map = new HashMap<>(8);
+ map.put(SecurityConstants.USER_INDEX_KEY, user.getUserIndex());
+ map.put(SecurityConstants.USER_TYPE, user.getType());
+ map.put(SecurityConstants.USER_NICKNAME_KEY, user.getNickName());
+ map.put(SecurityConstants.CLIENT_ID_KEY, clientId);
+ map.put(SecurityConstants.DEPT_INDEX_KEY, user.getDeptIndex());
+ if (StrUtil.isNotBlank(user.getAuthenticationMethod())) {
+ map.put(SecurityConstants.AUTHENTICATION_METHOD, user.getAuthenticationMethod());
+ }
+ ((DefaultOAuth2AccessToken) accessToken).setAdditionalInformation(map);
+ return accessToken;
+ };
+ }
+
+
+ /**
+ * 配置自定义密码认证过滤器
+ * @param security .
+ */
+ @Override
+ public void configure(AuthorizationServerSecurityConfigurer security) {
+ CustomClientCredentialsTokenEndpointFilter endpointFilter = new CustomClientCredentialsTokenEndpointFilter(security);
+ endpointFilter.afterPropertiesSet();
+ endpointFilter.setAuthenticationEntryPoint(authenticationEntryPoint());
+ security.addTokenEndpointAuthenticationFilter(endpointFilter);
+
+ security
+ .authenticationEntryPoint(authenticationEntryPoint())
+ /* .allowFormAuthenticationForClients()*/ //如果使用表单认证则需要加上
+ .tokenKeyAccess("permitAll()")
+ .checkTokenAccess("isAuthenticated()");
+ }
+
+
+
+ @Bean
+ public DaoAuthenticationProvider authenticationProvider() {
+ DaoAuthenticationProvider provider = new DaoAuthenticationProvider();
+ provider.setHideUserNotFoundExceptions(false);
+ provider.setUserDetailsService(userDetailsService);
+ provider.setPasswordEncoder(passwordEncoder);
+ return provider;
+ }
+
+}
diff --git a/pqs-auth/src/main/java/com/njcn/auth/config/WebSecurityConfig.java b/pqs-auth/src/main/java/com/njcn/auth/config/WebSecurityConfig.java
new file mode 100644
index 000000000..edeb8f34a
--- /dev/null
+++ b/pqs-auth/src/main/java/com/njcn/auth/config/WebSecurityConfig.java
@@ -0,0 +1,104 @@
+package com.njcn.auth.config;
+
+import com.njcn.auth.security.sm4.Sm4AuthenticationProvider;
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.security.authentication.AuthenticationManager;
+import org.springframework.security.authentication.ProviderManager;
+import org.springframework.security.authentication.dao.DaoAuthenticationProvider;
+import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
+import org.springframework.security.config.annotation.web.builders.HttpSecurity;
+import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
+import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
+import org.springframework.security.core.userdetails.UserDetailsService;
+import org.springframework.security.crypto.factory.PasswordEncoderFactories;
+import org.springframework.security.crypto.password.PasswordEncoder;
+
+/**
+ * @author hongawen
+ */
+@Slf4j
+@Configuration
+@EnableWebSecurity
+@RequiredArgsConstructor
+public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
+
+ private final UserDetailsService sysUserDetailsService;
+
+ private final Sm4AuthenticationProvider sm4AuthenticationProvider;
+
+
+ @Override
+ protected void configure(HttpSecurity http) throws Exception {
+ http
+ .authorizeRequests()
+ .antMatchers("/oauth/getPublicKey","/oauth/logout","/auth/getImgCode","/judgeToken/guangZhou").permitAll()
+ // @link https://gitee.com/xiaoym/knife4j/issues/I1Q5X6 (接口文档knife4j需要放行的规则)
+ .antMatchers("/webjars/**","/doc.html","/swagger-resources/**","/v2/api-docs").permitAll()
+ .anyRequest().authenticated()
+ .and()
+ .csrf().disable();
+ }
+
+ /**
+ * 认证管理对象
+ *
+ * @throws Exception .
+ * @return .
