java - 如何在Spring Security中的自定义PasswordEncoder中获取用户名？

Question

我正在现有应用程序中引入 Spring Security。目前 db 有 MD5 编码的密码，我们希望将其迁移到 bcrypt。由于我们最初拥有大量用户，因此我们希望同时支持 MD5 和 bcrypt。我们考虑过建立一个表来存储有多少用户迁移到 bcrypt，一旦我们将所有用户迁移到 bcrypt，我们将停止支持 MD5。

所以我想到扩展 SpringSecurity 的 BCryptPasswordEncoder 类并在 matches 方法中执行操作。所以我有下面的类(class)，

import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;

public class CustomPasswordEncoder extends BCryptPasswordEncoder {

    @Override
    public boolean matches(CharSequence rawPassword, String encodedPassword) {
        if (rawPassword == null || encodedPassword == null) {
            return false;
        }

        if (!super.matches(rawPassword, encodedPassword)) { // This is not BCrypt password try OLD password encoding instead
            boolean isOldPasswordMatched = rawPassword.equals(SHA1.getSHA1Hash(encodedPassword));
            if(isOldPasswordMatched){
                migrateToBCrypt(userName /* error here*/, encode(rawPassword));
            }
            return isOldPasswordMatched;
        }
        return true;
    }

    private boolean migrateToBCrypt(String userName, String newBcryptPassword){
        //update password in database 
        //Insert to migrated table
        return true;
    } 
}

但是我的问题是我没有在此函数内获取用户名来进行迁移，如何在密码编码器的 matches() 内获取用户名？我在这里做错了什么吗？在这种情况下最好的方法是什么？

Answer 1

建议的逻辑只是我的想法，您可以根据您的需要进行修改。

public class UserService extends BCryptPasswordEncoder{

    public Response login(@RequestBody User user){

        User existingUser = UserDao.getInstance().getUserByUsername( user.getUsername() );

        //Assuming all the users have `PasswordType` column as "MD5" in user table
        if( existingUser.getPasswordType().equals("MD5") ){
                // Your MD5 verification method, return boolean
            if( verifyMD5(user.getPassword, existingUser.getPassword()) ){
                 migrateToBCrypt(existingUser, user);
                 return Response.status(200).entity("Successfully Logged in").build();
            }else{
                 return Response.status(400).entity("Invalid Credentials").build();
            }

        }else if( existingUser.getPasswordType().equals("BCrypt") ){

            if( matches(user.getPassword(), existingUser.getPassword()) ){
                return Response.status(200).entity("Successfully Logged in").build();
            }else{
                return Response.status(400).entity("Invalid Credentials").build();
            }

        }

    }

    private void migrateToBcrypt(User existingUser, User user){

        existingUser.setPassword( encode(user.getPassword()) );
        existingUser.setPasswordType( "Bcrypt" );
        UserDao.getInstance().updateUser( existingUser );

    }

}

或者，如果您不想在表格上引入另一列，

public class UserService extends BCryptPasswordEncoder{

    public Response login(@RequestBody User user){

        User existingUser = UserDao.getInstance().getUserByUsername( user.getUsername() );

        if( !existingUser.getPassword().startsWith("$") ){
                // Your MD5 verification method, return boolean
            if( verifyMD5(user.getPassword, existingUser.getPassword()) ){
                 migrateToBCrypt(existingUser, user);
                 return Response.status(200).entity("Successfully Logged in").build();
            }else{
                 return Response.status(400).entity("Invalid Credentials").build();
            }

        }else {

            if( matches(user.getPassword(), existingUser.getPassword()) ){
                return Response.status(200).entity("Successfully Logged in").build();
            }else{
                return Response.status(400).entity("Invalid Credentials").build();
            }

        }

    }

    private void migrateToBcrypt(User existingUser, User user){

        existingUser.setPassword( encode(user.getPassword()) );
        UserDao.getInstance().updateUser( existingUser );

    }

}