charygao / uniauth Goto Github PK

<Resource name="jdbc/uniauth" auth="Container" type="javax.sql.DataSource" driverClassName="com.mysql.jdbc.Driver" url="jdbc:mysql://localhost:3306/uniauth?useUnicode=true&amp;characterEncoding=utf8" username="root" password="root" maxActive="50" maxIdle="20" maxWait="200" />

<!-- spring session publisher -->
<listener>
    <listener-class>org.springframework.security.web.session.HttpSessionEventPublisher</listener-class>
</listener>
<!-- In generally  Spring Security Filter order first before other filters  -->
<filter>
    <filter-name>springSecurityFilterChain</filter-name>
    <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>
<filter-mapping>
    <filter-name>springSecurityFilterChain</filter-name>
    <url-pattern>/*</url-pattern>
</filter-mapping>

<import resource="classpath:ss-uniauth-client.xml"/> //导入ss-client中的Spring配置文件

<bean id="domainDefine" class="com.dianrong.common.uniauth.common.client.DomainDefine">
    <property name="domainCode" value="techops"/>
    <!-- <property name="userInfoClass" value="com.dianrong.common.techops.sscustom.TechOpsUserExtInfo"/> -->
    <property name="rejectPublicInvocations" value="false"/>
    <property name="innerCacheUseRedis" value="true"/>
</bean>

<sec:http entry-point-ref="casAuthEntryPoint" use-expressions="true"
          request-matcher="ant" security-context-repository-ref="uniauthSecurityContextRepository"
          disable-url-rewriting="false">
    <sec:headers>
        <sec:frame-options disabled="true"/>
    </sec:headers>
    <sec:custom-filter ref="authenticationFilter"
                       position="CAS_FILTER"/>
    <sec:custom-filter after="EXCEPTION_TRANSLATION_FILTER"
                       ref="exceptionTranslationFilter"/>
    <sec:custom-filter ref="singleLogoutFilter" before="CAS_FILTER"/>
    <sec:custom-filter ref="requestSingleLogoutFilter"
                       before="LOGOUT_FILTER"/>
    <sec:csrf disabled="true"/>
    <sec:custom-filter position="CONCURRENT_SESSION_FILTER"
                       ref="concurrencyFilter"/>
    <sec:session-management session-authentication-strategy-ref="sas"
                            invalid-session-url="#{uniauthConfig['cas_server']}/login?service=#{uniauthConfig['domains.'+domainDefine.domainCode]}/login/cas"/>
    <sec:logout delete-cookies="JSESSIONID"/>
    <!-- 在此处可以添加业务系统常用的稳定的intercept-url定义 -->
    // 重要：如果你的系统基于url_pattern进行权限判断，应尽可能地将需要保护的url进行分解和登记，
    // 否则就会退而求其次地选用这条规则，因为这条定义是涵盖任何url的默认定义，即登录用户能访问所有url。
    <sec:intercept-url pattern="/**" access="isAuthenticated()"/>
</sec:http>

<!-- do not change: start -->
<bean id="exceptionTranslationFilter" class="com.dianrong.common.uniauth.client.custom.filter.SSExceptionTranslationFilter">
    <constructor-arg ref="casAuthEntryPoint"/>
    <property name="accessDeniedHandler">
        <bean class="org.springframework.security.web.access.AccessDeniedHandlerImpl">
            <property name="errorPage" value="/errors/403.jsp"/>
        </bean>
    </property>
</bean>

<bean id="concurrencyFilter" class="org.springframework.security.web.session.ConcurrentSessionFilter">
    <constructor-arg index="0" ref="sessionRegistry"/>
    <constructor-arg index="1" value="#{uniauthConfig['cas_server']}/logout?dupsession=true"/>
</bean>

<bean id="sessionRegistry" class="org.springframework.security.core.session.SessionRegistryImpl"/>

<bean id="sas" class="org.springframework.security.web.authentication.session.CompositeSessionAuthenticationStrategy">
    <constructor-arg>
        <list>
            <bean class="org.springframework.security.web.authentication.session.RegisterSessionAuthenticationStrategy">
                <constructor-arg ref="sessionRegistry"/>
            </bean>
            <bean class="org.springframework.security.web.authentication.session.ConcurrentSessionControlAuthenticationStrategy">
                <constructor-arg ref="sessionRegistry"/>
                <property name="maximumSessions" value="1"/>
                <property name="exceptionIfMaximumExceeded" value="false"/>
            </bean>
        </list>
    </constructor-arg>
</bean>

