java - Spring 安全。添加用户登录限制

Question

我有以下 spring 安全配置:

<http auto-config="true" authentication-manager-ref="userAuthenticationManager">
        <form-login login-page="/" 
            default-target-url="/member/personalAccount"
            authentication-failure-url="/loginfailed" authentication-success-handler-ref="authSuccessHandler" />

        <!-- <intercept-url pattern="/common/*" filters="none" /> -->
        <intercept-url ..../>
        <logout logout-url="/logout" logout-success-url="/" />
        <port-mappings>
         <port-mapping http="${http.port}" https="${https.port}"/>
        </port-mappings>
    </http>

    ....


    <authentication-manager alias="userAuthenticationManager">
        <!-- <authentication-provider user-service-ref="userSecurityService"> -->
        <authentication-provider>
            <password-encoder ref="encoder" />
            <jdbc-user-service data-source-ref="dataSource" 
                users-by-username-query="select email,password,prop_was_moderated from terminal_user where email = ?"  
                authorities-by-username-query="select email,user_role from terminal_user where email = ?" />
        </authentication-provider>
    </authentication-manager>

现在我想向 terminal_user 表添加新列。此列名为 prop_confirmed

我想实现只有prop_confirmed为true的用户才能登录。

你能帮我实现它吗？

Answer 1

一种方法是在 users-by-username-query 中硬编码 prop_confirmed 条件。这样，如果用户未得到确认，就会如同他们不存在一样，身份验证将失败:

select email,password,prop_was_moderated from terminal_user
    where email = ? AND prop_confirmed = TRUE

还有其他(可能更干净的)解决方案，例如自定义 AuthenticationManager。看看我的SO answer关于类似问题以获取这些选项的更详细描述。