java - 获取多个用户进行基本身份验证、Spring Boot 安全性

Question

我有一个用户列表，我想在我的基本身份验证中使用它们。

我的代码目前如下所示:

@Configuration
@EnableWebSecurity
public class BasicAuthConfig extends WebSecurityConfigurerAdapter {

  @Bean
  public PasswordEncoder passwordEncoder(){return new BCryptPasswordEncoder();}
  @Autowired
  private ConfigService configService;
  // Authentication : User --> Roles
  // NoOpPasswordEncoder has been deprecated in Spring security so {noop} is being used to avoid errors
  protected void configure(AuthenticationManagerBuilder auth)
    throws Exception {
    auth.inMemoryAuthentication().passwordEncoder(passwordEncoder())
      .withUser("someuser")
        .password("somepassword")
        .roles("USER");
  }

  // Authorization : Role -> Access
  protected void configure(HttpSecurity http) throws Exception {
    http
      .httpBasic()
        .and().authorizeRequests()
          .antMatchers("/actuator/**")
            .permitAll()
          .antMatchers("/tokenservice/**")
            .hasRole("USER")
          .antMatchers("/")
            .permitAll()
        .and().csrf()
        .disable()
          .headers()
          .frameOptions()
        .and().disable()
          .sessionManagement()
          .sessionCreationPolicy(SessionCreationPolicy.STATELESS);
  }}

我想用我的用户列表中的用户名和密码替换“someuser”和“somepassword”。目前我可以使用 configService.getCOnfigurations().getUsers() 获取列表。用户只有用户名和密码，都是字符串。如何将所有用户名和所有密码放入 .withUser() 中？

**编辑我在配置中做了一个简单的 for 循环，应该可以做到这一点，但是每当我尝试发布到我的 API 时，它都会显示 org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder:99 - 编码的密码看起来不像BCrypt

我使用在线 bcrypt 生成器来生成密码，它们看起来像这样

<?xml version="1.0" encoding="UTF-8"?>
<Configurations>
    <Port>8007</Port>
    <EnableHttps>true</EnableHttps>
    <KeyStorePath>classpath:ssl-server.jks</KeyStorePath>
    <KeyPass>changeit</KeyPass>
    <TokenTtlMillis>15000</TokenTtlMillis>
  <Users Username="user1">
      <Password>$2y$10$.8VQR6tJub5uVdVLByItQO8QYGZVuWPhLuBUTQSDJAvVpLAUmuqZ2</Password>
  </Users>
  <Users Username="user2">
    <Password>$2y$10$r/CQz7PZp5banmSzr9OiDe2Kxrda4BhXIBXvvouRnm1w3M72wLQj.</Password>
  </Users>
</Configurations>

密码就是简单的password和password2

Answer 1

使用 DaoAuthenticationProvider 构建 Claudio 的答案:

@Bean
public DaoAuthenticationProvider authenticationProvider() {
    DaoAuthenticationProvider authenticationProvider = new DaoAuthenticationProvider();
    authenticationProvider.setUserDetailsService(userDetailsService());
    authenticationProvider.setPasswordEncoder(passwordEncoder());
    return authenticationProvider;
}

@Override
protected void configure(AuthenticationManagerBuilder auth)
        throws Exception {
    auth.userDetailsService(userDetailsService())
            .authenticationProvider(authenticationProvider());
}

@Override
protected UserDetailsService userDetailsService() {
    return new MyUserDetailsService();
}

UserDetailsS​​ervice 是代码的真正核心所在。您将提供从 XML 读取的接口(interface)的自定义实现。假设您有一个方法 getPassword(String username):

// Adding this import to demontrate where "User" is coming from
import org.springframework.security.core.userdetails.User;

public class MyUserDetailsService implements UserDetailsService {

    @Override
    public User loadUserByUsername(String username) {
        return new User(username, getPassword(username), Arrays.asList(new SimpleGrantedAuthority("USER")));
    }

    private String getPassword(String username) {
        // Get password from your XML
    }
}

至于您的 BCrypt 问题，password 哈希给了我一个无效的盐修订错误。尝试直接使用您的应用对其进行哈希处理，例如:

public static void main(String[] args) {
    System.out.println(new BCryptPasswordEncoder().encode("password"));
}

或者传入一个文件，每行包含一个密码(使用 Java 8):

public static void main(String[] args) throws IOException {
    if (args.length != 1) {
        System.out.println("Requires 1 parameter that points to a file.");
        System.exit(1);
    }
    File f = new File(args[0]);
    if (!f.isFile()) {
        System.out.println("Not a file: " + f);
        System.exit(1);
    }
    PasswordEncoder encoder = new BCryptPasswordEncoder();
    try (Stream<String> lines = Files.lines(f.toPath())) {
        lines.map(encoder::encode)
                .forEach(System.out::println);
    }
}

这将为您提供 Spring 生成的哈希值，然后您可以将其插入到 XML 中。