#2. SecurityBuilder 와 SecurityConfigurer

1. 개념

SecurityBuilder: 보안을 구성하는 빈 객체와 설정클래스 생성

SecurityConfigurer: 보안처리를 담당하는 필터 생성 및 초기화 설정

 

SecurityBuilder 는 SecurityConfigurer 를 참조

 

2. 구체적으로 보기

SecurityBuilder.class 는 build() 메소드 가짐

SecurityConfigurer.class 는 init(), configure 메소드를 가지고 있다 인자는 SecurityBuilder 를 받는다

 

(1) HttpSecurityConfiguration.class

 @Bean({"org.springframework.security.config.annotation.web.configuration.HttpSecurityConfiguration.httpSecurity"})
  @Scope("prototype")
  HttpSecurity httpSecurity() throws Exception {
    LazyPasswordEncoder passwordEncoder = new LazyPasswordEncoder(this.context);
    AuthenticationManagerBuilder authenticationBuilder = new DefaultPasswordEncoderAuthenticationManagerBuilder(this.objectPostProcessor, passwordEncoder);
    authenticationBuilder.parentAuthenticationManager(this.authenticationManager());
    authenticationBuilder.authenticationEventPublisher(this.getAuthenticationEventPublisher());
    HttpSecurity http = new HttpSecurity(this.objectPostProcessor, authenticationBuilder, this.createSharedObjects());
    WebAsyncManagerIntegrationFilter webAsyncManagerIntegrationFilter = new WebAsyncManagerIntegrationFilter();
    webAsyncManagerIntegrationFilter.setSecurityContextHolderStrategy(this.securityContextHolderStrategy);
    http
    .csrf(Customizer.withDefaults())
    .addFilter(webAsyncManagerIntegrationFilter)
    .exceptionHandling(Customizer.withDefaults())
    .headers(Customizer.withDefaults())
    .sessionManagement(Customizer.withDefaults())
    .securityContext(Customizer.withDefaults())
    .requestCache(Customizer.withDefaults())
    .anonymous(Customizer.withDefaults())
    .servletApi(Customizer.withDefaults()).apply(new DefaultLoginPageConfigurer());
    http.logout(Customizer.withDefaults());
    this.applyCorsIfAvailable(http);
    this.applyDefaultConfigurers(http);
    return http;
  }

HttpSecurity bean 객체 생성

csrf -> CsrfConfigurer

exceptionHandling -> ExceptionHandlingConfigurer

...

이런 설정 클래스가 생성되면서 두 가지 메소드(init,configure)가 초기화 과정에서 실행된다 여기서 여러 인증 인가 작업을 하게 된다

이 빈객체를 받아서 초기화 작업을하는 곳이 있는데 아래 SpringBootWebSecurityConfiguration class 의 메소드 인자로 가게 된다

 @ConditionalOnDefaultWebSecurity
  static class SecurityFilterChainConfiguration {
    SecurityFilterChainConfiguration() {
    }

    @Bean
    @Order(2147483642)
    SecurityFilterChain defaultSecurityFilterChain(HttpSecurity http) throws Exception {
      http.authorizeHttpRequests((requests) -> ((AuthorizeHttpRequestsConfigurer.AuthorizedUrl)requests.anyRequest()).authenticated());
      http.formLogin(Customizer.withDefaults());
      http.httpBasic(Customizer.withDefaults());
      return (SecurityFilterChain)http.build();
    }
  }

 

이후 AbstractSecurityBuilder.class build 메소드를 타고

AbstractConfiguredSecurityBuilder.class doBuild 를 탄다

 protected final O doBuild() throws Exception {
    synchronized(this.configurers) {
      this.buildState = AbstractConfiguredSecurityBuilder.BuildState.INITIALIZING;
      this.beforeInit();
      this.init();
      this.buildState = AbstractConfiguredSecurityBuilder.BuildState.CONFIGURING;
      this.beforeConfigure();
      this.configure();
      this.buildState = AbstractConfiguredSecurityBuilder.BuildState.BUILDING;
      O result = (O)this.performBuild();
      this.buildState = AbstractConfiguredSecurityBuilder.BuildState.BUILT;
      return result;
    }
  }

초기화작업 -> 설정 -> 빌딩 -> 빌트(생성)

초기화 메서드

private void init() throws Exception {
    for(SecurityConfigurer<O, B> configurer : this.getConfigurers()) {
      configurer.init(this);
    }

    for(SecurityConfigurer<O, B> configurer : this.configurersAddedInInitializing) {
      configurer.init(this);
    }

  }