這個流程當中，切入點不多，集成登錄的思路如下：

  1. 在進入流程之前先進行攔截，設置集成認證的類型，例如：短信驗證碼、圖片驗證碼等信息。
  2. 在攔截的通知進行預處理，預處理的場景有很多，比如驗證短信驗證碼是否匹配、圖片驗證碼是否匹配、是否是登錄IP白名單等處理
  3. 在UserDetailService.loadUserByUsername方法中，根據之前設置的集成認證類型去獲取用戶信息，例如：通過手機號碼獲取用戶、通過微信小程序OPENID獲取用戶等等

接入這個流程之後，基本上就可以優雅集成第三方登錄。

實現

介紹完思路之後，下面通過代碼來展示如何實現：

第一步，定義攔截器攔截登錄的請求

/** * @author LIQIU * @date 2018-3-30 **/@Componentpublic class IntegrationAuthenticationFilter extends GenericFilterBean implements ApplicationContextAware { private static final String AUTH_TYPE_PARM_NAME = "auth_type"; private static final String OAUTH_TOKEN_URL = "/oauth/token"; private Collection<IntegrationAuthenticator> authenticators; private ApplicationContext applicationContext; private RequestMatcher requestMatcher; public IntegrationAuthenticationFilter(){ this.requestMatcher = new OrRequestMatcher( new AntPathRequestMatcher(OAUTH_TOKEN_URL, "GET"), new AntPathRequestMatcher(OAUTH_TOKEN_URL, "POST") ); } @Override public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws IOException, ServletException { HttpServletRequest request = (HttpServletRequest) servletRequest; HttpServletResponse response = (HttpServletResponse) servletResponse; if(requestMatcher.matches(request)){ //設置集成登錄信息IntegrationAuthentication integrationAuthentication = new IntegrationAuthentication(); integrationAuthentication.setAuthType(request.getParameter(AUTH_TYPE_PARM_NAME)); integrationAuthentication.setAuthParameters(request.getParameterMap()); IntegrationAuthenticationContext.set(integrationAuthentication); try{ //預處理this.prepare(integrationAuthentication); filterChain.doFilter(request,response); //後置處理this.complete(integrationAuthentication); }finally { IntegrationAuthenticationContext.clear(); } }else{ filterChain.doFilter(request,response); } } /** * 進行預處理* @param integrationAuthentication */ private void prepare(IntegrationAuthentication integrationAuthentication) { //延遲加載認證器if(this.authenticators == null){ synchronized (this){ Map<String,IntegrationAuthenticator> integrationAuthenticatorMap = applicationContext.getBeansOfType(IntegrationAuthenticator.class); if(integrationAuthenticatorMap != null){ this.authenticators = integrationAuthenticatorMap.values(); } } } if(this.authenticators == null){ this.authenticators = new ArrayList<>(); } for (IntegrationAuthenticator authenticator: authenticators) { if(authenticator.support(integrationAuthentication)){ authenticator.prepare(integrationAuthentication); } } } /** * 後置處理* @param integrationAuthentication */ private void complete(IntegrationAuthentication integrationAuthentication){ for (IntegrationAuthenticator authenticator: authenticators) { if(authenticator.support(integrationAuthentication)){ authenticator.complete(integrationAuthentication); } } } @Override public void setApplicationContext(ApplicationContext applicationContext) throws BeansException { this.applicationContext = applicationContext; }}

在這個類種主要完成2部分工作：1、根據參數獲取當前的是認證類型，2、根據不同的認證類型調用不同的IntegrationAuthenticator.prepar進行預處理

