Spring Security 四种添加用户的方式

柔光的暖阳◎ 2024-04-17 06:24 81阅读 0赞

### 添加用户 ###

*  （一）简单的默认配置
 *  （二）创建用户
 *   *  （1）inMemoryAuthentication 用户放在内存中
     *  （2）jdbcAuthentication 用户放在数据库中
     *   *  （2.1）如果使用security默认的表结构
         *  （2.2）使用自己的表结构
     *  （3）ldapAuthentication
     *  （4）userDetailsService 自定义

官网： https://spring.io/projects/spring-security  
https://spring.io/guides/topicals/spring-security-architecture/  
https://spring.io/guides/gs/securing-web/  
参考书籍：springboot实战（我的书是基于4.X的，例子有些旧，已经不适用）

> Spring Security is a powerful and highly customizable authentication and access-control framework. It is the de-facto standard for securing Spring-based applications.  
> 认证与访问控制框架  
> Spring Security is a framework that focuses on providing both authentication and authorization to Java applications. Like all Spring projects, the real power of Spring Security is found in how easily it can be extended to meet custom requirements  
> 为应用提供认证与授权服务

简单的说就是spring security 可以提供一个登陆功能，只有通过验证的用户才能访问（认证）。并且可以设置不同权限的人访问不同的页面（授权）。

# （一）简单的默认配置 #

搭建了一个空的springboot工程，简单的controller和hello.html  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZlbmdxaW5neXVlYmFpMTk_size_16_color_FFFFFF_t_70]  
.pom引入

<dependency>
    			<groupId>org.springframework.boot</groupId>
    			<artifactId>spring-boot-starter-security</artifactId>
    		</dependency>

![在这里插入图片描述][2020032620300165.png]  
启动的时候控制台会打印默认的密码  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZlbmdxaW5neXVlYmFpMTk_size_16_color_FFFFFF_t_70 1]  
访问http://localhost:8081/liviaSecurity/hello 会自动跳转到http://localhost:8081/liviaSecurity/login  
使用user和密码可以登录了

当然我们并不想要用他默认的**登录页面**，**用户信息**也要自己定。

# （二）创建用户 #

> Spring Security provides some configuration helpers to quickly get common authentication manager features set up in your application. The most commonly used helper is the AuthenticationManagerBuilder which is great for setting up in-memory, JDBC or LDAP user details, or for adding a custom UserDetailsService.

添加用户一共有四种方式 in-memory, JDBC or LDAP，UserDetailsService  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZlbmdxaW5neXVlYmFpMTk_size_16_color_FFFFFF_t_70 2]

## （1）inMemoryAuthentication 用户放在内存中 ##

首先我们要新建一个配置文件WebSecurityConfig 继承WebSecurityConfigurerAdapter，重写configure (AuthenticationManagerBuilder auth)方法。

@Configuration
    public class WebSecurityConfig extends WebSecurityConfigurerAdapter { 
        @Bean
        public BCryptPasswordEncoder passwordEncoder() { 
            return new BCryptPasswordEncoder();
        }
        @Override
        protected void configure (AuthenticationManagerBuilder auth) throws Exception{ 
            auth.inMemoryAuthentication().passwordEncoder(new BCryptPasswordEncoder())
                    .withUser("yourName")
                    .password(new BCryptPasswordEncoder().encode("abc"))
                    .roles("ADMIN")
                    .and()
                    .withUser("user")
                    .password(new BCryptPasswordEncoder().encode("abc"))
                    .roles("USER");
        }
    }

这样就可以用yourName/abc来登录系统  
**注意：**

*  java.lang.IllegalArgumentException: There is no PasswordEncoder mapped for the id “null”  
    security5.X 需要添加 **PasswordEncoder** 否则会报错
 *  ROLE\_ADMIN cannot start with ROLE\_ (it is automatically added)  
    roles("ADMIN ") 是用来为用户添加**权限**的默认\*\*ROLE\_\*\*前缀不需要写成ROLE\_ADMIN

如果有spring-boot-autoconfigure包，不用加注解@EnableWebSecurity，如下图  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZlbmdxaW5neXVlYmFpMTk_size_16_color_FFFFFF_t_70 3]

> The WebSecurityConfig class is annotated with @EnableWebSecurity to enable Spring Security’s web security support and provide the Spring MVC integration. It also extends WebSecurityConfigurerAdapter and overrides a couple of its methods to set some specifics of the web security configuration.

