(八) OAuth 2.0 认证成功，认证失败，退出成功

认证成功

监听AuthenticationSuccessEvent，注意在刷新令牌，校验令牌，登录密码校验成功都会发布这个事件，所以我们需要在监听器里面做一些排查判断。successHandler是自定义业务逻辑类。

/**
 * @description: 登录成功事件监听器
 * @Author C_Y_J
 * @create 2022/1/13 16:36
 **/
public class AuthenticationSuccessEventListener implements ApplicationListener<AuthenticationSuccessEvent> {

    @Autowired(required = false)
    private AuthenticationSuccessHandler successHandler;

    @Override
    public void onApplicationEvent(AuthenticationSuccessEvent event) {
        Authentication authentication = (Authentication) event.getSource();

        // successHandler不为空并且已经是认证用户，从请求上下文中拿到请求属性
        if (successHandler != null && isUserAuthentication(authentication)) {

            ServletRequestAttributes requestAttributes = (ServletRequestAttributes) RequestContextHolder.getRequestAttributes();

            HttpServletRequest request = requestAttributes.getRequest();
            HttpServletResponse response = requestAttributes.getResponse();

            // 调用自定义业务实现
            successHandler.handle(authentication, request, response);
        }
    }

    private boolean isUserAuthentication(Authentication authentication) {
        if (authentication.getPrincipal() instanceof SecurityUser) {
            return true;
        }
        return CollUtil.isNotEmpty(authentication.getAuthorities());
    }

}

认证失败

监听AuthenticationFailureBadCredentialsEvent，注意在刷新令牌，校验令牌，登录密码校验成功都会发布这个事件，所以我们需要在监听器里面做一些排查判断。successHandler是自定义业务逻辑类。

/**
 * @description: 认证失败事件监听器
 * @Author C_Y_J
 * @create 2022/1/13 16:36
 **/
public class AuthenticationFailureEventListener implements ApplicationListener<AuthenticationFailureBadCredentialsEvent> {

    @Autowired(required = false)
    private AuthenticationFailureHandler failureHandler;

    /**
     * Handle an application event.
     *
     * @param event the event to respond to
     */
    @Override
    public void onApplicationEvent(AuthenticationFailureBadCredentialsEvent event) {


        ServletRequestAttributes requestAttributes = (ServletRequestAttributes) RequestContextHolder.getRequestAttributes();

        HttpServletRequest request = requestAttributes.getRequest();
        HttpServletResponse response = requestAttributes.getResponse();

        AuthenticationException authenticationException = event.getException();
        Authentication authentication = (Authentication) event.getSource();

        // 调用自定义业务实现
        if (failureHandler != null) {
            failureHandler.handle(authenticationException, authentication, request, response);
        }
    }

    private boolean isUserAuthentication(Authentication authentication) {
        if (authentication.getPrincipal() instanceof SecurityUser) {
            return true;
        }
        return CollUtil.isNotEmpty(authentication.getAuthorities());
    }

}

退出成功

Spring security oauth2.0是没有退出接口的

/**
 * @description:
 * @Author C_Y_J
 * @create 2022/1/20 9:16
 **/
@RestController
@AllArgsConstructor
@RequestMapping("/token")
public class CustomTokenEndpoint {

    private final TokenStore tokenStore;

    /**
     * 退出token
     *
     * @param authHeader Authorization
     */
    @DeleteMapping("/logout")
    public R logout(@RequestHeader(value = HttpHeaders.AUTHORIZATION, required = false) String authHeader) {

        if (StrUtil.isBlank(authHeader)) {
            return R.ok(Boolean.FALSE, "退出失败，token 为空");
        }

        String tokenValue = authHeader.replace(OAuth2AccessToken.BEARER_TYPE, "").trim();

        OAuth2AccessToken accessToken = tokenStore.readAccessToken(tokenValue);
        if (accessToken == null || StrUtil.isBlank(accessToken.getValue())) {
            return R.ok(Boolean.TRUE, "退出失败，token 无效");
        }
        OAuth2Authentication auth2Authentication = tokenStore.readAuthentication(accessToken);
        // 清空用户信息
        // 清空access token
        tokenStore.removeAccessToken(accessToken);
        // 清空 refresh token
        OAuth2RefreshToken refreshToken = accessToken.getRefreshToken();
        tokenStore.removeRefreshToken(refreshToken);
        // 发送退出成功事件
        SpringContextHolder.publishEvent(new LogoutSuccessEvent(auth2Authentication));
        return R.ok();
    }

