프링향의 기록

php -> java + spring 마이그레이션중  Interceptor 방식으로 구현하였으나 마이그레이션 하는 김에… spring security 적용…

로그인 정상적으로 되나… 서버 재시작(세션 초기화) 하였음에도 세션 체크가 되지 않아..   없었던일로…

나중을 위해 정리…

내 생각으론..

web.xml 에 들어오는 url-pattern 에 의해 security-context.xml 에 정의한

UserDetailsService.java 와 CustomAuthenticationProvider.java

로 각 사용자 정보를 비교하여 인증정보를 저장하여 컨트롤 하는 것으로 보여짐..

UserDetailsService.java 에서는 사용자이름(이름 또는 아이디와 같은 고유값)

을 통해 조회된 정보를 CustomAuthenticationProvider.java의

Authentication authentication 객체에 담아 넘겨줌.

넘겨준 데이터를 통해 패스워드 일치, 권한등을 추가적으로 작업…

1. web.xml에 추가

<filter-name>springSecurityFilterChain</filter-name>
<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class> //filter 처리을 spring security로 위임하는것
</filter>
<filter-mapping>
<filter-name>springSecurityFilterChain</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>

<context-param>
 <param-name>contextConfigLocation</param-name>
 <param-value>/WEB-INF/spring/security-context.xml</param-value>
</context-param>

2. pom.xml 추가

<dependency>
 <groupId>org.springframework.security</groupId>
 <artifactId>spring-security-core</artifactId>
<version>4.1.3.RELEASE</version>
</dependency>

<dependency>
 <groupId>org.springframework.security</groupId>
 <artifactId>spring-security-taglibs</artifactId>
 <version>4.1.3.RELEASE</version>
</dependency>

<dependency>
 <groupId>org.springframework.security</groupId>
 <artifactId>spring-security-config</artifactId>
 <version>4.1.3.RELEASE</version>
</dependency>

3. security-context.xml 추가

<?xml version="1.0" encoding="UTF-8"?>
<beans:beans
xmlns="http://www.springframework.org/schema/security"
xmlns:beans="http://www.springframework.org/schema/beans"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://www.springframework.org/schema/beans
http://www.springframework.org/schema/beans/spring-beans-4.3.xsd
http://www.springframework.org/schema/security
http://www.springframework.org/schema/security/spring-security-4.1.xsd">

<!-- expressions을 추가해야 hasRole,permitAll등의 다양한 옵션들을 쓸수 있음 -->
<http auto-config="true" use-expressions="true">
<form-login username-parameter="userId" password-parameter="userPw"
login-page="/index.do" login-processing-url="/login/login.do"
default-target-url="/user/myPage.do" authentication-failure-url="/index.do" />

<!-- 관리자만 들어갈수있음 -->
<intercept-url pattern="/admin/**" access="hasAuthority('ROLE_ADMIN')" /> 
<!-- 인증한사람만 들어갈수있음 -->
<intercept-url pattern="/user/**" access="isAuthenticated()" />
<!-- 누구나 다들어갈수 있음 -->
<intercept-url pattern="/**" access="permitAll" />


<!-- CSRF 보안 관련 처리 -->
<csrf/>

<!-- 사용시 로그인 페이지에서 form 에 추가  -->

<input type="hidden" name="${_csrf.parameterName}" value="${_csrf.token}" />
</http>


<beans:bean id="customAuthenticationProvider" class="com.ers.service.CustomAuthenticationProvider" />
<beans:bean id="userDetailService" class="com.ers.service.UserDetailService" />

<authentication-manager alias="authenticationManager">
<authentication-provider ref="customAuthenticationProvider"/>

<authentication-provider user-service-ref="userDetailService">
<!-- <password-encoder ref="passwordEncoder" /> -->
</authentication-provider>
</authentication-manager>
</beans:beans>

4. 사용자정보 조회할 UserDetailService.java 구현

package com.ers.service;

import java.util.ArrayList;
import java.util.List;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.authority.SimpleGrantedAuthority;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.core.userdetails.UsernameNotFoundException;
import org.springframework.stereotype.Service;

import com.ers.mapper.LoginMapper;
import com.ers.model.LoginInfoVO;
import com.ers.model.UserDetailVO;

@Service
public class UserDetailService implements UserDetailsService{

@Autowired
private LoginMapper loginMapper;

@Override
public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
LoginInfoVO loginInfoVO = loginMapper.getUserInfo(username);

if(loginInfoVO == null) {
throw new UsernameNotFoundException("사용자 정보를 조회 할 수 없습니다.");
}
ArrayList<GrantedAuthority> authorities = new ArrayList<GrantedAuthority>();
if("ADM".equals(loginInfoVO.getUserType())) {
authorities.add(new SimpleGrantedAuthority("ROLE_ADMIN"));
}else {
authorities.add(new SimpleGrantedAuthority("ROLE_USER"));
}

/**
* 스프링 시큐리티 관련 정보
*/
UserDetailVO userDetailVO = new UserDetailVO();
userDetailVO.setUsername(username);
userDetailVO.setPassword(loginInfoVO.getUserPw());
userDetailVO.setEnabled(true);
userDetailVO.setAuthorities(authorities);

/**
* 로그인관련 정보
*/
userDetailVO.setCmpCd(loginInfoVO.getCmpCd());
userDetailVO.setDeptCd(loginInfoVO.getDeptCd());
userDetailVO.setMoSalCd(loginInfoVO.getMoSalCd());
userDetailVO.setUserName(loginInfoVO.getUserName());
userDetailVO.setUserType(loginInfoVO.getUserType());
userDetailVO.setUserId(loginInfoVO.getUserId().toUpperCase());
userDetailVO.setLoginYn("Y");
return userDetailVO;
}
}

5. 사용자정보에 대한 인증정보 (사용자정보 있는 경우 후처리)

package com.ers.service;

import java.util.List;

import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.authentication.AuthenticationProvider;
import org.springframework.security.authentication.BadCredentialsException;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.AuthenticationException;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.authority.SimpleGrantedAuthority;
import org.springframework.security.core.userdetails.UsernameNotFoundException;
import org.springframework.stereotype.Component;

import com.ers.mapper.LoginMapper;
import com.ers.model.LoginInfoVO;
import com.ers.model.UserDetailVO;

@Component
public class CustomAuthenticationProvider implements AuthenticationProvider{

protected Logger logger = LoggerFactory.getLogger(this.getClass());

@Autowired
UserDetailService userDetailService;

@Autowired
private LoginMapper loginMapper;

@Override
public Authentication authenticate(Authentication authentication) throws AuthenticationException {
UsernamePasswordAuthenticationToken authToken = (UsernamePasswordAuthenticationToken) authentication;

UserDetailVO userInfo = (UserDetailVO) userDetailService.loadUserByUsername(authToken.getName()); //UserDetailsService에서 유저정보를 불러온다.

if(userInfo == null) {
throw new UsernameNotFoundException(authToken.getName());
}

LoginInfoVO loginInfoVO = loginMapper.getUserInfo(authToken.getName());
if(!matchPassword(userInfo.getPassword(), authToken.getCredentials())) {
throw new BadCredentialsException("not matching username or password");
}

List<GrantedAuthority> authorities = (List<GrantedAuthority>) userInfo.getAuthorities();
return new UsernamePasswordAuthenticationToken(loginInfoVO.getUserId(), loginInfoVO.getUserPw(), authorities);
}

@Override
public boolean supports(Class<?> authentication) {
return true;
}

private boolean matchPassword(String password, Object credentials) {
return password.equals(credentials);
}
}