带Spring Security的Spring Boot-通过SMS/PIN/TOTP进行双因素身份验证

Question

我正在开发一个Spring Boot 2.5.0 web应用程序，使用Thymeleaf使用Spring Security表单登录。我正在寻找如何使用Spring Security表单登录实现双因素身份验证（2FA）的想法。

要求是，当用户使用其用户名和密码通过登录时。在登录表单中，如果用户名和密码验证成功，则应向用户的注册手机号码发送一个SMS代码，并用另一个页面询问用户输入SMS代码。如果用户正确获取SMS代码，则应将其转发到安全应用程序页面。

在登录表单上，除了用户名和密码外，用户还需要输入验证码图像中的文本，该图像通过扩展UsernamePasswordAuthenticationFilter的SimpleAuthenticationFilter进行验证。

这是当前的安全配置

@Configuration
@EnableWebSecurity
public class SecurityConfiguration extends WebSecurityConfigurerAdapter {
    @Autowired
    private CustomUserDetailsServiceImpl userDetailsService;
    
    @Override
    protected void configure(HttpSecurity httpSecurity) throws Exception {
        httpSecurity
            .addFilterBefore(authenticationFilter(), UsernamePasswordAuthenticationFilter.class)    
            .authorizeRequests()
                .antMatchers(
                        "/favicon.ico",
                        "/webjars/**",
                        "/images/**",
                        "/css/**",
                        "/js/**",
                        "/login/**",
                        "/captcha/**",
                        "/public/**",
                        "/user/**").permitAll()
                .anyRequest().authenticated()
            .and().formLogin()
                .loginPage("/login")
                    .permitAll()
                .defaultSuccessUrl("/", true)
            .and().logout()
                .invalidateHttpSession(true)
                .clearAuthentication(true)
                .deleteCookies("JSESSONID")
                .logoutRequestMatcher(new AntPathRequestMatcher("/logout"))
                .logoutSuccessUrl("/login?logout")
                    .permitAll()
            .and().headers().frameOptions().sameOrigin()
            .and().sessionManagement()
                .maximumSessions(5)
                .sessionRegistry(sessionRegistry())
                .expiredUrl("/login?error=5");
    }

    public SimpleAuthenticationFilter authenticationFilter() throws Exception {
        SimpleAuthenticationFilter filter = new SimpleAuthenticationFilter();
        filter.setAuthenticationManager(authenticationManagerBean());
        filter.setAuthenticationFailureHandler(authenticationFailureHandler());
        return filter;
    }

    @Bean
    public AuthenticationFailureHandler authenticationFailureHandler() {
        return new CustomAuthenticationFailureHandler();
    }
    
    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.authenticationProvider(authenticationProvider());
    }
    
    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }

    @Bean
    public DaoAuthenticationProvider authenticationProvider() {
        DaoAuthenticationProvider auth = new DaoAuthenticationProvider();
        auth.setUserDetailsService(userDetailsService);
        auth.setPasswordEncoder(passwordEncoder());
        return auth;
    }

    /** TO-GET-SESSIONS-STORED-ON-SERVER */
    @Bean
    public SessionRegistry sessionRegistry() {
        return new SessionRegistryImpl();
    }

}

这就是上面提到的SimpleAuthenticationFilter。

public class SimpleAuthenticationFilter extends UsernamePasswordAuthenticationFilter {

    public static final String SPRING_SECURITY_FORM_CAPTCHA_KEY = "captcha";
    
    @Override
    public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response)
            throws AuthenticationException {
        HttpSession session = request.getSession(true);
        
        String captchaFromSession = null;
        if (session.getAttribute("captcha") != null) {
            captchaFromSession = session.getAttribute("captcha").toString();
        } else {
            throw new CredentialsExpiredException("INVALID SESSION");
        }
        
        String captchaFromRequest = obtainCaptcha(request);
        if (captchaFromRequest == null) {
            throw new AuthenticationCredentialsNotFoundException("INVALID CAPTCHA");
        }
        
        if (!captchaFromRequest.equals(captchaFromSession)) {
            throw new AuthenticationCredentialsNotFoundException("INVALID CAPTCHA");
        }
        
        UsernamePasswordAuthenticationToken authRequest = getAuthRequest(request);
        setDetails(request, authRequest);

        return this.getAuthenticationManager().authenticate(authRequest);
    }

    private UsernamePasswordAuthenticationToken getAuthRequest(HttpServletRequest request) {
        String username = obtainUsername(request);
        String password = obtainPassword(request);
        
        if (username == null) {
            username = "";
        }
        if (password == null) {
            password = "";
        }

        return new UsernamePasswordAuthenticationToken(username, password);
    }
    
    private String obtainCaptcha(HttpServletRequest request) {
        return request.getParameter(SPRING_SECURITY_FORM_CAPTCHA_KEY);
    }

}

有什么办法吗？提前谢谢。

Answer 1

Spring Security提供了一个mfa示例，可以帮助您入门。它使用带有OTP的Google Authenticator，但你可以插入发送/验证短信短代码。

您还可以考虑将验证码验证与（开箱即用）身份验证过滤器分开。如果它们是同一个过滤器链中的独立过滤器，则代码更少，效果也相同。