摘要：序本文就來介紹一下如何使用進行賬戶切換順序內置的各種可以看到是提供的里頭順序在最后的一個。前面講到了主要用來進行鑒權處理，而是用來做賬戶切換的，把它放在之后，是要求對切換用戶的功能進行鑒權，否則任何人都可以隨意切換用戶，那就安全故障了。

本文就來介紹一下如何使用SwitchUserFilter進行賬戶切換

spring security內置的各種filter：

可以看到SwitchUserFilter是spring security提供的filter里頭order順序在最后的一個。
前面講到了FilterSecurityInterceptor主要用來進行鑒權處理，而SwitchUserFilter是用來做賬戶切換的，把它放在FilterSecurityInterceptor之后，是要求對切換用戶的功能進行鑒權，否則任何人都可以隨意切換用戶，那就安全故障了。

@EnableWebSecurity
@EnableGlobalMethodSecurity(
        securedEnabled = true,
        jsr250Enabled = true,
        prePostEnabled = true
)
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Bean
    public SwitchUserFilter switchUserFilter(UserDetailsService userDetailsService) throws Exception {
        SwitchUserFilter switchUserFilter = new SwitchUserFilter();
        switchUserFilter.setUserDetailsService(userDetailsService);
        switchUserFilter.setTargetUrl("/session");
        return switchUserFilter;
    }


    @Override
    protected void configure(HttpSecurity http) throws Exception {
        //Each  namespace block always creates an SecurityContextPersistenceFilter, an ExceptionTranslationFilter and a FilterSecurityInterceptor. These are fixed and cannot be replaced with alternatives.
        http
                .addFilterAfter(switchUserFilter(userDetailsService()),FilterSecurityInterceptor.class)
                .exceptionHandling().authenticationEntryPoint(new UnauthorizedEntryPoint())
                .and()
                .csrf().disable()
                .authorizeRequests()
                .antMatchers("/login","/css/**", "/js/**","/fonts/**").permitAll()
                .antMatchers("/session").authenticated()
                .antMatchers("/login/impersonate").hasAuthority("ROLE_ADMIN")
                .antMatchers("/logout/impersonate").hasAuthority(SwitchUserFilter.ROLE_PREVIOUS_ADMINISTRATOR)
                .and()
                .formLogin()
                .permitAll()
                .and()
                .logout()
                .deleteCookies("JSESSIONID")
                .permitAll();
    }

    @Bean
    @Override
    protected UserDetailsService userDetailsService(){
        InMemoryUserDetailsManager manager = new InMemoryUserDetailsManager();
        manager.createUser(User.withUsername("demoUser1").password("123456")
                .authorities("ROLE_USER","read_x").build());
        manager.createUser(User.withUsername("admin").password("123456")
                .authorities("ROLE_ADMIN").build());
        return manager;
    }
}

SwitchUserFilter默認的切換賬號的url為/login/impersonate，默認注銷切換賬號的url為/logout/impersonate，默認的賬號參數為username

上面的配置為了方便驗證，把切換完用戶的targetUrl設置為/session，其代碼如下

@RestController
@RequestMapping("/session")
public class SessionController {

    @GetMapping("")
    public Object getCurrentUser(){
        return SecurityContextHolder.getContext().getAuthentication();
    }
}

首先用普通用戶登錄，訪問http://localhost:8080/login/impersonate?username=admin，發現返回403

注銷，使用管理員登錄，訪問http://localhost:8080/login/impersonate?username=demoUser1，發現成功并跳轉到session

{
  "authorities": [
    {
      "authority": "ROLE_USER"
    },
    {
      "authority": "read_x"
    },
    {
      "source": {
        "authorities": [
          {
            "authority": "ROLE_ADMIN"
          }
        ],
        "details": {
          "remoteAddress": "0:0:0:0:0:0:0:1",
          "sessionId": null
        },
        "authenticated": true,
        "principal": {
          "password": null,
          "username": "admin",
          "authorities": [
            {
              "authority": "ROLE_ADMIN"
            }
          ],
          "accountNonExpired": true,
          "accountNonLocked": true,
          "credentialsNonExpired": true,
          "enabled": true
        },
        "credentials": null,
        "name": "admin"
      },
      "authority": "ROLE_PREVIOUS_ADMINISTRATOR"
    }
  ],
  "details": {
    "remoteAddress": "0:0:0:0:0:0:0:1",
    "sessionId": "1BF3D6F40A6F488EFD3ABE8F80E52872"
  },
  "authenticated": true,
  "principal": {
    "password": "123456",
    "username": "demoUser1",
    "authorities": [
      {
        "authority": "ROLE_USER"
      },
      {
        "authority": "read_x"
      }
    ],
    "accountNonExpired": true,
    "accountNonLocked": true,
    "credentialsNonExpired": true,
    "enabled": true
  },
  "credentials": "123456",
  "name": "demoUser1"
}

可以發現有成功切換

之后再切換回來
http://localhost:8080/logout/impersonate?username=demoUser1

{
  "authorities": [
    {
      "authority": "ROLE_ADMIN"
    }
  ],
  "details": {
    "remoteAddress": "0:0:0:0:0:0:0:1",
    "sessionId": null
  },
  "authenticated": true,
  "principal": {
    "password": null,
    "username": "admin",
    "authorities": [
      {
        "authority": "ROLE_ADMIN"
      }
    ],
    "accountNonExpired": true,
    "accountNonLocked": true,
    "credentialsNonExpired": true,
    "enabled": true
  },
  "credentials": null,
  "name": "admin"
}

可以發現切換回來了，是不是非常神奇，太強大了，以后線上排查問題之類的，非常方便，爽歪歪了簡直

異常情況

如果你切換了不存在的用戶，則報

This application has no explicit mapping for /error, so you are seeing this as a fallback.

Sat Dec 16 14:36:28 CST 2017
There was an unexpected error (type=Unauthorized, status=401).
Authentication Failed: demoUser2

SwitchUserFilter是個強大的filter，非常方便測試環境進行調試、測試，甚至可以用來進行上線問題排查。