+ */
+ @Override
+ @Bean
+ public AuthenticationManager authenticationManagerBean() throws Exception {
+ return super.authenticationManagerBean();
+ }
+
+
+
+ @Override
+ public void configure(AuthenticationManagerBuilder auth) {
+ auth.authenticationProvider(daoAuthenticationProvider());
+ }
+
+
+
+
+ /**
+ * 用户名密码认证授权提供者
+ *
+ * @return
+ */
+ @Bean
+ public DaoAuthenticationProvider daoAuthenticationProvider() {
+ DaoAuthenticationProvider provider = new DaoAuthenticationProvider();
+ provider.setUserDetailsService(sysUserDetailsService);
+ provider.setPasswordEncoder(passwordEncoder());
+ provider.setHideUserNotFoundExceptions(false); // 是否隐藏用户不存在异常，默认:true-隐藏；false-抛出异常；
+ return provider;
+ }
+
+ /**
+ * 重写父类自定义AuthenticationManager 将provider注入进去
+ * 当然我们也可以考虑不重写 在父类的manager里面注入provider
+ */
+ @Bean
+ @Override
+ protected AuthenticationManager authenticationManager(){
+ return new ProviderManager(sm4AuthenticationProvider);
+ }
+
+
+ /**
+ * 密码编码器
+ *
+ * 委托方式，根据密码的前缀选择对应的encoder，例如：{bcypt}前缀->标识BCYPT算法加密；{noop}->标识不使用任何加密即明文的方式
+ * 密码判读 DaoAuthenticationProvider#additionalAuthenticationChecks
+ */
+ @Bean
+ public PasswordEncoder passwordEncoder() {
+ return PasswordEncoderFactories.createDelegatingPasswordEncoder();
+ }
+
+
+}
diff --git a/pqs-auth/src/main/java/com/njcn/auth/controller/AuthController.java b/pqs-auth/src/main/java/com/njcn/auth/controller/AuthController.java
new file mode 100644
index 000000000..7d7ad38bd
--- /dev/null
+++ b/pqs-auth/src/main/java/com/njcn/auth/controller/AuthController.java
@@ -0,0 +1,140 @@
+package com.njcn.auth.controller;
+
+import com.nimbusds.jose.jwk.JWKSet;
+import com.nimbusds.jose.jwk.RSAKey;
+import com.njcn.auth.service.UserTokenService;
+import com.njcn.common.pojo.constant.SecurityConstants;
+import com.njcn.common.pojo.dto.UserTokenInfo;
+import com.njcn.common.pojo.enums.response.CommonResponseEnum;
+import com.njcn.common.pojo.response.HttpResult;
+import com.njcn.common.utils.HttpResultUtil;
+import com.njcn.common.utils.LogUtil;
+import com.njcn.common.utils.sm.DesUtils;
+import com.njcn.redis.utils.RedisUtil;
+import com.njcn.user.api.UserFeignClient;
+import com.njcn.web.controller.BaseController;
+import com.njcn.web.utils.RequestUtil;
+import io.swagger.annotations.Api;
+import io.swagger.annotations.ApiImplicitParam;
+import io.swagger.annotations.ApiImplicitParams;
+import io.swagger.annotations.ApiOperation;
+import lombok.AllArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+import org.apache.commons.collections.CollectionUtils;
+import org.springframework.security.oauth2.common.OAuth2AccessToken;
+import org.springframework.security.oauth2.provider.endpoint.TokenEndpoint;
+import org.springframework.web.HttpRequestMethodNotSupportedException;
+import org.springframework.web.bind.annotation.*;
+import springfox.documentation.annotations.ApiIgnore;
+
+import java.security.KeyPair;
+import java.security.Principal;
+import java.security.interfaces.RSAPublicKey;
+import java.time.LocalDateTime;
+import java.time.ZoneOffset;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Map;
+import java.util.Objects;
+
+/**
+ * @author hongawen
+ */
+@Api(tags = "认证中心")
+@Slf4j
+@RestController
+@RequestMapping("/oauth")
+@AllArgsConstructor
+public class AuthController extends BaseController {
+
+
+ private final TokenEndpoint tokenEndpoint;
+
+ private final KeyPair keyPair;
+
+ private final RedisUtil redisUtil;
+
+ private final UserFeignClient userFeignClient;
+
+ private final UserTokenService userTokenService;
+
+
+ @ApiIgnore
+ @ApiOperation("登录认证")
+ @ApiImplicitParams({
+ @ApiImplicitParam(name = SecurityConstants.GRANT_TYPE, defaultValue = "password", value = "授权模式", required = true),
+ @ApiImplicitParam(name = SecurityConstants.CLIENT_ID, defaultValue = "njcn", value = "Oauth2客户端ID", required = true),
+ @ApiImplicitParam(name = SecurityConstants.CLIENT_SECRET, defaultValue = "njcnpqs", value = "Oauth2客户端秘钥", required = true),
+ @ApiImplicitParam(name = SecurityConstants.REFRESH_TOKEN, value = "刷新token"),
+ @ApiImplicitParam(name = SecurityConstants.USERNAME, value = "登录用户名"),
+ @ApiImplicitParam(name = SecurityConstants.PASSWORD, value = "登录密码"),
+ @ApiImplicitParam(name = SecurityConstants.IMAGE_CODE, value = "图形验证码"),
+ })
+ @PostMapping("/token")
+ public Object postAccessToken(@ApiIgnore Principal principal, @RequestParam @ApiIgnore Map parameters) throws HttpRequestMethodNotSupportedException {
+ String methodDescribe = getMethodDescribe("postAccessToken");
+ String username = parameters.get(SecurityConstants.USERNAME);
+ String grantType = parameters.get(SecurityConstants.GRANT_TYPE);
+ //正式环境需删除，均是加密的用户名
+ if (!grantType.equalsIgnoreCase(SecurityConstants.PASSWORD)) {
+ username = DesUtils.aesDecrypt(username);
+ }
+ if (grantType.equalsIgnoreCase(SecurityConstants.REFRESH_TOKEN_KEY)) {
+ //如果是刷新token，需要去黑名单校验
+ userTokenService.judgeRefreshToken(parameters.get(SecurityConstants.REFRESH_TOKEN_KEY));
+ }
+ RequestUtil.saveLoginName(username);
+ OAuth2AccessToken oAuth2AccessToken = tokenEndpoint.postAccessToken(principal, parameters).getBody();
+ //用户的登录名&密码校验成功后，判断当前该用户是否可以正常使用系统
+ userFeignClient.judgeUserStatus(username);
+ //登录成功后，记录token信息，并处理踢人效果
+ userTokenService.recordUserInfo(oAuth2AccessToken);
+ if (!grantType.equalsIgnoreCase(SecurityConstants.PASSWORD)) {
+ return HttpResultUtil.assembleCommonResponseResult(CommonResponseEnum.SUCCESS, oAuth2AccessToken, methodDescribe);
+ } else {
+ return oAuth2AccessToken;
+ }
+ }
+
+ @ApiOperation("用户登出系统")
+ @DeleteMapping("/logout")
+ public HttpResult