如何将UserDetailsService下面的自定义添加到此Spring OAuth2示例中?
UserDetailsService
默认值user和默认值在应用程序password的application.properties文件中定义authserver。
user
password
application.properties
authserver
不过,我想以下自定义添加UserDetailsService到该demo包中的authserver应用程序用于测试目的:
demo
package demo; import java.util.List; import org.springframework.security.core.GrantedAuthority; import org.springframework.security.core.authority.AuthorityUtils; import org.springframework.security.core.userdetails.UserDetails; import org.springframework.security.core.userdetails.UsernameNotFoundException; import org.springframework.security.provisioning.UserDetailsManager; import org.springframework.stereotype.Service; @Service class Users implements UserDetailsManager { @Override public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException { String password; List<GrantedAuthority> auth = AuthorityUtils.commaSeparatedStringToAuthorityList("ROLE_USER"); if (username.equals("Samwise")) { auth = AuthorityUtils.commaSeparatedStringToAuthorityList("ROLE_HOBBIT"); password = "TheShire"; } else if (username.equals("Frodo")){ auth = AuthorityUtils.commaSeparatedStringToAuthorityList("ROLE_HOBBIT"); password = "MyRing"; } else{throw new UsernameNotFoundException("Username was not found. ");} return new org.springframework.security.core.userdetails.User(username, password, auth); } @Override public void createUser(UserDetails user) {// TODO Auto-generated method stub } @Override public void updateUser(UserDetails user) {// TODO Auto-generated method stub } @Override public void deleteUser(String username) {// TODO Auto-generated method stub } @Override public void changePassword(String oldPassword, String newPassword) { // TODO Auto-generated method stub } @Override public boolean userExists(String username) { // TODO Auto-generated method stub return false; } }
如您所见,这UserDetailsService还不autowired是,它故意使用不安全的密码,因为它仅用于测试目的。
autowired
需要什么样的具体变化来进行 GitHub的示例应用程序,以便用户可以登录为username=Samwise与password=TheShire,或username=Frodo用password=MyRing? 是否需要对AuthserverApplication.java其他地方进行更改?
username=Samwise
password=TheShire
username=Frodo
password=MyRing
AuthserverApplication.java
建议:
在春天的OAuth2开发指南说,使用一个GlobalAuthenticationManagerConfigurer配置UserDetailsService全球。但是,使用谷歌搜索这些名称所产生的效果会有所帮助。
GlobalAuthenticationManagerConfigurer
另外,使用内部弹簧安全性INSTEAD OF OAuth的其他应用程序使用以下语法来连接UserDetailsService,但是我不确定如何将其语法调整为当前OP:
@Order(Ordered.HIGHEST_PRECEDENCE) @Configuration protected static class AuthenticationSecurity extends GlobalAuthenticationConfigurerAdapter { @Autowired private Users users; @Override public void init(AuthenticationManagerBuilder auth) throws Exception { auth.userDetailsService(users); } }
我试着用@Autowire里面的OAuth2AuthorizationConfig连接Users到AuthorizationServerEndpointsConfigurer如下:
@Autowire
OAuth2AuthorizationConfig
Users
AuthorizationServerEndpointsConfigurer
@Autowired//THIS IS A TEST private Users users;//THIS IS A TEST @Override public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception { endpoints.authenticationManager(authenticationManager) .accessTokenConverter(jwtAccessTokenConverter()) .userDetailsService(users)//DetailsService)//THIS LINE IS A TEST ; }
但是Spring Boot日志表明Samwise找不到该用户,这意味着该用户UserDetailsService未成功连接。这是Spring Boot日志的相关摘录:
Samwise
2016-04-20 15:34:39.998 DEBUG 5535 --- [nio-9999-exec-9] o.s.s.a.dao.DaoAuthenticationProvider : User 'Samwise' not found 2016-04-20 15:34:39.998 DEBUG 5535 --- [nio-9999-exec-9] w.a.UsernamePasswordAuthenticationFilter : Authentication request failed: org.springframework.security.authentication.BadCredentialsException: Bad credentials
我还能尝试什么?
使用Spring Security开发我的oauth服务器时遇到了类似的问题。我的情况略有不同,因为我想添加一个UserDetailsService以对刷新令牌进行身份验证,但是我认为我的解决方案也会为您提供帮助。
像您一样,我首先尝试UserDetailsService使用指定AuthorizationServerEndpointsConfigurer,但这是行不通的。我不确定这是错误还是设计使然,但是UserDetailsService需要在中设置AuthenticationManager以便各种oauth2类找到它。这为我工作:
AuthenticationManager
@Configuration @EnableWebSecurity public class SecurityConfig extends WebSecurityConfigurerAdapter { @Autowired Users userDetailsService; @Autowired public void configAuthentication(AuthenticationManagerBuilder auth) throws Exception { auth.userDetailsService(userDetailsService); } @Override protected void configure(HttpSecurity http) throws Exception { http.authorizeRequests() // other stuff to configure your security } }
我认为,如果您从第73行开始更改了以下内容,则可能对您有用:
@Override protected void configure(AuthenticationManagerBuilder auth) throws Exception { auth.parentAuthenticationManager(authenticationManager) .userDetailsService(userDetailsService); }
您当然也需要@Autowired Users userDetailsService;在WebSecurityConfigurerAdapter
@Autowired Users userDetailsService;
WebSecurityConfigurerAdapter
我想提及的其他事项: