diff --git a/yudao-example/yudao-sso-demo-by-code/src/main/java/cn/iocoder/yudao/ssodemo/framework/config/SecurityConfiguration.java b/yudao-example/yudao-sso-demo-by-code/src/main/java/cn/iocoder/yudao/ssodemo/framework/config/SecurityConfiguration.java index a81330fd2..0a71a650f 100644 --- a/yudao-example/yudao-sso-demo-by-code/src/main/java/cn/iocoder/yudao/ssodemo/framework/config/SecurityConfiguration.java +++ b/yudao-example/yudao-sso-demo-by-code/src/main/java/cn/iocoder/yudao/ssodemo/framework/config/SecurityConfiguration.java @@ -2,17 +2,20 @@ package cn.iocoder.yudao.ssodemo.framework.config; import cn.iocoder.yudao.ssodemo.framework.core.filter.TokenAuthenticationFilter; import cn.iocoder.yudao.ssodemo.framework.core.handler.AccessDeniedHandlerImpl; +import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Configuration; import org.springframework.http.HttpMethod; import org.springframework.security.config.annotation.web.builders.HttpSecurity; -import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter; +import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity; import org.springframework.security.web.AuthenticationEntryPoint; +import org.springframework.security.web.SecurityFilterChain; import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter; import javax.annotation.Resource; @Configuration(proxyBeanMethods = false) -public class SecurityConfiguration extends WebSecurityConfigurerAdapter { +@EnableWebSecurity +public class SecurityConfiguration{ @Resource private TokenAuthenticationFilter tokenAuthenticationFilter; @@ -22,8 +25,8 @@ public class SecurityConfiguration extends WebSecurityConfigurerAdapter { @Resource private AuthenticationEntryPoint authenticationEntryPoint; - @Override - protected void configure(HttpSecurity httpSecurity) throws Exception { + @Bean + protected SecurityFilterChain filterChain(HttpSecurity httpSecurity) throws Exception { // 设置 URL 安全权限 httpSecurity.csrf().disable() // 禁用 CSRF 保护 .authorizeRequests() @@ -43,6 +46,7 @@ public class SecurityConfiguration extends WebSecurityConfigurerAdapter { // 添加 Token Filter httpSecurity.addFilterBefore(tokenAuthenticationFilter, UsernamePasswordAuthenticationFilter.class); + return httpSecurity.build(); } } diff --git a/yudao-example/yudao-sso-demo-by-password/src/main/java/cn/iocoder/yudao/ssodemo/framework/config/SecurityConfiguration.java b/yudao-example/yudao-sso-demo-by-password/src/main/java/cn/iocoder/yudao/ssodemo/framework/config/SecurityConfiguration.java index a81330fd2..19631a3a4 100644 --- a/yudao-example/yudao-sso-demo-by-password/src/main/java/cn/iocoder/yudao/ssodemo/framework/config/SecurityConfiguration.java +++ b/yudao-example/yudao-sso-demo-by-password/src/main/java/cn/iocoder/yudao/ssodemo/framework/config/SecurityConfiguration.java @@ -2,17 +2,20 @@ package cn.iocoder.yudao.ssodemo.framework.config; import cn.iocoder.yudao.ssodemo.framework.core.filter.TokenAuthenticationFilter; import cn.iocoder.yudao.ssodemo.framework.core.handler.AccessDeniedHandlerImpl; +import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Configuration; import org.springframework.http.HttpMethod; import org.springframework.security.config.annotation.web.builders.HttpSecurity; -import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter; +import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity; import org.springframework.security.web.AuthenticationEntryPoint; +import org.springframework.security.web.SecurityFilterChain; import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter; import javax.annotation.Resource; @Configuration(proxyBeanMethods = false) -public class SecurityConfiguration extends WebSecurityConfigurerAdapter { +@EnableWebSecurity +public class SecurityConfiguration { @Resource private TokenAuthenticationFilter tokenAuthenticationFilter; @@ -22,8 +25,8 @@ public class SecurityConfiguration extends WebSecurityConfigurerAdapter { @Resource private AuthenticationEntryPoint authenticationEntryPoint; - @Override - protected void configure(HttpSecurity httpSecurity) throws Exception { + @Bean + protected SecurityFilterChain filterChain(HttpSecurity httpSecurity) throws Exception { // 设置 URL 安全权限 httpSecurity.csrf().disable() // 禁用 CSRF 保护 .authorizeRequests() @@ -43,6 +46,7 @@ public class SecurityConfiguration extends WebSecurityConfigurerAdapter { // 添加 Token Filter httpSecurity.addFilterBefore(tokenAuthenticationFilter, UsernamePasswordAuthenticationFilter.class); + return httpSecurity.build(); } } diff --git a/yudao-framework/yudao-spring-boot-starter-security/src/main/java/cn/iocoder/yudao/framework/security/config/YudaoWebSecurityConfigurerAdapter.java b/yudao-framework/yudao-spring-boot-starter-security/src/main/java/cn/iocoder/yudao/framework/security/config/YudaoWebSecurityConfigurerAdapter.java index 4bbc39681..c3715c185 100644 --- a/yudao-framework/yudao-spring-boot-starter-security/src/main/java/cn/iocoder/yudao/framework/security/config/YudaoWebSecurityConfigurerAdapter.java +++ b/yudao-framework/yudao-spring-boot-starter-security/src/main/java/cn/iocoder/yudao/framework/security/config/YudaoWebSecurityConfigurerAdapter.java @@ -5,16 +5,16 @@ import cn.iocoder.yudao.framework.web.config.WebProperties; import com.google.common.collect.HashMultimap; import com.google.common.collect.Multimap; import org.springframework.boot.autoconfigure.AutoConfiguration; -import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean; import org.springframework.context.ApplicationContext; import org.springframework.context.annotation.Bean; import org.springframework.http.HttpMethod; import org.springframework.security.authentication.AuthenticationManager; +import org.springframework.security.config.annotation.authentication.configuration.AuthenticationConfiguration; import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity; import org.springframework.security.config.annotation.web.builders.HttpSecurity; -import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter; import org.springframework.security.config.http.SessionCreationPolicy; import org.springframework.security.web.AuthenticationEntryPoint; +import org.springframework.security.web.SecurityFilterChain; import org.springframework.security.web.access.AccessDeniedHandler; import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter; import org.springframework.web.method.HandlerMethod; @@ -34,7 +34,7 @@ import java.util.Set; */ @AutoConfiguration @EnableGlobalMethodSecurity(prePostEnabled = true, securedEnabled = true) -public class YudaoWebSecurityConfigurerAdapter extends WebSecurityConfigurerAdapter { +public class YudaoWebSecurityConfigurerAdapter { @Resource private WebProperties webProperties; @@ -72,11 +72,9 @@ public class YudaoWebSecurityConfigurerAdapter extends WebSecurityConfigurerAdap * 由于 Spring Security 创建 AuthenticationManager 对象时,没声明 @Bean 注解,导致无法被注入 * 通过覆写父类的该方法,添加 @Bean 注解,解决该问题 */ - @Override @Bean - @ConditionalOnMissingBean(AuthenticationManager.class) - public AuthenticationManager authenticationManagerBean() throws Exception { - return super.authenticationManagerBean(); + public AuthenticationManager authenticationManagerBean(AuthenticationConfiguration authenticationConfiguration) throws Exception { + return authenticationConfiguration.getAuthenticationManager(); } /** @@ -96,8 +94,8 @@ public class YudaoWebSecurityConfigurerAdapter extends WebSecurityConfigurerAdap * rememberMe | 允许通过remember-me登录的用户访问 * authenticated | 用户登录后可访问 */ - @Override - protected void configure(HttpSecurity httpSecurity) throws Exception { + @Bean + protected SecurityFilterChain filterChain(HttpSecurity httpSecurity) throws Exception { // 登出 httpSecurity // 开启跨域 @@ -141,6 +139,8 @@ public class YudaoWebSecurityConfigurerAdapter extends WebSecurityConfigurerAdap // 添加 Token Filter httpSecurity.addFilterBefore(authenticationTokenFilter, UsernamePasswordAuthenticationFilter.class); + + return httpSecurity.build(); } private String buildAppApi(String url) {