如果是springMVC工程的话需要加@EnableWebSecurity  
参考：https://blog.csdn.net/andy\_zhang2007/article/details/90023901

## （2）jdbcAuthentication 用户放在数据库中 ##

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZlbmdxaW5neXVlYmFpMTk_size_16_color_FFFFFF_t_70 4]

### （2.1）如果使用security默认的表结构 ###

如上图位置，我的mysql貌似版本太低调整了一下建表语句如下图创建表 users 和authorities

CREATE TABLE users(username VARCHAR(50) NOT NULL PRIMARY KEY,PASSWORD VARCHAR(500) NOT NULL,enabled BOOLEAN NOT NULL);
    CREATE TABLE authorities (username VARCHAR(50) NOT NULL,authority VARCHAR(50) NOT NULL,CONSTRAINT fk_authorities_users FOREIGN KEY(username) REFERENCES users(username));
    CREATE UNIQUE INDEX ix_auth_username ON authorities (username,authority);

新增用户和权限 密码是abc在BCryptPasswordEncoder加密后的值

INSERT users  VALUES('yourName','$2a$10$6Ed5ZXTH9DNwKzeFU07Ks.jGr3beIjU3o6mi12Jgh4Rh2t0goLbqO',1);
    INSERT users  VALUES('user','$2a$10$6Ed5ZXTH9DNwKzeFU07Ks.jGr3beIjU3o6mi12Jgh4Rh2t0goLbqO',1);
    INSERT authorities VALUES('yourName','ADMIN');
    INSERT authorities VALUES('user','USER');

yml配置数据源，pom添加jar包  
![在这里插入图片描述][20200327161519932.png]  
pom 我平时用的是jpa，这里使用jdbc

<dependency>
    	<groupId>org.springframework.boot</groupId>
    	<artifactId>spring-boot-starter-jdbc</artifactId>
    </dependency>
    <dependency>
    	<groupId>mysql</groupId>
    	<artifactId>mysql-connector-java</artifactId>
    	<version>8.0.18</version>
    </dependency>

@Qualifier("dataSource")
        @Autowired
        private  DataSource datasource;
    
        @Override
        protected void configure (AuthenticationManagerBuilder auth) throws Exception{ 
            auth.jdbcAuthentication().dataSource(datasource);
        }

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZlbmdxaW5neXVlYmFpMTk_size_16_color_FFFFFF_t_70 5]  
查询逻辑如上图所示，参考：  
[https://blog.csdn.net/wangmx1993328/article/details/81834974][https_blog.csdn.net_wangmx1993328_article_details_81834974]  
[https://blog.csdn.net/qq\_41754409/article/details/101115900][https_blog.csdn.net_qq_41754409_article_details_101115900]

### （2.2）使用自己的表结构 ###

但是一般情况下我们的用户表要用自定义的  
假设表结构如下

CREATE TABLE `users1` (
      `username1` VARCHAR(50) NOT NULL,
      `password1` VARCHAR(500) NOT NULL,
      `enabled1` TINYINT(1) NOT NULL,
      `otherColumn` VARCHAR(500) NOT NULL,
      PRIMARY KEY (`username1`)
    ) ENGINE=INNODB DEFAULT CHARSET=utf8;
    
    
    CREATE TABLE `authorities1` (
      `username1` VARCHAR(50) NOT NULL,
      `authority1` VARCHAR(50) NOT NULL,
      `otherColumn` VARCHAR(500) NOT NULL,
      UNIQUE KEY `ix_auth_username` (`username1`,`authority1`),
      CONSTRAINT `fk_authorities_users1` FOREIGN KEY (`username1`) REFERENCES `users1` (`username1`)
    ) ENGINE=INNODB DEFAULT CHARSET=utf8

所以要重写查询的sql语句

@Configuration
    @Slf4j
    public class WebSecurityConfig extends WebSecurityConfigurerAdapter { 
        @Bean
        public BCryptPasswordEncoder passwordEncoder() { 
            return new BCryptPasswordEncoder();
        }
        @Qualifier("dataSource")
        @Autowired
        private  DataSource datasource;
    
        @Override
        protected void configure (AuthenticationManagerBuilder auth) throws Exception{ 
            auth.jdbcAuthentication().dataSource(datasource)
                    .authoritiesByUsernameQuery("select username1,authority1 from authorities1 where username1 = ? ")
                    .usersByUsernameQuery("select username1,password1,enabled1 from users1 where username1 = ?");
        }
    }

## （3）ldapAuthentication ##

对ldap不是很了解，有需要的可以参考 [https://www.cnblogs.com/youcong/p/9386186.html][https_www.cnblogs.com_youcong_p_9386186.html]  
[https://stackoverflow.com/questions/21555280/how-to-use-spring-ldap-authentication][https_stackoverflow.com_questions_21555280_how-to-use-spring-ldap-authentication]  
[https://www.it1352.com/967139.html][https_www.it1352.com_967139.html]

