Spring-Security 实现黑白名单功能

添加该功能是在原有功能上新增功能： SpringBoot +SpringSecurity+mysql 实现用户数据权限管理

本文仅做重点代码的和相关依赖说明：SpringBoot +SpringSecurity+mysql 实现用户数据权限管理 文章中，我们采用的了分布式架构搭建该项目，导致controller 模块是不存在数据库连接资源（DataSource），由此，我们在controller 模块需要添加关于mysql 的连接和相关配置参数：
 

	<!-- mysql数据库驱动 --> 
		<dependency> 
			<groupId>mysql</groupId> 
			<artifactId>mysql-connector-java</artifactId> 
			<version>8.0.12</version> 
		</dependency> 
		<!-- 数据层 Spring-data-jpa --> 
		<dependency> 
			<groupId>org.springframework.boot</groupId> 
			<artifactId>spring-boot-starter-data-jpa</artifactId> 
		</dependency>

application.properties 添加数据库相关配置参数：

#mysql setting 
spring.datasource.url=jdbc:mysql://192.168.1.73:3306/boot-security?serverTimezone=UTC&useSSL=false&allowPublicKeyRetrieval=true 
spring.datasource.username=root 
spring.datasource.password=digipower 
spring.datasource.driver-class-name=com.mysql.cj.jdbc.Driver 
spring.jpa.properties.hibernate.hbm2ddl.auto=update

自定义IP黑白名单相关实体文件和查询接口：

package com.zzg.security.ip; 
 
import java.io.Serializable; 
import java.util.Date; 
 
 
/** 
 * 黑白IP对象 
 * @author zzg 
 * 
 */ 
@SuppressWarnings("serial") 
public class IpRoster implements Serializable { 
	 
	private Long id; 
	 
	private String ip; 
	 
	private Date date; 
	 
	public IpRoster(){ 
		super(); 
	} 
 
	// 构造函数 
	public IpRoster(Long id, String ip, Date date) { 
		super(); 
		this.id = id; 
		this.ip = ip; 
		this.date = date; 
	} 
	 
	// set 和 get 方法 
	public Long getId() { 
		return id; 
	} 
 
	public void setId(Long id) { 
		this.id = id; 
	} 
 
	public String getIp() { 
		return ip; 
	} 
 
	public void setIp(String ip) { 
		this.ip = ip; 
	} 
 
	public Date getDate() { 
		return date; 
	} 
 
	public void setDate(Date date) { 
		this.date = date; 
	} 
 
} 
 

package com.zzg.security.ip; 
 
import java.sql.ResultSet; 
import java.sql.SQLException; 
 
 
import org.springframework.jdbc.core.RowMapper; 
/** 
 * RowMapper 转换IpRoster 实体对象 
 * @author zzg 
 * 
 */ 
public class IpRosterMapper implements RowMapper<IpRoster> { 
 
	@Override 
	public IpRoster mapRow(ResultSet rs, int rowNum) throws SQLException { 
		// TODO Auto-generated method stub 
		IpRoster object = new IpRoster(); 
		object.setId(rs.getLong("id")); 
		object.setIp(rs.getString("ip")); 
		object.setDate(rs.getDate("date")); 
		return object; 
	} 
 
} 

package com.zzg.security.ip; 
 
import java.util.List; 
import org.springframework.jdbc.core.support.JdbcDaoSupport; 
 
/** 
 * IP黑白名单数据库查询 
 * @author zzg 
 * 
 */ 
public class IpRosterRepositoryImpl extends JdbcDaoSupport { 
	public static final String DEF_SELECT_IP_SQL ="select id, ip, date from ip_roster"; 
	 
	public List<IpRoster> getAllIpRoster(){ 
		return getJdbcTemplate().query(DEF_SELECT_IP_SQL, new IpRosterMapper()); 
		 
