Spring Boot 中的 Spring Security 自动配置初探

2020-05-28 00:00:00 是一个配置注解容器该类

1. 前言

我们在前几篇对 Spring Security 的用户信息管理机制，密码机制进行了探讨。我们发现 Spring Security Starter相关的 Servlet 自动配置都在spring-boot-autoconfigure-2.1.9.RELEASE（当前 Spring Boot 版本为2.1.9.RELEASE）模块的路径org.springframework.boot.autoconfigure.security.servlet 之下。其实官方提供的Starter组件的自动配置你都能在spring-boot-autoconfigure-2.1.9.RELEASE下找到。今天我们进一步来解密 Spring Security 在 Spring Boot 的配置和使用。

2. Spring Boot 下 Spring Security 的自动配置

我们可以通过 org.springframework.boot.autoconfigure.security.servlet 路径下找到 Spring Security 关于Servlet的自动配置类。我们来大致了解一下。

2.1 SecurityAutoConfiguration

  package org.springframework.boot.autoconfigure.security.servlet;
  
  import org.springframework.boot.autoconfigure.EnableAutoConfiguration;
  import org.springframework.boot.autoconfigure.condition.ConditionalOnClass;
  import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean;
  import org.springframework.boot.autoconfigure.security.SecurityDataConfiguration;
  import org.springframework.boot.autoconfigure.security.SecurityProperties;
  import org.springframework.boot.context.properties.EnableConfigurationProperties;
  import org.springframework.context.ApplicationEventPublisher;
  import org.springframework.context.annotation.Bean;
  import org.springframework.context.annotation.Configuration;
  import org.springframework.context.annotation.Import;
  import org.springframework.security.authentication.AuthenticationEventPublisher;
  import org.springframework.security.authentication.DefaultAuthenticationEventPublisher;
  
  /**
   * {@link EnableAutoConfiguration Auto-configuration} for Spring Security.
   *
   * @author Dave Syer
   * @author Andy Wilkinson
   * @author Madhura Bhave
   * @since 1.0.0
   */
  @Configuration
  @ConditionalOnClass(DefaultAuthenticationEventPublisher.class)
  @EnableConfigurationProperties(SecurityProperties.class)
  @Import({ SpringBootWebSecurityConfiguration.class, WebSecurityEnablerConfiguration.class,
          SecurityDataConfiguration.class })
  public class SecurityAutoConfiguration {
  
      @Bean
      @ConditionalOnMissingBean(AuthenticationEventPublisher.class)
      public DefaultAuthenticationEventPublisher authenticationEventPublisher(ApplicationEventPublisher publisher) {
          return new DefaultAuthenticationEventPublisher(publisher);
      }
  
  }

相关文章