java - 使用 spring security 登录无效

Question

我正在尝试使用 spring security 进行登录，但它不起作用，因为它返回给我这个链接:http://localhost:8080/login?error并在主页上举报我:这是代码:

静态页面中的索引，它重新链接我:

<a href="login">LogIn</a>

在模板中我有这个:

<h2>Digita il tuo username e la tua password per accedere al sistema </h2>
                <form th:action="@{/login}" method="post" th:object="${responsabile}">
                    <div class="field half first">
                        <label for="name"><span class="icon fa-user"></span>Username:</label>
                        <input name="name" id="username" type="text" placeholder="Username" th:field="*{nomeUtente}"/>
                    </div>
                    <div class="field half">
                        <label for="email"><span class="icon fa-code"></span> Password:</label>
                        <input name="email" id="email" type="password" placeholder="Password" th:field="*{chiaveAccesso}"/>
                    </div>
                    <ul class="actions">
                        <li><input value="Login" class="button" type="submit"/></li>
                    </ul>
                </form>     

捕获它的请求映射就在那里:

        package it.uniroma3.controller;

    import it.uniroma3.model.Centro;
    import it.uniroma3.model.Responsabile;
    import it.uniroma3.service.CentroService;
    import it.uniroma3.service.ResponsabileService;
    import org.springframework.beans.factory.annotation.Autowired;
    import org.springframework.security.core.Authentication;
    import org.springframework.security.core.context.SecurityContextHolder;
    import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
    import org.springframework.stereotype.Controller;
    import org.springframework.ui.Model;
    import org.springframework.web.bind.annotation.ModelAttribute;
    import org.springframework.web.bind.annotation.RequestMapping;
    import org.springframework.web.bind.annotation.RequestMethod;
    import org.springframework.web.bind.annotation.RequestParam;

    import javax.servlet.http.HttpSession;
    import javax.validation.Valid;

    @Controller
    public class LoginController {

        @Autowired
        private ResponsabileService responsabileService;
        @Autowired
        private CentroService centroService;

        @RequestMapping("/login")
        public String login(Model model) {
            model.addAttribute("responsabile", new Responsabile());
            return "login";
        }

        @RequestMapping("/role")
        public String loginRole(HttpSession session, Model model) {
            Authentication auth = SecurityContextHolder.getContext().getAuthentication();
            String role = auth.getAuthorities().toString();
            Responsabile responsabile = this.responsabileService.findByNomeUtente(auth.getName());

            String targetUrl = "";
            if(role.contains("RESPONSABILE")) {
                session.setAttribute("responsabile", responsabile);
                Centro centro=this.centroService.findById(responsabile.getCentro().getId());
                session.setAttribute("centro", centro);
                model.addAttribute("username",responsabile.getNomeUtente());
                targetUrl = "/responsabile/respPanel";
            } else if(role.contains("DIRETTORE")) {
                session.setAttribute("responsabile", responsabile);
                model.addAttribute("username", responsabile.getNomeUtente());
                targetUrl = "/direttore/direttorePanel";
            }

            return targetUrl;
        }





    }

我喜欢支持那个类:

@Entity

公共(public)课责任{

@Id
@GeneratedValue(strategy=GenerationType.AUTO)
private Long id;

@Column(nullable=false)
private String nome;

@Column(nullable=false)
private String cognome;

@Column(nullable=false, unique=true)
private String nomeUtente;

@Column(nullable=false)
private String chiaveAccesso;

@ManyToOne  //ok
private Azienda azienda;

@OneToOne   //ok
private Azienda aziendadiretta;

@OneToOne(cascade=CascadeType.ALL)
private Centro centro;

@Column(nullable=false)
private String role;

和

        package it.uniroma3.error;

    import org.slf4j.Logger;
    import org.slf4j.LoggerFactory;
    import org.springframework.security.access.AccessDeniedException;
    import org.springframework.security.core.Authentication;
    import org.springframework.security.core.context.SecurityContextHolder;
    import org.springframework.security.web.access.AccessDeniedHandler;
    import org.springframework.stereotype.Component;

    import javax.servlet.ServletException;
    import javax.servlet.http.HttpServletRequest;
    import javax.servlet.http.HttpServletResponse;
    import java.io.IOException;

    // handle 403 page
    @Component
    public class MyAccessDeniedHandler implements AccessDeniedHandler {

        private static Logger logger = LoggerFactory.getLogger(MyAccessDeniedHandler.class);

        @Override
        public void handle(HttpServletRequest httpServletRequest,
                        HttpServletResponse httpServletResponse,
                        AccessDeniedException e) throws IOException, ServletException {

            Authentication auth
                    = SecurityContextHolder.getContext().getAuthentication();

            if (auth != null) {
                logger.info("User '" + auth.getName()
                        + "' attempted to access the protected URL: "
                        + httpServletRequest.getRequestURI());
            }

            httpServletResponse.sendRedirect(httpServletRequest.getContextPath() + "/403");

