How can I add my business logic to the authentication of spring cloud oauth? - spring-boot

Question

In the oauth server side(auth microservice),I try to implement the oauth center by spring security and jwt, here is the Code of my UserDetailService:
#Override
#Transactional
public UserDetails loadUserByUsername(String username) throws
UsernameNotFoundException {
ManagerInfo managerInfo = userMapper.getUserByLoginName(username);
if(managerInfo ==null)
throw new UsernameNotFoundException("sorry,can not find user of "+username+"！");
Collection<Role> roleList =roleMapper.getRoleByUserId(managerInfo.getId());
String roleIds = roleList.stream().map(role ->role.getId().toString()).collect(Collectors.joining(","));
Collection<Authority> authorities =authorityMapper.getAuthoritiesByRoleIds(roleIds);
CustomUserPrincipal userDetail = new CustomUserPrincipal(managerInfo.getUsername(),managerInfo.getPassword(),
authorities);
userDetail.setUser(managerInfo);
return userDetail;
}
The CustomUserprincipal just extends org.springframework.security.core.userdetails.User,and the Authority implements org.springframework.security.core.GrantedAuthority.
In my gateway project , I try to use spring boot(version:1.5.9.RELEASE) and here is some dependency:
<dependency>
<groupId>org.springframework.security.oauth</groupId>
<artifactId>spring-security-oauth2</artifactId>
</dependency>
<dependency>
<groupId>org.springframework.security</groupId>
<artifactId>spring-security-jwt</artifactId>
</dependency>
Now,I have successfully authenticate the user by "prePostEnabled" way,here is the controller code:
#RequestMapping(value = "/getUserById/{id}",method = RequestMethod.GET)
#PreAuthorize("hasAnyAuthority('LIST_USER')")
CollectionAccount getUserById(#PathVariable String id){
return managerService.getCollectionAccount(Long.parseLong(id));
}
All the code I have written works great,and the user have 'LIST USER' authority which is returned by the userdetailservice can access this method.
But,what if I want to authenticate the user by resource type,not just the authority string?
Or add some business logic to the authentication, like 'A_PARK_LIST_USER','B_PARK_LIST_USER' and so on,maybe the user login in just have 'A_PARK_LIST_USER' and can not list the user of "B_PARK",so I can not control the access right just by'LIST USER', how can I do that?

Answer 1

You just need to inject the AuthenticationPrincipal into the controller method.
Try this:
#RequestMapping(value = "/getUserById/{id}",method = RequestMethod.GET)
#PreAuthorize("hasAnyAuthority('LIST_USER')")
CollectionAccount getUserById(#PathVariable String id, #AuthenticationPrincipal Principal principal){
//Here you have the users information, the principal.getName() will be the username that has been authenticated
log.debug(principal.getName());
return managerService.getCollectionAccount(Long.parseLong(id));
}