玩转Spring Cloud Security OAuth2身份认证扩展——电话号码+验证码认证

在程序的认证过程中，除了常规的用户名和密码方式（可以参考深入理解Spring Cloud Security OAuth2身份认证），也经常会出现电话号码+密码的方式；电话号码+验证码的方式；或者第三方软件的方式。以下，以电话号码+验证码的方式讲述OAuth2认证方式的扩展。

认证对象（PhoneAndVerificationCodeAuthenticationToken ）

在OAuth2认证开始认证时，会提前Authentication认证信息，然后交由AuthenticationManager认证。定义电话号码+验证码的Authentication认证信息，源码如下：

public class PhoneAndVerificationCodeAuthenticationToken extends AbstractAuthenticationToken {

    /**
     * 手机号
     */
    private final Object phoneNumber;

    /**
     * 验证码
     */
    private final Object verificationCode;

    public PhoneAndVerificationCodeAuthenticationToken(Object phoneNumber, Object verificationCode) {
        super(null);
        this.phoneNumber = phoneNumber;
        this.verificationCode = verificationCode;
    }

    public PhoneAndVerificationCodeAuthenticationToken(Collection<? extends GrantedAuthority> authorities, Object phoneNumber, Object verificationCode) {
        super(authorities);
        this.phoneNumber = phoneNumber;
        this.verificationCode = verificationCode;
        // 认证已经通过
        setAuthenticated(true);
    }

    /**
     * 用户身份凭证（一般是密码或者验证码）
     */
    @Override
    public Object getCredentials() {
        return verificationCode;
    }

    /**
     * 身份标识（一般是姓名，手机号）
     */
    @Override
    public Object getPrincipal() {
        return phoneNumber;
    }
}

认证逻辑（PhoneAndVerificationCodeAuthenticationProvider ）

在AuthenticationManager认证过程中，是通过AuthenticationProvider接口的扩展来实现自定义认证方式的。定义手机和验证码认证提供者PhoneAndVerificationCodeAuthenticationProvider，其源码如下：

public class PhoneAndVerificationCodeAuthenticationProvider implements AuthenticationProvider {

    /**
     * UserDetailsService
     */
    private final MallUserDetailsService mallUserDetailsService;

    /**
     * redis服务
     */
    public final RedisTemplate<String, Object> redisTemplate;

    public PhoneAndVerificationCodeAuthenticationProvider(MallUserDetailsService mallUserDetailsService, RedisTemplate<String, Object> redisTemplate) {
        this.mallUserDetailsService = mallUserDetailsService;
        this.redisTemplate = redisTemplate;
    }

    @Override
    public Authentication authenticate(Authentication authentication) throws AuthenticationException {

        PhoneAndVerificationCodeAuthenticationToken phoneAndVerificationCodeAuthenticationToken = (PhoneAndVerificationCodeAuthenticationToken) authentication;
        Object verificationCodeObj;
        String verificationCode = Objects.nonNull(verificationCodeObj = phoneAndVerificationCodeAuthenticationToken.getCredentials()) ?
                verificationCodeObj.toString() : StringUtils.EMPTY;
        // TODO 验证授权码
        // 验证用户
        Object phoneNumberObj;
        String phoneNumber = Objects.nonNull(phoneNumberObj = phoneAndVerificationCodeAuthenticationToken.getPrincipal())
                ? phoneNumberObj.toString() : StringUtils.EMPTY;
        if (StringUtils.isBlank(phoneNumber)) {
            throw new InternalAuthenticationServiceException("phone number is empty!");
        }
        // 根据电话号码获取用户
        UserDetails userDetails = mallUserDetailsService.loadUserByPhoneNumber(phoneNumber);
        if (Objects.isNull(userDetails)) {
            throw new InternalAuthenticationServiceException(
                    "MallUserDetailsService returned null, which is an interface contract violation");
        }
        // 封装需要认证的PhoneAndVerificationCodeAuthenticationToken对象
        return new PhoneAndVerificationCodeAuthenticationToken(userDetails.getAuthorities(), phoneNumber, verificationCode);
    }