第二步，將攔截器放入到攔截鏈條中

/** * @author LIQIU * @date 2018-3-7 **/@Configuration@EnableAuthorizationServerpublic class AuthorizationServerConfiguration extends AuthorizationServerConfigurerAdapter { @Autowired private RedisConnectionFactory redisConnectionFactory; @Autowired private AuthenticationManager authenticationManager; @Autowired private IntegrationUserDetailsService integrationUserDetailsService; @Autowired private WebResponseExceptionTranslator webResponseExceptionTranslator; @Autowired private IntegrationAuthenticationFilter integrationAuthenticationFilter; @Autowired private DatabaseCachableClientDetailsService redisClientDetailsService; @Override public void configure(ClientDetailsServiceConfigurer clients) throws Exception { // TODO persist clients details clients.withClientDetails(redisClientDetailsService); } @Override public void configure(AuthorizationServerEndpointsConfigurer endpoints) { endpoints .tokenStore(new RedisTokenStore(redisConnectionFactory))// .accessTokenConverter(jwtAccessTokenConverter()) .authenticationManager(authenticationManager) .exceptionTranslator(webResponseExceptionTranslator) .reuseRefreshTokens(false) .userDetailsService(integrationUserDetailsService); } @Override public void configure(AuthorizationServerSecurityConfigurer security) throws Exception { security.allowFormAuthenticationForClients() .tokenKeyAccess("isAuthenticated()") .checkTokenAccess("permitAll()") .addTokenEndpointAuthenticationFilter(integrationAuthenticationFilter); } @Bean public PasswordEncoder passwordEncoder() { return new BCryptPasswordEncoder(); } @Bean public JwtAccessTokenConverter jwtAccessTokenConverter() { JwtAccessTokenConverter jwtAccessTokenConverter = new JwtAccessTokenConverter(); jwtAccessTokenConverter.setSigningKey("cola-cloud"); return jwtAccessTokenConverter; }}

通過調用security. .addTokenEndpointAuthenticationFilter(integrationAuthenticationFilter);方法，將攔截器放入到認證鏈條中。

第三步，根據認證類型來處理用戶信息

@Servicepublic class IntegrationUserDetailsService implements UserDetailsService { @Autowired private UpmClient upmClient; private List<IntegrationAuthenticator> authenticators; @Autowired(required = false) public void setIntegrationAuthenticators(List<IntegrationAuthenticator> authenticators) { this.authenticators = authenticators; } @Override public User loadUserByUsername(String username) throws UsernameNotFoundException { IntegrationAuthentication integrationAuthentication = IntegrationAuthenticationContext.get(); //判斷是否是集成登錄if (integrationAuthentication == null) { integrationAuthentication = new IntegrationAuthentication(); } integrationAuthentication.setUsername(username); UserVO userVO = this.authenticate(integrationAuthentication); if(userVO == null){ throw new UsernameNotFoundException("用戶名或密碼錯誤"); } User user = new User(); BeanUtils.copyProperties(userVO, user); this.setAuthorize(user); return user; } /** * 設置授權信息* * @param user */ public void setAuthorize(User user) { Authorize authorize = this.upmClient.getAuthorize(user.getId()); user.setRoles(authorize.getRoles()); user.setResources(authorize.getResources()); } private UserVO authenticate(IntegrationAuthentication integrationAuthentication) { if (this.authenticators != null) { for (IntegrationAuthenticator authenticator : authenticators) { if (authenticator.support(integrationAuthentication)) { return authenticator.authenticate(integrationAuthentication); } } } return null; }}

這裡實現了一個IntegrationUserDetailsService ，在loadUserByUsername方法中會調用authenticate方法，在authenticate方法中會當前上下文種的認證類型調用不同的IntegrationAuthenticator 來獲取用戶信息，接下來來看下默認的用戶名密碼是如何處理的：

 @Component@Primarypublic class UsernamePasswordAuthenticator extends AbstractPreparableIntegrationAuthenticator { @Autowired private UcClient ucClient; @Override public UserVO authenticate(IntegrationAuthentication integrationAuthentication) { return ucClient.findUserByUsername(integrationAuthentication.getUsername()); } @Override public void prepare(IntegrationAuthentication integrationAuthentication) { } @Override public boolean support(IntegrationAuthentication integrationAuthentication) { return StringUtils.isEmpty(integrationAuthentication.getAuthType()); }}

UsernamePasswordAuthenticator只會處理沒有指定的認證類型即是默認的認證類型，這個類中主要是通過用戶名獲取密碼。接下來來看下圖片驗證碼登錄如何處理的：

