多因素认证是一种实现安全访问控制的常见方法，基本的设计理念在于，用户如果想要访问最终的资源，至少需要通过两种认证机制 一种常见的做法是分成两个步骤实现，第一步通过用户名和密码获取一个认证码（Authentication Code），第二步基于用户名和该认证码进行安全访问 下面我们基于这种思想，搭建一个多因素认证系统。可以借助上两集的用户体系上进行修改 数据库中新建一个表auth_code , 其对应的实体类如下所示 package com. kai. oauth. securityservice. entity ; import lombok. Data ; @Data public class AuthCode { private String id; private String username; private String code; } 新建AuthController，并暴露两个端点 /user/auth 和 /authcode/check package com. kai. oauth. securityservice. controller ; import com. kai. oauth. securityservice. entity. AuthCode ; import com. kai. oauth. securityservice. entity. User ; import com. kai. oauth. securityservice. service. UserService ; import org. springframework. beans. factory. annotation. Autowired ; import org. springframework. web. bind. annotation. PostMapping ; import org. springframework. web. bind. annotation. RequestBody ; import org. springframework. web. bind. annotation. RestController ; import javax. servlet. http. HttpServletResponse ; import java. util. HashMap ; import java. util. Map ; @RestController public class AuthController { @Autowired private UserService userService; //基于用户名和密码的认证，返回authcode @PostMapping ( "/user/auth" ) public Map < String , String > userAuth ( @RequestBody User user) { String authcode= userService. userAuth ( user) ; Map < String , String > = new HashMap < > ( ) ; map. put ( "authcode" , authcode) ; return map; } //基于用户名和authcode的认证 @PostMapping ( "/authcode/check" ) public void codeAuth ( @RequestBody AuthCode authCode, HttpServletResponse response) { if ( userService. codeAuth ( authCode) ) { response. setStatus ( HttpServletResponse . SC_OK ) ; } else { response. setStatus ( HttpServletResponse . SC_FORBIDDEN ) ; } } } 上诉代码中的 userService.userAuth(user) 与 userService.codeAuth(authCode) 方法具体实现如下所示 package com. kai. oauth. securityservice. service ; import com. kai. oauth. securityservice. entity. AuthCode ; import com. kai. oauth. securityservice. entity. User ; import com. kai. oauth. securityservice. mapper. AuthCodeMapper ; import com. kai. oauth. securityservice. mapper. UserMapper ; import org. springframework. beans. factory. annotation. Autowired ; import org. springframework. security. authentication. BadCredentialsException ; import org. springframework. security. crypto. password. PasswordEncoder ; import org. springframework. stereotype. Service ; import java. util. UUID ; @Service public class UserService { @Autowired private UserMapper userMapper; @Autowired private AuthCodeMapper authCodeMapper; @Autowired private PasswordEncoder passwordEncoder; //基于用户名与密码的认证实现 public String userAuth ( User user) { //根据username查询用户信息 User u= userMapper. selectByUserName ( user. getUsername ( ) ) ; if ( u!= null ) { //验证密码是否匹配 if ( passwordEncoder. matches ( user. getPassword ( ) , u. getPassword ( ) ) ) { //密码匹配后生成authcode，并返回 String authCode= generateOrRenewAuthCode ( u) ; return authCode; } else { throw new BadCredentialsException ( "Bad credentials" ) ; } } else { throw new BadCredentialsException ( "Bad credentials" ) ; } } //基于用户名与authcode的认证实现 public boolean codeAuth ( AuthCode authCode) { //通过username查询auth_code表数据 AuthCode code= authCodeMapper. findAuthCodeByUsername ( authCode. getUsername ( ) ) ; if ( code!= null ) { //判断code与auth_code表的code是否一致 if ( authCode. getCode ( ) . equals ( code. getCode ( ) ) ) { return true ; } } return false ; } //生成authcode方法 private String generateOrRenewAuthCode ( User user) { //随机生成一个uuid当做authcode String generatedCode= UUID . randomUUID ( ) . toString ( ) . replaceAll ( "-" , "" ) ; //根据username查询auth_code表数据 AuthCode authCode= authCodeMapper. findAuthCodeByUsername ( user. getUsername ( ) ) ; //没有数据就新增一条，有则更新 if ( authCode!= null ) { authCode. setCode ( generatedCode) ; authCodeMapper. updateAuthCode ( authCode) ; } else { AuthCode code= new AuthCode ( ) ; code. setId ( UUID . randomUUID ( ) . toString ( ) . replaceAll ( "-" , "" ) ) ; code. setUsername ( user. getUsername ( ) ) ; code. setCode ( generatedCode) ; authCodeMapper. insertAuthCode ( code) ; } return generatedCode; } } 关于AuthCode的查询代码如下所示 package com. kai. oauth. securityservice. mapper ; import com. kai. oauth. securityservice. entity. AuthCode ; import org. apache. ibatis. annotations. Mapper ; @Mapper public interface AuthCodeMapper { AuthCode findAuthCodeByUsername ( String username) ; void insertAuthCode ( AuthCode authCode) ; void updateAuthCode ( AuthCode authCode) ; } AuthCodeMapper.xml 如下所示 < ? xml version= "1.0" encoding= "UTF-8" ? > < ! DOCTYPE mapperPUBLIC "-//mybatis.org//DTD Mapper 3.0//EN" "http://mybatis.org/dtd/mybatis-3-mapper.dtd" > < mapper namespace= "com.kai.oauth.securityservice.mapper.AuthCodeMapper" > < resultMap id= "authCodeResultMap" type= "com.kai.oauth.securityservice.entity.AuthCode" > < id property= "id" column= "id" / > < result property= "username" column= "username" / > < result property= "code" column= "code" / > < / resultMap> < select id= "findAuthCodeByUsername" resultMap= "authCodeResultMap" > select* from auth_code where username= #{ username} < / select> < insert id= "insertAuthCode" parameterType= "com.kai.oauth.securityservice.entity.AuthCode" > insert into auth_codevalues ( #{ id} , #{ username} , #{ code} ) < / insert> < update id= "updateAuthCode" parameterType= "com.kai.oauth.securityservice.entity.AuthCode" > UPDATE auth_codeSET code= #{ code} WHERE username= #{ username} < / update> < / mapper> 修改MyWebSecurityConfigAdapter，把/user/auth 和 /authcode/check 端点设置成无需认证 protected void configure ( HttpSecurity http) throws Exception { http. csrf ( ) . disable ( ) . httpBasic ( ) ; //任何请求都无需认证 http. authorizeRequests ( ) . anyRequest ( ) . permitAll ( ) ; } 现在用postman来测试一下这两个端点，先来试试访问/user/auth端点，生成authcode 利用生成的authcode值 ，来访问/authcode/check端点，可以看到返回的status状态码是200，而非403，说明走的是 response.setStatus(HttpServletResponse.SC_OK); 
)
