java - Spring Boot 2 安全基础认证

Question

为什么以下基本安全配置不应用 inMemoryAuthentication() 子句？

@Configuration
@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
            .csrf().disable()
            .httpBasic()
            .and()
            .authorizeRequests()
            .anyRequest().authenticated();
        super.configure(http);
    }

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.inMemoryAuthentication()
            .withUser("username").password("password");
        super.configure(auth);
    }

}

应用初始化后，仍然只有Spring自己默认生成的user，没有username这样的用户。

Answer 1

不要从 void configure(AuthenticationManagerBuilder auth) 调用 super 方法。它将 disableLocalConfigureAuthenticationBldr 标志设置为 true，这会导致您的 AuthenticationManagerBuilder 被忽略。最后，您的 void configure(AuthenticationManagerBuilder auth) 方法应如下所示:

@Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
    auth.inMemoryAuthentication()
            .withUser("username").password("password").roles("USER");
}