    @Override
    public boolean supports(Class<?> authentication) {
        return PhoneAndVerificationCodeAuthenticationToken.class.isAssignableFrom(authentication);
    }
}

认证TokenGranter（PhoneAndVerificationCodeTokenGranter ）

spring security OAuth2中，默认的只有授权码类型，简化类型，密码类型，客户端类型。这里需要新增一种电话号码+验证码的认证和生成访问授权码的TokenGranter。接口TokenGranter定义了token获取方法，源码如下：

public interface TokenGranter {

	OAuth2AccessToken grant(String grantType, TokenRequest tokenRequest);

}

spring security使用了组合模式定义了上述4中TokenGranter，如下：

ImplicitTokenGranter：简化类型
ResourceOwnerPasswordTokenGranter：密码类型
AuthorizationCodeTokenGranter：授权码类型
ClientCredentialsTokenGranter：客户端类型
RefreshTokenGranter：刷新token
CompositeTokenGranter：组合类型

CompositeTokenGranter，组合了所有的TokenGranter实现类，其源码如下：

public class CompositeTokenGranter implements TokenGranter {

    // TokenGranter 列表
	private final List<TokenGranter> tokenGranters;

	public CompositeTokenGranter(List<TokenGranter> tokenGranters) {
		this.tokenGranters = new ArrayList<TokenGranter>(tokenGranters);
	}
	
	public OAuth2AccessToken grant(String grantType, TokenRequest tokenRequest) {
		for (TokenGranter granter : tokenGranters) {
			OAuth2AccessToken grant = granter.grant(grantType, tokenRequest);
			if (grant!=null) {
				return grant;
			}
		}
		return null;
	}
	
	public void addTokenGranter(TokenGranter tokenGranter) {
		if (tokenGranter == null) {
			throw new IllegalArgumentException("Token granter is null");
		}
		tokenGranters.add(tokenGranter);
	}

}

新增电话验证码类型，PhoneAndVerificationCodeTokenGranter，参考密码类型ResourceOwnerPasswordTokenGranter的认证流程，首先进行电话号码与验证码的认证，然后生成访问授权码，其源码如下：

public class PhoneAndVerificationCodeTokenGranter extends AbstractTokenGranter {

    private static final String GRANT_TYPE = "cms_code";

    private final AuthenticationManager authenticationManager;

    public PhoneAndVerificationCodeTokenGranter(AuthenticationManager authenticationManager, AuthorizationServerTokenServices tokenServices,
                                                ClientDetailsService clientDetailsService, OAuth2RequestFactory requestFactory) {
        this(authenticationManager, tokenServices, clientDetailsService, requestFactory, GRANT_TYPE);
    }

    @Autowired
    protected PhoneAndVerificationCodeTokenGranter(AuthenticationManager authenticationManager, AuthorizationServerTokenServices tokenServices,
                                                   ClientDetailsService clientDetailsService, OAuth2RequestFactory requestFactory, String grantType) {
        super(tokenServices, clientDetailsService, requestFactory, grantType);
        this.authenticationManager = authenticationManager;
    }

    @Override
    protected OAuth2Authentication getOAuth2Authentication(ClientDetails client, TokenRequest tokenRequest) {

        Map<String, String> parameters = new LinkedHashMap<>(tokenRequest.getRequestParameters());
        // 电话号码与验证码
        String phoneNumber = parameters.get("phone_number");
        String verificationCode = parameters.get("verification_code");

