angularjs - Facebook 登录后 (javascript sdk) - 如何在 Spring-Security 中创建用户 session ？

Question

我在用:
- Facebook-JavaScript-SDK(用于登录)
- Angular-JS(前端)
- Spring-Security(服务器安全层)
- Spring MVC(服务器 MVC)

用户可以通过以下方式登录我的网络应用程序
(A) 要么使用 Facebook 登录(在 javascript FB SDK 中实现)要么
(B) 通过普通的用户名/密码形式。

(B)的情况
我做了一个带有字段的表单发布:

j_username
j_password

to /j_spring_security_check (Spring Security)

这工作正常。

但是在(A)的情况下，用户通过FB(在前端)登录后，
我需要做什么才能让 Spring Security 为用户创建 session ？
此时我所拥有的只是 facebook 用户与我的电子邮件，服务器不知道前端的此登录。

Answer 1

成功登录Face Book后，您应该向您的后端API发出AJAX请求，并为用户创建有关Face book身份验证的数据库条目。

1)您需要从 Spring-Security 实现 UserDetailsS​​ervice

@Component
public class CustomUserDetailsService implements UserDetailsService {

@Override
public UserDetails loadUserByUsername(String userEmail) throws UsernameNotFoundException {
    // check for Facebook authentication(DB Entry)
    // fetch user details and roles from db using e-mail
    SimpleGrantedAuthority authority = new SimpleGrantedAuthority(roles);

    UserDetails usd = new User(userId, userId, grantedAuths);
    return usd;

}

}

2) 实现自定义身份验证提供程序

@Component("customAuthenticationProvider")

public class CustomAuthenticationProvider implements AuthenticationProvider {

    @Autowired
    private CustomUserDetailsService customUserDetailsService;

    @Override
    public Authentication authenticate(Authentication authentication) throws AuthenticationException {
        String userId = authentication.getName();
        String password = authentication.getCredentials().toString();

        UserDetails userFromDB = customUserDetailsService.loadUserByUsername(userId);

        if (userFromDB != null) {

            List<GrantedAuthority> grantedAuths = new ArrayList<GrantedAuthority>();
            for (GrantedAuthority auth : userFromDB.getAuthorities()) {
                grantedAuths.add(auth);
            }

            if (grantedAuths.size() != 0) {
                System.out.println("user:" + userId + " got auth from custom auth provider");
                return new UsernamePasswordAuthenticationToken(userFromDB, password, grantedAuths);

            } else {
                throw new DisabledException("No roles assigned");
            }

        }

        throw new DisabledException("User or password incorrect");

    }

    @Override
    public boolean supports(Class<?> authentication) {
        return authentication.equals(UsernamePasswordAuthenticationToken.class);
    }
}

3) 登录 Controller

@Controller
public class LoginController {

    @Autowired
    private CustomAuthenticationProvider customAuthenticationProvider;

    @Autowired
    private CustomUserDetailsService customUserDetailsService;

@RequestMapping(value = "/login",           )
public ResponseEntity<Object> fbLogin(@RequestParam String userEmail,  HttpServletRequest request) {

  UserDetails   userDetails=customUserDetailsService.loadUserByUsername(userid);

            UsernamePasswordAuthenticationToken token = new UsernamePasswordAuthenticationToken(userDetails, userid);
            token.setDetails(new WebAuthenticationDetails(request));
            Authentication authentication = this.customAuthenticationProvider.authenticate(token);

}
}

4) Spring 安全配置

@Configuration
@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

@Autowired
private CustomAuthenticationProvider authProvider;  

 @Override
 protected void configure(AuthenticationManagerBuilder auth) throws Exception {
    auth.authenticationProvider(authProvider);
    }
}