Spring Security自定义AuthenticationManager实现手机号/密码双认证

public class CustomAuthenticationProvider implements AuthenticationProvider {  
    private final UserDetailsService userDetailsService;    // 账号密码验证  
    private final PasswordEncoder passwordEncoder;       // 密码加密器  
    private final PhoneNumberUserService phoneNumberUserService; // 手机号验证  
    public CustomAuthenticationProvider(UserDetailsService userDetailsService,  
                                        PasswordEncoder passwordEncoder,  
                                        PhoneNumberUserService phoneNumberUserService) {  
        this.userDetailsService = userDetailsService;  
        this.passwordEncoder = passwordEncoder;  
        this.phoneNumberUserService = phoneNumberUserService;  
    }  
    @Override  
    public Authentication authenticate(Authentication authentication) throws AuthenticationException {  
        String principal = (String) authentication.getPrincipal();  // username:xxx 或 phone:xxx        
        String credentials = (String) authentication.getCredentials(); // 密码或验证码  
        UserDetails userDetails;  
        if (principal.startsWith("username:")) {         // 账号密码登录  
            String username = principal.substring("username:".length());  
            userDetails = userDetailsService.loadUserByUsername(username);  
            if (!passwordEncoder.matches(credentials, userDetails.getPassword())) {  
                throw new BadCredentialsException("密码错误");  
            }  
        } else if (principal.startsWith("phone:")) {         // 手机号登录  
            String phoneNumber = principal.substring("phone:".length());  
            userDetails = phoneNumberUserService.loadUserByPhoneNumber(phoneNumber);         // 这里验证码校验可放在 service 内，也可前置过滤器                      
		else{  
			throw new BadCredentialsException("登录方式不支持");  
		}          
		// 生成已认证令牌  
		UsernamePasswordAuthenticationToken result = new UsernamePasswordAuthenticationToken(userDetails, credentials, userDetails.getAuthorities());  
			result.setDetails(authentication.getDetails());  
		return result;  
        }  
	@Override public boolean supports (Class < ? > authentication){  
		return UsernamePasswordAuthenticationToken.class.isAssignableFrom(authentication);  
	}  
    }  
}

@Service  
@RequiredArgsConstructor  
public class UserDetailsServiceImpl implements UserDetailsService {  
    private final UserMapper userMapper;  
    private final MenuMapper menuMapper;  
    @Override  
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {  
        User user = userMapper.selectOne(new LambdaQueryWrapper<User>().eq(User::getUserName, username));  
        if (user == null) throw new UsernameNotFoundException("用户不存在");  
        List<String> perms = menuMapper.selectPermsByUserId(user.getId());  
        perms.add(user.getRoles()); // 合并角色         
		return new LoginUser(user, perms);  
    }  
}

@Service  
@RequiredArgsConstructor  
public class PhoneNumberUserService {  
    private final UserMapper userMapper;  
    private final MenuMapper menuMapper;  
    private final RedisTemplate<String, String> redisTemplate; // 缓存验证码          
    public UserDetails loadUserByPhoneNumber(String phoneNumber) {       // 1️ 查库         
User user = userMapper.selectOne(new LambdaQueryWrapper<User>().eq(User::getPhonenumber, phoneNumber));  
        if (user == null)  
            throw new RuntimeException("手机号未注册");          // 2️ 查权限         
List<String> perms = menuMapper.selectPermsByUserId(user.getId());  
        perms.add(user.getRoles());          // 3️验证码校验示例（可前置过滤器）       
        //String codeInRedis = redisTemplate.opsForValue().get("SMS:" + phoneNumber);  
        return new LoginUser(user, perms);  
    }  
}

@Configuration  
@EnableWebSecurity  
@RequiredArgsConstructor  
public class SecurityConfig {  
    private final AuthenticationConfiguration authenticationConfiguration;  
  //密码加密器
    @Bean  
    public PasswordEncoder passwordEncoder() {  
        return new BCryptPasswordEncoder();  
    }  
    @Bean  
    public UserDetailsService userDetailsService() {  
        return new UserDetailsServiceImpl();  
    }  
    @Bean  
    public PhoneNumberUserService phoneNumberUserService() {  
        return new PhoneNumberUserService();  
    }  
    @Bean  
    public CustomAuthenticationProvider customAuthenticationProvider() {  
        return new CustomAuthenticationProvider(userDetailsService(), passwordEncoder(), phoneNumberUserService());  
    }  
    @Bean  
    public AuthenticationManager authenticationManager() throws Exception {       
    // 替换默认 AuthenticationManager
    return new ProviderManager(customAuthenticationProvider());  
    }  
}

@RestController  
@RequestMapping("/auth")  
@RequiredArgsConstructor  
public class AuthController {  
    private final AuthenticationManager authenticationManager;  
    private final RedisTemplate<String, Object> redisTemplate;  
    @PostMapping("/login")  
    public Result login(@RequestBody LoginDTO dto) {  
        String principal = dto.getLoginType() == 1 ? "username:" + dto.getUsername() : "phone:" + dto.getPhone();  
        UsernamePasswordAuthenticationToken token = new UsernamePasswordAuthenticationToken(principal, dto.getCredential());  
        Authentication authenticate = authenticationManager.authenticate(token);  
        LoginUser loginUser = (LoginUser) authenticate.getPrincipal();  
        String jwt = JwtUtil.createJWT(loginUser.getUser().getId().toString());  
        redisTemplate.opsForValue().set("login:" + loginUser.getUser().getId(), loginUser);  
        return Result.OK("登录成功", Map.of("token", jwt));  
    }  
}