 /** * 集成驗證碼認證* @author LIQIU * @date 2018-3-31 **/@Componentpublic class VerificationCodeIntegrationAuthenticator extends UsernamePasswordAuthenticator { private final static String VERIFICATION_CODE_AUTH_TYPE = "vc"; @Autowired private VccClient vccClient; @Override public void prepare(IntegrationAuthentication integrationAuthentication) { String vcToken = integrationAuthentication.getAuthParameter("vc_token"); String vcCode = integrationAuthentication.getAuthParameter("vc_code"); //驗證驗證碼Result<Boolean> result = vccClient.validate(vcToken, vcCode, null); if (!result.getData()) { throw new OAuth2Exception("驗證碼錯誤"); } } @Override public boolean support(IntegrationAuthentication integrationAuthentication) { return VERIFICATION_CODE_AUTH_TYPE.equals(integrationAuthentication.getAuthType()); }}

VerificationCodeIntegrationAuthenticator繼承UsernamePasswordAuthenticator，因為其只是需要在prepare方法中驗證驗證碼是否正確，獲取用戶還是用過用戶名密碼的方式獲取。但是需要認證類型為"vc"才會處理接下來來看下短信驗證碼登錄是如何處理的：

 @Componentpublic class SmsIntegrationAuthenticator extends AbstractPreparableIntegrationAuthenticator implements ApplicationEventPublisherAware { @Autowired private UcClient ucClient; @Autowired private VccClient vccClient; @Autowired private PasswordEncoder passwordEncoder; private ApplicationEventPublisher applicationEventPublisher; private final static String SMS_AUTH_TYPE = "sms"; @Override public UserVO authenticate(IntegrationAuthentication integrationAuthentication) { //獲取密碼，實際值是驗證碼String password = integrationAuthentication.getAuthParameter("password"); //獲取用戶名，實際值是手機號String username = integrationAuthentication.getUsername(); //發布事件，可以監聽事件進行自動註冊用戶this.applicationEventPublisher.publishEvent(new SmsAuthenticateBeforeEvent(integrationAuthentication)); //通過手機號碼查詢用戶UserVO userVo = this.ucClient.findUserByPhoneNumber(username); if (userVo != null) { //將密碼設置為驗證碼userVo.setPassword(passwordEncoder.encode(password)); //發布事件，可以監聽事件進行消息通知this.applicationEventPublisher.publishEvent(new SmsAuthenticateSuccessEvent(integrationAuthentication)); } return userVo; } @Override public void prepare(IntegrationAuthentication integrationAuthentication) { String smsToken = integrationAuthentication.getAuthParameter("sms_token"); String smsCode = integrationAuthentication.getAuthParameter("password"); String username = integrationAuthentication.getAuthParameter("username"); Result<Boolean> result = vccClient.validate(smsToken, smsCode, username); if (!result.getData()) { throw new OAuth2Exception("驗證碼錯誤或已過期"); } } @Override public boolean support(IntegrationAuthentication integrationAuthentication) { return SMS_AUTH_TYPE.equals(integrationAuthentication.getAuthType()); } @Override public void setApplicationEventPublisher(ApplicationEventPublisher applicationEventPublisher) { this.applicationEventPublisher = applicationEventPublisher; }}

SmsIntegrationAuthenticator會對登錄的短信驗證碼進行預處理，判斷其是否非法，如果是非法的則直接中斷登錄。如果通過預處理則在獲取用戶信息的時候通過手機號去獲取用戶信息，並將密碼重置，以通過後續的密碼校驗。

總結

在這個解決方案中，主要是使用責任鍊和適配器的設計模式來解決集成登錄的問題，提高了可擴展性，並對spring的源碼無污染。如果還要繼承其他的登錄，只需要實現自定義的IntegrationAuthenticator就可以。

項目地址：https://gitee.com/leecho/cola-cloud

本地下載：cola-cloud_jb51.rar

以上就是本文的全部內容，希望對大家的學習有所幫助，也希望大家多多支持武林網。

相關文章