Spring Security(3.2)BCrypt没有对登录时的密码进行哈希处理

Question

我试图用MySQL中的一个数据库在Spring Web应用程序登录中训练哈希，但当我引入正确的密码时，登录名总是用？error=true再次发送我到登录名。

我确定，如果我把我在表'users'中的密码（即散列密码）准确地放入，我就可以正确地访问主页。由于项目的规范，所有的配置都是在XML文件中进行的。我是Spring的新手，我无法确定上下文文件中的错误在哪里。我使用两个身份验证提供者，但我只需要在其中一个中使用BCrypt enconder。

null

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
       xmlns:security="http://www.springframework.org/schema/security"
       xmlns:c="http://www.springframework.org/schema/c"
       xsi:schemaLocation="http://www.springframework.org/schema/beans 
       http://www.springframework.org/schema/beans/spring-beans-3.2.xsd
       http://www.springframework.org/schema/security 
       http://www.springframework.org/schema/security/spring-security-3.2.xsd">

<!--    Rutas que se ignoraran  -->
<security:http pattern="/css/**" security="none"/>
<security:http pattern="/assets/**" security="none"/>
<security:http pattern="/img/**" security="none"/>
<security:http pattern="/js/**" security="none"/>
<security:http pattern="/login*" security="none"/>
<security:http pattern="/recovery/*" security="none"/>
<security:http pattern="/recovery/initRecovery/*" security="none"/>

<security:http pattern="/lock*" use-expressions="true" auto-config="true">
     <security:intercept-url pattern="/lock*" access="permitAll" />
</security:http>


<security:http  
    auto-config="true" use-expressions="true"  
    authentication-manager-ref="authenticationManager" 
    access-denied-page="/denegado" >
    <security:intercept-url pattern="/**" access="isAuthenticated()" />
    <security:form-login login-page="/login" default-target-url="/init" authentication-failure-url="/loginfailed" />
    <security:logout invalidate-session="true" logout-success-url="/" />
</security:http>

<bean id="encoder" class="org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder">
    <constructor-arg name="strength" value="10" />
</bean>

<bean id="authenticationProviderCrece" 
      class="org.springframework.security.authentication.dao.DaoAuthenticationProvider">
    <property name="userDetailsService" ref="userDetailsServicecrece"/>
</bean>


<bean id="authenticationProviderSac" 
      class="org.springframework.security.authentication.dao.DaoAuthenticationProvider">
    <property name="userDetailsService" ref="userDetailsServicesac"/>
</bean>


<bean id="authenticationManager"
    class="org.springframework.security.authentication.ProviderManager">
  <property name="providers">
    <list>
      <ref local="authenticationProviderCrece"/>
      <ref local="authenticationProviderSac"/>
    </list>
  </property>
</bean>

<security:authentication-manager>
    <security:authentication-provider user-service-ref="userDetailsServicecrece"/>
    <security:authentication-provider user-service-ref="userDetailsServicesac">
        <security:password-encoder ref="encoder"/>
    </security:authentication-provider>
</security:authentication-manager>

usuariosDetailsServiceImpl.java

package com.segurosargos.sac.service.impl;

import java.util.ArrayList;
import java.util.Collection;

import javax.annotation.Resource;

import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.authority.SimpleGrantedAuthority;
import org.springframework.security.core.userdetails.User; 
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.core.userdetails.UsernameNotFoundException;
import org.springframework.stereotype.Service;

import com.segurosargos.sac.modelo.entidad.Usuario;
import com.segurosargos.sac.service.UsuarioService;

@Service("userDetailsServicesac")
public class UsuariosDetailsServiceImpl implements UserDetailsService {

@Resource
private UsuarioService usuarioService;

   @Override
   public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
       System.out.println("Buscando usuario en BD SAC...");

       Usuario usuario = usuarioService.findByUsername(username);

       if (usuario != null) {

           boolean enabled = usuario.isEnabled();
           boolean accountNonExpired = usuario.isAccountNonExpired();
           boolean credentialsNonExpired = usuario.isCredentialsNonExpired();
           boolean accountNonLocked = usuario.isAccountNonLocked();

           Collection<GrantedAuthority> authorities = new ArrayList<GrantedAuthority>();
           authorities.add(new SimpleGrantedAuthority("ROLE_USER"));

           User user = new User(usuario.getUsername(), usuario.getPassword(),
                enabled, accountNonExpired, credentialsNonExpired, accountNonLocked, authorities);

           return user;
       }

       return null;

    }
}

Answer 1

谢谢大家的回复。我只需修改SecurityContext.xml，直接在DaoAuthenticationProvider中更改PasswordEnconder的注入。passwordEncoder是添加类BCryptPasswordEncoder的bean的id。

    <bean id="authenticationProviderSac" 
      class="org.springframework.security.authentication.dao.DaoAuthenticationProvider">
    <property name="userDetailsService" ref="userDetailsServicesac"/>
    <property name="passwordEncoder" ref="passwordEncoder" />
</bean>


<bean id="authenticationManager"
    class="org.springframework.security.authentication.ProviderManager">
  <property name="providers">
    <list>
      <ref local="authenticationProviderCrece"/>
      <ref local="authenticationProviderSac"/>
    </list>
  </property>
</bean>

<security:authentication-manager>
    <security:authentication-provider user-service-ref="userDetailsServicecrece"/>
    <security:authentication-provider user-service-ref="userDetailsServicesac" />
</security:authentication-manager>