        }
    }

安全配置类:

            package it.uniroma3.security;

        import org.springframework.beans.factory.annotation.Autowired;
        import org.springframework.beans.factory.annotation.Qualifier;
        import org.springframework.context.annotation.Bean;
        import org.springframework.context.annotation.Configuration;
        import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
        import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
        import org.springframework.security.config.annotation.web.builders.HttpSecurity;
        import org.springframework.security.config.annotation.web.builders.WebSecurity;
        import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
        import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
        import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
        import org.springframework.security.web.access.AccessDeniedHandler;

        import javax.sql.DataSource;

        @Configuration
        @EnableWebSecurity
        @EnableGlobalMethodSecurity(securedEnabled = true)
        public class SecurityConfig extends WebSecurityConfigurerAdapter {

            private final String usersQuery = "SELECT nome_utente,chiave_accesso,TRUE FROM responsabile WHERE nome_utente = ?";
            private final String rolesQuery = "SELECT nome_utente,role FROM responsabile WHERE nome_utente = ?";

            @Qualifier("dataSource")
            @Autowired
            private DataSource dataSource;

            @Autowired
            private AccessDeniedHandler accessDeniedHandler;

            @Bean
            public BCryptPasswordEncoder bCryptPasswordEncoder() {
                return new BCryptPasswordEncoder();
            }

            @Override
            protected void configure(AuthenticationManagerBuilder auth) throws Exception {
                auth.jdbcAuthentication().dataSource(dataSource)
                        .passwordEncoder(new BCryptPasswordEncoder())
                        .usersByUsernameQuery(usersQuery)
                        .authoritiesByUsernameQuery(rolesQuery);
            }

            @Override
            protected void configure(HttpSecurity http) throws Exception {
                http
                        .csrf().disable()
                        .authorizeRequests()
                        .antMatchers("/", "/index", "/login").permitAll()
                        .antMatchers("/**").hasRole("DIRETTORE")
                        .antMatchers("/**").hasRole("RESPONSABILE")
                        .anyRequest().permitAll()
                        .anyRequest().authenticated()
                        .and()
                        .formLogin()
                        .loginPage("/login")
                        .defaultSuccessUrl("/role")
                        .and()
                        .logout()
                        .logoutSuccessUrl("/login")
                        .permitAll()
                        .and()
                        .exceptionHandling().accessDeniedHandler(accessDeniedHandler);
            }


            @Autowired
            public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
                auth.jdbcAuthentication().dataSource(dataSource)
                        .passwordEncoder(bCryptPasswordEncoder())
                        .usersByUsernameQuery(usersQuery)
                        .authoritiesByUsernameQuery(rolesQuery);
            }

            //Spring Boot configured this already.
            @Override
            public void configure(WebSecurity web) {
                web
                        .ignoring()
                        .antMatchers("/static/**","/assets/**","/images/**" );
            }

            /*
            @Autowired
            public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
                auth
                        .inMemoryAuthentication()
                        .withUser("superadmin").password("superadmin").roles("SUPERADMIN");
            }
            */

        }

日志:在 6.958 秒内启动 ProgettoSiwApplication(JVM 运行时间为 7.964)2018-06-21 12:55:36.453 INFO 13584 --- [nio-8080-exec-1] o.a.c.c.C.[Tomcat].[localhost].[/]:初始化 Spring FrameworkServlet 'dispatcherServlet'2018-06-21 12:55:36.453 INFO 13584 --- [nio-8080-exec-1] o.s.web.servlet.DispatcherServlet:FrameworkServlet 'dispatcherServlet':初始化开始2018-06-21 12:55:36.487 INFO 13584 --- [nio-8080-exec-1] o.s.web.servlet.DispatcherServlet:FrameworkServlet 'dispatcherServlet':初始化在 34 毫秒内完成

Answer 1

请将安全配置类更改为这样。

@Override
    protected void configure(HttpSecurity http) throws Exception {
        http
                .authorizeRequests()
                .antMatchers("/", "/home").permitAll()
                .anyRequest().authenticated()
                .and()
                .formLogin()
                .loginPage("/login")
                .defaultSuccessUrl("/role")
                .permitAll()
                .and()
                .logout()
                .permitAll();
    }
@Bean
@Override
public UserDetailsService userDetailsService() {
    UserDetails user =
            User.withDefaultPasswordEncoder()
                    .username("user")
                    .password("password")
                    .roles("USER")
                    .build();

    return new InMemoryUserDetailsManager(user);
}


<!DOCTYPE html>
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:th="http://www.thymeleaf.org"
      xmlns:sec="http://www.thymeleaf.org/thymeleaf-extras-springsecurity3">
<head>
    <title>Spring Security Example </title>
</head>
<body>
<!--<div th:if="${param.error}">
    Invalid username and password.
</div>
<div th:if="${param.logout}">
    You have been logged out.
</div>-->
<form th:action="@{/login}" method="post">
    <div><label> User Name : <input type="text" name="username"/> </label></div>
    <div><label> Password: <input type="password" name="password"/> </label></div>
    <div><input type="submit" value="Sign In"/></div>
</form>
</body>
</html>

在这里找到工作代码https://gitlab.com/supun/spring-boot-app/commit/be2f0f723f5aec728bcaf777325fb1899d878f8f