<!--AuthenticationFilter -->
<bean id="authenticationFilter" class="com.dianrong.common.uniauth.client.custom.filter.DelegateUniauthAuthenticationFilter">
    <constructor-arg>
        <list>
            <ref bean="casAuthenticationFilter"/>
            <ref bean="jwtAuthenticationFilter"/>
            <ref bean="basicAuthAuthenticationFilter"/>
        </list>
    </constructor-arg>
    <constructor-arg value="#{domainDefine.authenticationTypeList}"/>
</bean>

<!-- CAS方式登陆成功之后,验证ST失败的处理Handler -->
<bean id="ssAuthenticationFailHandler" class="com.dianrong.common.uniauth.client.custom.handler.SSAuthenticationFailureHandler"/>

<bean id="jwtAuthenticationFilter" class="com.dianrong.common.uniauth.client.custom.filter.UniauthJWTAuthenticationFilter">
    <constructor-arg index="0" ref="uniauthJWTSecurity"/>
    <constructor-arg index="1" ref="jwtQuery"/>
    <property name="authenticationManager" ref="authenticationManager"/>
    <property name="authenticationSuccessHandler" ref="ssAuthenticationSuccessHandler"/>
    <property name="authenticationFailureHandler" ref="jwtAuthenticationFailureHandler"/>
    <property name="sessionAuthenticationStrategy" ref="sas"/>
</bean>

<bean id="casAuthenticationFilter" class="com.dianrong.common.uniauth.client.custom.filter.UniauthCasAuthenticationFilter">
    <property name="authenticationManager" ref="authenticationManager"/>
    <property name="filterProcessesUrl" value="/login/cas"/>
    <property name="authenticationSuccessHandler" ref="ssAuthenticationSuccessHandler"/>
    <property name="authenticationFailureHandler" ref="ssAuthenticationFailHandler"/>
    <property name="sessionAuthenticationStrategy" ref="sas"/>
</bean>

<bean id="basicAuthAuthenticationFilter" class="com.dianrong.common.uniauth.client.custom.filter.UniauthBasicAuthAuthenticationFilter">
    <property name="authenticationManager" ref="authenticationManager"/>
    <property name="sessionAuthenticationStrategy" ref="sas"/>
</bean>

<!-- 提供两个jwt获取的方式,可配置header和parameter名来自定义参数名 -->
<bean class="com.dianrong.common.uniauth.client.custom.jwt.RequestHeaderJWTQuery"/>
<bean class="com.dianrong.common.uniauth.client.custom.jwt.RequestParameterJWTQuery"/>
<!-- do not change: end -->
<!-- 注册PermissionEvaluator实现，以便支持hasPermission表达式，如果不使用则不用配置
     注意：ID必须为uniauthPermissionEvaluator，且primary="true" -->
<bean id="uniauthPermissionEvaluator" class="com.dianrong.common.techops.sscustom.TechOpsPermissionEvaluator" primary="true"></bean>

<!--引入uniauth的xml配置-->
<import resource="classpath:ss-uniauth-client.xml" />
<bean id="domainDefine" class="com.dianrong.common.uniauth.common.client.DomainDefine">
 <property name="domainCode" value="springboot-ssclient"/>
 <property name="userInfoClass" value="com.dianrong.uniauth.ssclient.bean.SSClientUserExtInfo"/>
 <property name="rejectPublicInvocations" value="false"/>
 <property name="customizedLoginRedirecUrl"  value="/content"/>
</bean>

<bean id="sessionRegistry" class="org.springframework.security.core.session.SessionRegistryImpl" />
<bean id="sas" class="org.springframework.security.web.authentication.session.CompositeSessionAuthenticationStrategy">
 <constructor-arg>
  <list>
   <bean
    class="org.springframework.security.web.authentication.session.RegisterSessionAuthenticationStrategy">
    <constructor-arg ref="sessionRegistry" />
   </bean>
   <bean
    class="org.springframework.security.web.authentication.session.ConcurrentSessionControlAuthenticationStrategy">
    <constructor-arg ref="sessionRegistry" />
    <property name="maximumSessions" value="1" />
    <property name="exceptionIfMaximumExceeded" value="false" />
   </bean>
  </list>
 </constructor-arg>
</bean>
<bean id="uniauthPermissionEvaluator" class="com.dianrong.uniauth.ssclient.bean.SSClientPermissionEvaluator" primary="true"/>