java - 在同一项目中使用内存身份验证和数据库身份验证

Question

我有一个现有项目正在使用 InMemory 身份验证和 Spring Security，现在有一个新要求。现在我们还需要使用基于数据库的身份验证以及内存中身份验证，因为将有两种类型的用户:一种是静态的，另一种是动态添加的；对于动态添加，我们需要使用基于数据库的身份验证。我在不同的项目中使用了基于内存和数据库的身份验证，但在同一项目中并未同时使用这两种身份验证。请建议一些在同一项目上使用两者的解决方案。我正在使用 Spring Boot 2.0.2Release，并且基于 Java 的解决方案是最受欢迎的。

@Configuration
@EnableWebSecurity
@Order(Ordered.HIGHEST_PRECEDENCE)
public class SecurityConfig extends WebSecurityConfigurerAdapter{

    @Value("${admin.username}")
    String user;

    @Value("${admin.password}")
    String password;

    @Value("${superadmin.username}")
    String admin;

    @Value("${superadmin.password}")
    String adminPassword;

    /* (non-Javadoc)
     * @see org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter#configure(org.springframework.security.config.annotation.web.builders.HttpSecurity)
     */
    @Override
    protected void configure(HttpSecurity http) throws Exception {

        http.authorizeRequests()
        .antMatchers("/","/blogs","/support","/index","/pricing","/step-guide","/sales-info","/sales-info/**","/step-guide/**","/blogs/**","/productdetail","/25-point-checklist-for-networking","/thanks-for-downloading-checklist","/events-&-conference",,"/share_profile","/share","/share/**").permitAll()
        .antMatchers("/swagger-ui.html").hasAnyAuthority("ROLE_SUPER_ADMIN")
        .antMatchers("/admin").hasAnyAuthority("ROLE_SUPER_ADMIN","ROLE_ADMIN")
        .antMatchers("/api/**").permitAll()
        .anyRequest().authenticated()       
        .and()
        .formLogin()
        .loginPage("/login").permitAll()
        .successHandler(new AuthenticationSuccessHandler() {

            @Override
            public void onAuthenticationSuccess(HttpServletRequest request, HttpServletResponse response,
                    Authentication authentication) throws IOException, ServletException {
                String currentUsername = authentication.getName();
                if(currentUsername.equals(admin)) {
                    response.sendRedirect(request.getContextPath()+"/admin");
                }
                else if(currentUsername.equals(user))
                {
                    response.sendRedirect(request.getContextPath()+"/swagger-ui.html");
                }
            }

        })
        .and()
        .logout()
        .permitAll()
        .and().csrf().disable();


    }

    /* (non-Javadoc)
     * @see org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter#configure(org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder)
     */
    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {

        auth.inMemoryAuthentication()       
        .withUser(user)
        .password(PasswordUtil.encryptPassword(password))
        .credentialsExpired(false)
        .accountExpired(false)
        .accountLocked(false)       
        .roles("SUPER_ADMIN");

        auth.inMemoryAuthentication()
        .withUser(admin)
        .password(PasswordUtil.encryptPassword(adminPassword))
        .credentialsExpired(false)
        .accountExpired(false)
        .accountLocked(false)
        .roles("ADMIN");
    }

    @Override
    public void configure(WebSecurity web) throws Exception {
        web.ignoring().antMatchers("/resources/**","/webjars/**","/static/**","/css/**","/js/**","/fonts/**","/images/**","/favicon.ico","/swagger-resources/**","/bucket/**");
    }

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }   

}

带有数据库身份验证和自定义身份验证处理程序的代码是:

@Configuration
@EnableWebSecurity
@Order(Ordered.HIGHEST_PRECEDENCE)
public class SecurityConfig extends WebSecurityConfigurerAdapter{

    @Autowired
    PasswordEncoder passwordEncoder;

    @Autowired
    AppUserDetailsService appUserDetailsService;

    @Autowired
    CustomAuthenticationSuccessHandler customAuthenticationSuccessHandler;

    /* (non-Javadoc)
     * @see org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter#configure(org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder)
     */
    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.userDetailsService(appUserDetailsService).passwordEncoder(passwordEncoder);
    }

    /* (non-Javadoc)
     * @see org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter#configure(org.springframework.security.config.annotation.web.builders.WebSecurity)
     */
    @Override
    public void configure(WebSecurity web) throws Exception {
        web.ignoring().antMatchers("/resources/**","/webjars/**","/static/**","/css/**","/js/**","/fonts/**","/images/**","/favicon.ico");
    }

    /* (non-Javadoc)
     * @see org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter#configure(org.springframework.security.config.annotation.web.builders.HttpSecurity)
     */
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests()
        .antMatchers("/").permitAll()
        .antMatchers("/swagger-ui.html").hasAnyAuthority("ROLE_SUPER_ADMIN")
        .antMatchers("/api/user/sign_up").permitAll()
        .antMatchers("/api/user/forgot_password").permitAll()
        .antMatchers("/api/**").authenticated()
        .anyRequest().authenticated()
        .and()
        .formLogin()
        .loginPage("/login").successHandler(customAuthenticationSuccessHandler).permitAll()     
        .and()
        .logout()
        .permitAll()
        .and().csrf().disable().exceptionHandling().accessDeniedPage("/403");
    }

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }

}

所以我想将这两者结合起来，并且根据情况可以有单个登录页面或多个登录页面。

Answer 1

如果您实现 WebSecurityConfigurerAdapter，您将拥有以下内容:

 @Override
 protected void configure(AuthenticationManagerBuilder auth) {

         //   auth.ldapAuthentication()...
        auth.apply(new LdapAuthenticationProviderConfigurer());
        auth.apply(new JdbcUserDetailsManagerConfigurer<>());
        auth.apply(new InMemoryUserDetailsManagerConfigurer<>());
 }

方法 ldapAuthentication() 只是将 LdapAuthenticationProvider 添加到 AbstractConfiguredSecurityBuilder 的配置列表中。只需尝试向 AuthenticationManagerBuilder 添加另一个配置器即可。

示例:

InMemoryUserDetailsManagerConfigurer memprovider = 
    new InMemoryUserDetailsManagerConfigurer();

    memprovider.withUser("admin")
            .credentialsExpired(false)
            .accountExpired(false)
            .accountLocked(false)
            .roles("SUPER_ADMIN");
    auth.apply(memprovider);

这将应用一个新的提供程序。而不是简单地应用第二个:

JdbcUserDetailsManagerConfigurer jdpbProvider = 
    new JdbcUserDetailsManagerConfigurer();
    jdpbProvider.withUser("user").password() ...
    auth.apply(jdpbProvider);

使用 UserDetailService:

 @Autowired
 UserDetailsService appUserDetailsService;

和

 DaoAuthenticationConfigurer daoAC = 
     new DaoAuthenticationConfigurer(appUserDetailsService);
 daoAC.passwordEncoder(passwordEncoder);
 auth.apply(daoAC);