spring security 配置多个AuthenticationProvider

　　发现很少关于spring security的文章，基本都是入门级的，配个UserServiceDetails或者配个路由控制就完事了，而且很多还是xml配置，国内通病...so，本文里的配置都是java配置，不涉及xml配置，事实上我也不会xml配置

spring security的大体介绍

　　spring security本身如果只是说配置，还是很简单易懂的（我也不知道网上说spring security难，难在哪里），简单不需要特别的功能，一个WebSecurityConfigurerAdapter的实现，然后实现UserServiceDetails就是简单的数据库验证了，这个我就不说了。

　　spring security大体上是由一堆Filter（所以才能在spring mvc前拦截请求）实现的，Filter有几个，登出Filter（LogoutFilter），用户名密码验证Filter（UsernamePasswordAuthenticationFilter）之类的，Filter再交由其他组件完成细分的功能，例如最常用的UsernamePasswordAuthenticationFilter会持有一个AuthenticationManager引用，AuthenticationManager顾名思义，验证管理器，负责验证的，但AuthenticationManager本身并不做具体的验证工作，AuthenticationManager持有一个AuthenticationProvider集合，AuthenticationProvider才是做验证工作的组件，AuthenticationManager和AuthenticationProvider的工作机制可以大概看一下这两个的java doc，然后成功失败都有相对应该Handler 。大体的spring security的验证工作流程就是这样了。

开始配置多AuthenticationProvider

首先，写一个内存认证的AuthenticationProvider，这里我简单地写一个只有root帐号的AuthenticationProvider

package com.scau.equipment.config.common.security.provider;

import org.springframework.security.authentication.AuthenticationProvider;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.AuthenticationException;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.authority.SimpleGrantedAuthority;
import org.springframework.security.core.userdetails.User;
import org.springframework.stereotype.Component;

import java.util.Arrays;
import java.util.List;

/**
 * Created by Administrator on 2017-05-10.
 */
@Component
public class InMemoryAuthenticationProvider implements AuthenticationProvider {
    private final String adminName = "root";
    private final String adminPassword = "root";

    //根用户拥有全部的权限
    private final List<GrantedAuthority> authorities = Arrays.asList(new SimpleGrantedAuthority("CAN_SEARCH"),
            new SimpleGrantedAuthority("CAN_SEARCH"),
            new SimpleGrantedAuthority("CAN_EXPORT"),
            new SimpleGrantedAuthority("CAN_IMPORT"),
            new SimpleGrantedAuthority("CAN_BORROW"),
            new SimpleGrantedAuthority("CAN_RETURN"),
            new SimpleGrantedAuthority("CAN_REPAIR"),
            new SimpleGrantedAuthority("CAN_DISCARD"),
            new SimpleGrantedAuthority("CAN_EMPOWERMENT"),
            new SimpleGrantedAuthority("CAN_BREED"));

    @Override
    public Authentication authenticate(Authentication authentication) throws AuthenticationException {
        if(isMatch(authentication)){
            User user = new User(authentication.getName(),authentication.getCredentials().toString(),authorities);
            return new UsernamePasswordAuthenticationToken(user,authentication.getCredentials(),authorities);
        }
        return null;
    }

    @Override
    public boolean supports(Class<?> authentication) {
        return true;
    }

    private boolean isMatch(Authentication authentication){
        if(authentication.getName().equals(adminName)&&authentication.getCredentials().equals(adminPassword))
            return true;
        else
            return false;
    }
}

InMemoryAuthenticationProvider