Spring数据使用JWT

Question

（授权已经在存储库中使用@preauthorize（“hasrole('role_user')”）完成）

@Configuration
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class SecurityConfiguration extends WebSecurityConfigurerAdapter {

  /**
   * This section defines the user accounts which can be used for
   * authentication as well as the roles each user has.
   */
  @Override
  public void configure(AuthenticationManagerBuilder auth) throws Exception {

    auth.inMemoryAuthentication()
      .withUser("greg").password("turnquist").roles("USER").and()
      .withUser("ollie").password("gierke").roles("USER", "ADMIN");
  }

  /**
   * This section defines the security policy for the app.
   * - BASIC authentication is supported (enough for this REST-based demo)
   * - /employees is secured using URL security shown below
   * - CSRF headers are disabled since we are only testing the REST interface,
   *   not a web one.
   *
   * NOTE: GET is not shown which defaults to permitted.
   */
  @Override
  protected void configure(HttpSecurity http) throws Exception {

    http
      .httpBasic().and()
      .authorizeRequests()
        .antMatchers(HttpMethod.POST, "/employees").hasRole("ADMIN")
        .antMatchers(HttpMethod.PUT, "/employees/**").hasRole("ADMIN")
        .antMatchers(HttpMethod.PATCH, "/employees/**").hasRole("ADMIN").and()
      .csrf().disable();
  }
}

Answer 1

这里有一个关于spring boot中JWT身份验证的很好的教程，但也适用于spring应用程序:https://auth0.com/blog/implementing-jwt-authentication-on-spring-boot/

根据您需要的SecurityConfiguration.Configure中的教程

http.authorizeRequests()
            .anyRequest().authenticated()
            .and()
            .addFilter(new JWTAuthenticationFilter(authenticationManager()))
            .addFilter(new JWTAuthorizationFilter(authenticationManager()))
            // this disables session creation on Spring Security
            .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);

JWTauthEnticationFilter扩展UsernamePasswordAuthenticationFilter，应用于/login URL，如果系统中存在这样的用户，则根据您的登录名/密码生成JWT令牌。

jwtauthorizationfilter验证http标头中的JWT令牌

当然，您需要添加更多的运动部件，以便在本教程中启用JWT auth。