    /**
     * 用户认证信息
     */
    @GetMapping(value = "/authentication")
    public String info() {
        Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
        if (!authentication.isAuthenticated()) {
            return null;
        }
        Object principal = authentication.getPrincipal();
        String username = null;
        if (principal instanceof UserDetails) {
            username = ((UserDetails) principal).getUsername();
        } else {
            username = principal.toString();
        }
        return username;
    }
}

event

/**
 * @description: 退出成功事件
 * @Author C_Y_J
 * @create 2022/1/20 9:22
 **/
public class LogoutSuccessEvent extends AbstractAuthenticationEvent {

    public LogoutSuccessEvent(Authentication authentication) {
        super(authentication);
    }

}

/**
 * @description:
 * @Author C_Y_J
 * @create 2022/1/20 9:20
 **/
@Slf4j
public class SpringContextHolder implements ApplicationContextAware, DisposableBean {

    private static ApplicationContext applicationContext = null;

    /**
     * 取得存储在静态变量中的ApplicationContext.
     */
    public static ApplicationContext getApplicationContext() {
        return applicationContext;
    }

    /**
     * 实现ApplicationContextAware接口, 注入Context到静态变量中.
     */
    @Override
    public void setApplicationContext(ApplicationContext applicationContext) {
        SpringContextHolder.applicationContext = applicationContext;
    }

    /**
     * 从静态变量applicationContext中取得Bean, 自动转型为所赋值对象的类型.
     */
    @SuppressWarnings("unchecked")
    public static <T> T getBean(String name) {
        return (T) applicationContext.getBean(name);
    }

    /**
     * 从静态变量applicationContext中取得Bean, 自动转型为所赋值对象的类型.
     */
    public static <T> T getBean(Class<T> requiredType) {
        return applicationContext.getBean(requiredType);
    }

    /**
     * 清除SpringContextHolder中的ApplicationContext为Null.
     */
    public static void clearHolder() {
        if (log.isDebugEnabled()) {
            log.debug("清除SpringContextHolder中的ApplicationContext:" + applicationContext);
        }
        applicationContext = null;
    }

    /**
     * 发布事件
     *
     * @param event
     */
    public static void publishEvent(ApplicationEvent event) {
        if (applicationContext == null) {
            return;
        }
        applicationContext.publishEvent(event);
    }

    /**
     * 实现DisposableBean接口, 在Context关闭时清理静态变量.
     */
    @Override
    public void destroy() {
        SpringContextHolder.clearHolder();
    }

}

监听器

/**
 * @description: 退出登录成功事件监听器
 * @Author C_Y_J
 * @create 2022/1/20 9:55
 **/
@Slf4j
public class AuthenticationLogoutSuccessEventListener implements ApplicationListener<LogoutSuccessEvent> {

    @Autowired(required = false)
    private AuthenticationLogoutHandler logoutHandler;

    /**
     * Handle an application event.
     *
     * @param event the event to respond to
     */
    @Override
    public void onApplicationEvent(LogoutSuccessEvent event) {
        OAuth2Authentication authentication = (OAuth2Authentication) event.getSource();

        // successHandler不为空 并且 已经是认证用户 。从请求上下文中拿到请求属性
        if (logoutHandler != null && isUserAuthentication(authentication)) {

            ServletRequestAttributes requestAttributes = (ServletRequestAttributes) RequestContextHolder.getRequestAttributes();

            HttpServletRequest request = requestAttributes.getRequest();
            HttpServletResponse response = requestAttributes.getResponse();

            // 调用自定义业务实现
            logoutHandler.handle(authentication, request, response);
        }
    }

    private boolean isUserAuthentication(Authentication authentication) {
        if (authentication.getPrincipal() instanceof SecurityUser) {
            return true;
        }
        return CollUtil.isNotEmpty(authentication.getAuthorities());
    }
}

最后记得加上@Component注解放入Spring容器中