	} 
 
} 

自定义认证器，添加验证用户IP是否在黑白名单中：

package com.zzg.security.provider; 
 
import java.util.ArrayList; 
import java.util.HashMap; 
import java.util.List; 
import java.util.stream.Collectors; 
 
import javax.sql.DataSource; 
 
import org.apache.commons.codec.digest.DigestUtils; 
import org.springframework.beans.factory.annotation.Autowired; 
import org.springframework.security.authentication.AuthenticationProvider; 
import org.springframework.security.authentication.BadCredentialsException; 
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken; 
import org.springframework.security.core.Authentication; 
import org.springframework.security.core.AuthenticationException; 
import org.springframework.security.core.userdetails.UserDetailsService; 
import org.springframework.security.core.userdetails.UsernameNotFoundException; 
import org.springframework.security.web.authentication.WebAuthenticationDetails; 
import org.springframework.stereotype.Component; 
 
import com.zzg.security.ip.IpRoster; 
import com.zzg.security.ip.IpRosterRepositoryImpl; 
import com.zzg.security.userservice.AuthUserDetails; 
import com.zzg.security.userservice.CustomUserService; 
 
/** 
 *自定义身份验证提供者 
 *  
 * @author zzg 
 * 
 */ 
@Component 
public class SpringSecurityProvider implements AuthenticationProvider { 
 
	@Autowired 
	private CustomUserService userDetailService; 
	 
	@Autowired 
	private DataSource dataSource; // 数据源 
	 
	private IpRosterRepositoryImpl ip; // IP 黑白名单查询 
	 
	private List<String> black_white = new ArrayList<>(); 
	 
	 
 
 
	@Override 
	public Authentication authenticate(Authentication authentication) throws AuthenticationException { 
		// TODO Auto-generated method stub 
		// 检查用户IP 
	    WebAuthenticationDetails details = (WebAuthenticationDetails) authentication.getDetails(); 
        String userIp = details.getRemoteAddress(); 
         
        // 黑白名单初始化数据 
        if(ip == null){ 
			ip = new IpRosterRepositoryImpl(); 
			ip.setDataSource(dataSource); // 设定数据源 
		} 
		List<IpRoster> list = ip.getAllIpRoster(); 
		if(list != null && list.size() > 0){ 
			black_white = list.stream().map(IpRoster::getIp).collect(Collectors.toList()); 
		} 
		 
        // 判断用户IP 是否在黑白名单中 
        if(black_white.contains(userIp)){ 
            throw new BadCredentialsException("非法 IP 地址"); 
        } 
         
		 
		String userName = authentication.getName(); 
		String password = (String) authentication.getCredentials(); 
 
	    // 查询用户权限信息 
		AuthUserDetails userInfo = (AuthUserDetails) userDetailService.loadUserByUsername(userName);  
		if (userInfo == null) { 
			throw new UsernameNotFoundException(""); 
		} 
 
		// 密码判断 
		String encodePwd = DigestUtils.md5Hex(password).toUpperCase(); 
		if (!userInfo.getPassword().equals(encodePwd)) { 
			throw new BadCredentialsException(""); 
		} 
 
		return new UsernamePasswordAuthenticationToken(userInfo, userInfo.getPassword(), 
				userInfo.getAuthorities()); 
	} 
 
	@Override 
	public boolean supports(Class<?> authentication) { 
		// TODO Auto-generated method stub 
		return UsernamePasswordAuthenticationToken.class.equals(authentication); 
	} 
	 
	// 拓展获取用户查询服务 
	public UserDetailsService getUserDetailsService(){ 
		return this.userDetailService; 
	} 
} 

补全黑白名单的SQL脚本：

DROP TABLE IF EXISTS `persistent_logins`; 
CREATE TABLE `persistent_logins`  ( 
  `username` varchar(64) CHARACTER SET utf8 COLLATE utf8_general_ci NOT NULL, 
  `series` varchar(64) CHARACTER SET utf8 COLLATE utf8_general_ci NOT NULL, 
  `token` varchar(64) CHARACTER SET utf8 COLLATE utf8_general_ci NOT NULL, 
  `last_used` timestamp(0) NOT NULL DEFAULT CURRENT_TIMESTAMP(0) ON UPDATE CURRENT_TIMESTAMP(0), 
  PRIMARY KEY (`series`) USING BTREE 
) ENGINE = InnoDB CHARACTER SET = utf8 COLLATE = utf8_general_ci ROW_FORMAT = Dynamic;