Spring Security (2) - 스프링 시큐리티

// PageController.java

@Controller
public class PageController {

    @Autowired
    MainNewsServiceImpl mainNewsService;

    @RequestMapping(value="/")
    public String indexPage() {

        return "index";
    }

    @RequestMapping(value="/login")
    public String loginPage() {

        return "login";
    }
    
    @RequestMapping(value="/loginSuccess")
    public String loginSuccessPage() {
    
        return "loginSuccess";
    }
    
    @RequestMapping(value="/admin")
    public String adminPage() {
    
        return "admin";
    }
}

// User.java

    @Entity
    @Table(name="T_USER")
    @Data
    public class User {

    @Id
    @GeneratedValue(strategy=GenerationType.IDENTITY)
    @Column(name = "seq")
    private int id;

    @Column(name = "id", length = 20, unique = true, nullable = false)
    private String uid;
    @Column(length = 50, nullable = false)
    private String password;
    @Column(length = 10, nullable = false)
    private String name;
    @Column(nullable = false)
    private Date date;

    @OneToMany(cascade=CascadeType.ALL, fetch=FetchType.EAGER)
    @JoinColumn(name="user_seq")
    private List<UserRole> roles = new ArrayList<UserRole>();
}

// UserRole.java

@Entity
@Table(name="T_USER_ROLE")
@Data
public class UserRole {

    @Id
    @GeneratedValue(strategy=GenerationType.IDENTITY)
    @Column(name = "seq")
    private int seq;

    @Column(name = "user_seq")
    private int user;

    @Column(length = 200, nullable = false)
    private String role;
}

@Repository
public interface UserDao extends JpaRepository<User, Integer> {
    public User findByUid(String uid);
}

@Repository
public interface UserRoleDao extends JpaRepository<UserRole, Integer> {
}

// SpringSecurityConfig.java

@EnableWebSecurity
public class SpringSecurityConfig extends WebSecurityConfigurerAdapter  {

    @Override
    public void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests() // URL별 Access control을 설정이 가능합니다. 
                .antMatchers("/admin").hasRole("ADMIN")
                .antMatchers("/loginSuccess").authenticated()
                .antMatchers("/","/login").permitAll()
            .and().formLogin().permitAll() // 로그인관련 설정을 진행합니다.
                .loginPage("/login")
                .usernameParameter("id")
                .passwordParameter("password")
                .loginProcessingUrl("/loginProcess")
                .defaultSuccessUrl("/loginSuccess")
            .and().logout() // 로그아웃관련 설정을 진행합니다.
                .logoutUrl("/logout")
                .logoutSuccessUrl("/")
                .deleteCookies("JSESSIONID")
                .invalidateHttpSession(true) 
                .permitAll()
            .and().csrf().disable() // 스프링 시큐리티에서는 기본적으로 csrf와 헤더를 체크하게되어 있는데 위의 설정을 통해 체크없이 진행할수 있도록 설정해줍니다.  
                headers().disable();

    }

    @Override
    public void configure(WebSecurity web) throws Exception {
        // 위에서 진행한 http Access control 설정보다 앞서 인증에서 제외시켜줄 목록들을 정의할수 있습니다. 주로 리소스들에 대하여 ignore 시켜줍니다.  
        web.ignoring().antMatchers("/css/**", "/script/**", "/image/**", "/fonts/**", "lib/**");
    }

    @Override
    public void configure(AuthenticationManagerBuilder builder)
    throws Exception {
        // 위 AuthenticationManagerBuilder 설정은 실제로 인증이 일어나는 provider를 커스터마이징한 AuthenticationProvider로 등록시켜주는 설정입니다. 해당 설정을통해 인증과정을 직접 구현해줄수 있습니다.  
        builder.authenticationProvider(customAuthenticationProvider());
    }

    @Bean
    public AuthenticationProvider customAuthenticationProvider() {
        return new CustomAuthenticationProvider();
    }
}

// CustomAuthenticationProvider.java

public class CustomAuthenticationProvider implements AuthenticationProvider {

    @Resource (name="UserInformationService")
    UserInformationService userInformationService;

    @Override
    public Authentication authenticate(Authentication authentication) throws AuthenticationException {
        Collection<? extends GrantedAuthority> authorities;

        String id = authentication.getName(); 
        String password = (String) authentication.getCredentials(); 


        UserInformation user = (UserInformation) userInformationService.loadUserByUsername(id);// ID 확인
        user.getUsername();
        authorities = user.getAuthorities();

        System.out.println("AUTHORIES :: " + authorities);

        BCryptPasswordEncoder bCryptPasswordEncoder = new BCryptPasswordEncoder();

        if(!bCryptPasswordEncoder.matches(password, user.getPassword())) // PW 확인
        throw new BadCredentialsException("wrongPassword"); // PW 틀림

        return new UsernamePasswordAuthenticationToken(user, user.getPassword(), authorities);
    }

    @Override
    public boolean supports(Class<?> authentication) {
        return  authentication.equals(UsernamePasswordAuthenticationToken.class);
    }
}

  // UserInformation.java
  
  @Data
  public class UserInformation implements UserDetails {
  
      private String username;
      private String password;
      private List<GrantedAuthority> authorities;
      
      @Override
      public boolean isAccountNonExpired() {
          // TODO Auto-generated method stub
          return false;
      }
      
      @Override
      public boolean isAccountNonLocked() {
          // TODO Auto-generated method stub
          return false;
      }
      
      @Override
      public boolean isCredentialsNonExpired() {
          // TODO Auto-generated method stub
          return false;
      }
      
      @Override
      public boolean isEnabled() {
          // TODO Auto-generated method stub
          return false;
      }
  }

// UserInformationService.java

@Service ("UserInformationService")
public class UserInformationService implements UserDetailsService {

    @Resource (name="UserDao")
    private UserDao UserDao;

    private static final Logger logger = LoggerFactory.getLogger(CustomAuthenticationProvider.class);

    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {

        UserInformation user  = new UserInformation();
        try{ 
            User userEntity = UserDao.findByUid(username);
            user.setUsername(userEntity.getUid());
            user.setPassword(userEntity.getPassword());
            user.setAuthorities(makeGrantedAuthority(userEntity.getRoles()));           
            }catch(Exception e){
            throw new UsernameNotFoundException("wrongId"); // Email 로그인, 저장된 ID 없음
        }
        return user;
    }

    public List<GrantedAuthority> makeGrantedAuthority(List<UserRole> roles){
        List<GrantedAuthority> list = new ArrayList<>();
        roles.forEach(role -> list.add(new SimpleGrantedAuthority(role.getRole())));
        return list;
    }
}