## （4）userDetailsService 自定义 ##

实现UserDetailsService 接口 通过用户名查询用户信息，可以从数据库里查，也可以写在内存中。  
我这里放了一个固定的用户，在之后可以用springcontextholder获取

public class CustomUserService implements UserDetailsService { 
        @Override
        public UserDetails loadUserByUsername(String userName) throws UsernameNotFoundException { 
            if(!"yourName".equals(userName)){ 
                return new UserInfo();
            }
            return new UserInfo(userName);
        }
    }

public class WebSecurityConfig extends WebSecurityConfigurerAdapter { 
        @Bean
        public BCryptPasswordEncoder passwordEncoder() { 
            return new BCryptPasswordEncoder();
        }
        
        @Bean
        UserDetailsService customUserService(){ 
            return new CustomUserService();
        }
    
        @Override
        protected void configure (AuthenticationManagerBuilder auth) throws Exception{ 
            auth.userDetailsService(customUserService()).passwordEncoder(passwordEncoder());
        }
    
    }

自定义一个用户信息，

@Data
    @EqualsAndHashCode(callSuper = false)
    @Accessors(chain = true)
    public class UserInfo implements UserDetails { 
    
        private String username;
    
        private String password;
    
        private String info;
    
        UserInfo(){ 
    
        }
    
        UserInfo(String userName){ 
            this.setUsername(userName);
            this.setPassword(new BCryptPasswordEncoder().encode("abc"));
        }
    
        @Override
        public Collection<? extends GrantedAuthority> getAuthorities() { 
            return null;
        }
        /** * 账户是否过期 * @return */
        @Override
        public boolean isAccountNonExpired() { 
            return true;
        }
    
        /** * 是否禁用 * @return */
        @Override
        public boolean isAccountNonLocked() { 
            return true;
        }
    
        /** * 密码是否过期 * @return */
        @Override
        public boolean isCredentialsNonExpired() { 
            return true;
        }
    
        /** * 是否启用 * @return */
        @Override
        public boolean isEnabled() { 
            return true;
        }
    }

参考：  
[https://blog.csdn.net/linhaibing009/article/details/85147801][https_blog.csdn.net_linhaibing009_article_details_85147801]  
[https://www.bookstack.cn/read/spring-security-tutorial/docs-jpa-userdetailsservice.md][https_www.bookstack.cn_read_spring-security-tutorial_docs-jpa-userdetailsservice.md]

[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZlbmdxaW5neXVlYmFpMTk_size_16_color_FFFFFF_t_70]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/16/632a8493916d4c8fbf1a830a7d857c60.png
[2020032620300165.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/16/ddf062eb0fbd420e93bae164302de8ac.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZlbmdxaW5neXVlYmFpMTk_size_16_color_FFFFFF_t_70 1]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/16/dd8cae0a76d4426b80067a6dde4a4c31.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZlbmdxaW5neXVlYmFpMTk_size_16_color_FFFFFF_t_70 2]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/16/c42227636a0740a99b62d9a6d24e5368.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZlbmdxaW5neXVlYmFpMTk_size_16_color_FFFFFF_t_70 3]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/16/13dc01e517524af8927b6334a1b1554c.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZlbmdxaW5neXVlYmFpMTk_size_16_color_FFFFFF_t_70 4]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/16/8a0a9c1ce10c4412a413b3c5d72014ff.png
[20200327161519932.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/16/37a38a0485db4755ab66da837bbb75b5.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZlbmdxaW5neXVlYmFpMTk_size_16_color_FFFFFF_t_70 5]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/16/971a84e9af284fdbb1586464cfa7d5cc.png
[https_blog.csdn.net_wangmx1993328_article_details_81834974]: https://blog.csdn.net/wangmx1993328/article/details/81834974
[https_blog.csdn.net_qq_41754409_article_details_101115900]: https://blog.csdn.net/qq_41754409/article/details/101115900
[https_www.cnblogs.com_youcong_p_9386186.html]: https://www.cnblogs.com/youcong/p/9386186.html
[https_stackoverflow.com_questions_21555280_how-to-use-spring-ldap-authentication]: https://stackoverflow.com/questions/21555280/how-to-use-spring-ldap-authentication
[https_www.it1352.com_967139.html]: https://www.it1352.com/967139.html
[https_blog.csdn.net_linhaibing009_article_details_85147801]: https://blog.csdn.net/linhaibing009/article/details/85147801
[https_www.bookstack.cn_read_spring-security-tutorial_docs-jpa-userdetailsservice.md]: https://www.bookstack.cn/read/spring-security-tutorial/docs-jpa-userdetailsservice.md