        Authentication userAuth = new PhoneAndVerificationCodeAuthenticationToken(phoneNumber, verificationCode);
        ((AbstractAuthenticationToken) userAuth).setDetails(parameters);
        try {
            // authenticationManager进行验证
            userAuth = authenticationManager.authenticate(userAuth);
        } catch (AccountStatusException ase) {
            //covers expired, locked, disabled cases (mentioned in section 5.2, draft 31)
            throw new InvalidGrantException(ase.getMessage());
        } catch (BadCredentialsException e) {
            // If the username/password are wrong the spec says we should send 400/invalid grant
            throw new InvalidGrantException(e.getMessage());
        }
        if (userAuth == null || !userAuth.isAuthenticated()) {
            throw new InvalidGrantException("Could not authenticate phone number: " + phoneNumber);
        }
        OAuth2Request storedOAuth2Request = getRequestFactory().createOAuth2Request(client, tokenRequest);
        return new OAuth2Authentication(storedOAuth2Request, userAuth);
    }
}

自定义认证配置

在资源服务中的配置，主要说下在配置tokenGranter，需要把默认端的全部一起设置，不然就是新增的才有效。tokenGranter配置的的源码如下：

    /**
     * 授权服务端点配置
     */
    @Override
    public void configure(AuthorizationServerEndpointsConfigurer endpoints) {

        // 初始化所有的TokenGranter，并且类型为CompositeTokenGranter
        List<TokenGranter> tokenGranters = getDefaultTokenGranters(endpoints);
        tokenGranters.add(new PhoneAndVerificationCodeTokenGranter(authenticationManager, endpoints.getTokenServices(),
                endpoints.getClientDetailsService(), endpoints.getOAuth2RequestFactory()));

        endpoints.tokenGranter(new CompositeTokenGranter(tokenGranters))
                // 配置tokenStore，使用redis 存储token
                .tokenStore(new RedisTokenStore(redisConnectionFactory))
                .authenticationManager(authenticationManager)
                // 用户管理服务
                .userDetailsService(userDetailsService)
                // 配置令牌转化器
                .accessTokenConverter(jwtAccessTokenConverter)
                // 允许 GET、POST 请求获取 token，即访问端点：oauth/token
                .allowedTokenEndpointRequestMethods(HttpMethod.GET, HttpMethod.POST)
                .reuseRefreshTokens(true);
    }

    /**
     * 初始化所有的TokenGranter
     */
    private List<TokenGranter> getDefaultTokenGranters(AuthorizationServerEndpointsConfigurer endpoints) {

        ClientDetailsService clientDetails = endpoints.getClientDetailsService();
        AuthorizationServerTokenServices tokenServices = endpoints.getTokenServices();
        AuthorizationCodeServices authorizationCodeServices = endpoints.getAuthorizationCodeServices();
        OAuth2RequestFactory requestFactory = endpoints.getOAuth2RequestFactory();

        List<TokenGranter> tokenGranters = new ArrayList<>();
        tokenGranters.add(new AuthorizationCodeTokenGranter(tokenServices, authorizationCodeServices, clientDetails,
                requestFactory));
        tokenGranters.add(new RefreshTokenGranter(tokenServices, clientDetails, requestFactory));
        ImplicitTokenGranter implicit = new ImplicitTokenGranter(tokenServices, clientDetails, requestFactory);
        tokenGranters.add(implicit);
        tokenGranters.add(new ClientCredentialsTokenGranter(tokenServices, clientDetails, requestFactory));
        if (authenticationManager != null) {
            tokenGranters.add(new ResourceOwnerPasswordTokenGranter(authenticationManager, tokenServices,
                    clientDetails, requestFactory));
        }
        return tokenGranters;
    }

手机号码和验证码认证提供者的配置，源码如下：

    /**
     * 配置HTTP安全
     */
    @Override
    protected void configure(HttpSecurity httpSecurity) throws Exception {

        // 配置电话号码和验证码认证
        httpSecurity.authenticationProvider(new PhoneAndVerificationCodeAuthenticationProvider(userDetailsService, redisTemplate))
                .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS)
                .and()
                .authorizeRequests()
                .antMatchers("/oauth/**").permitAll()
                .anyRequest().authenticated();
    }