带有spring-boot和spring-security的JWT

Question

我对Spring保安很陌生。我试图在我的Spring-Boot应用程序中实现JWT来执行身份验证。我学习了示例代码，并且能够生成jwt。但是根据示例文件中的配置，我可以使用配置中的内存数据集来验证httpRequest中的输入。但是，我不理解如何将请求中发送的用户名和密码与我的数据库中的值进行检查。请引导我。我的配置类是

@Configuration
@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

@Override
protected void configure(HttpSecurity http) throws Exception {
    http.csrf().disable().authorizeRequests()
            .antMatchers("/").permitAll()
            .antMatchers(HttpMethod.POST, "/login").permitAll()
            .anyRequest().authenticated()
            .and()
            // We filter the api/login requests
            .addFilterBefore(new JWTLoginFilter("/login", authenticationManager()),
                    UsernamePasswordAuthenticationFilter.class)
            // And filter other requests to check the presence of JWT in header
            .addFilterBefore(new JWTAuthenticationFilter(),
                    UsernamePasswordAuthenticationFilter.class);
}

@Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
    // Create a default account
    auth.inMemoryAuthentication()
            .withUser("admin")
            .password("password")
            .roles("ADMIN");
}
}

在重写的configure（AuthenticationManagerBuilder auth）throws exception中，我可以设置将与/login路径的request中存在的凭据进行比较的凭据

public class TokenAuthenticationService {

static final long EXPIRATIONTIME = 864_000_000; // 10 days
static final String SECRET = "ThisIsASecret";
static final String TOKEN_PREFIX = "Bearer";
static final String HEADER_STRING = "Authorization";

static void addAuthentication(HttpServletResponse res, String username)     {
    String JWT = Jwts.builder()
            .setSubject(username)
            .setExpiration(new Date(System.currentTimeMillis() + EXPIRATIONTIME))
            .signWith(SignatureAlgorithm.HS512, SECRET)
            .compact();
    res.addHeader(HEADER_STRING, TOKEN_PREFIX + " " + JWT);
}

static Authentication getAuthentication(HttpServletRequest request) {
    String token = request.getHeader(HEADER_STRING);
    if (token != null) {
        // parse the token.
        String user = Jwts.parser()
                .setSigningKey(SECRET)
                .parseClaimsJws(token.replace(TOKEN_PREFIX, ""))
                .getBody()
                .getSubject();

        return user != null ?
                new UsernamePasswordAuthenticationToken(user, null, Collections.emptyList()) :
                null;
    }
    return null;
}
}

public class JWTLoginFilter extends AbstractAuthenticationProcessingFilter {

public JWTLoginFilter(String url, AuthenticationManager authManager) {
super(new AntPathRequestMatcher(url));
setAuthenticationManager(authManager);
}

@Override
public Authentication attemptAuthentication(
        HttpServletRequest req, HttpServletResponse res)
        throws AuthenticationException, IOException, ServletException {
    AccountCredentials creds = new ObjectMapper()
            .readValue(req.getInputStream(), AccountCredentials.class);
    return getAuthenticationManager().authenticate(
            new UsernamePasswordAuthenticationToken(
                    creds.getUsername(),
                    creds.getPassword(),
                    Collections.emptyList()
            )
    );
}

@Override
protected void successfulAuthentication(
        HttpServletRequest req,
        HttpServletResponse res, FilterChain chain,
        Authentication auth) throws IOException, ServletException {
    TokenAuthenticationService
            .addAuthentication(res, auth.getName());
}
}

public class JWTAuthenticationFilter extends GenericFilterBean{

@Override
public void doFilter(ServletRequest request,
                     ServletResponse response,
                     FilterChain filterChain)
        throws IOException, ServletException {
    Authentication authentication = TokenAuthenticationService
            .getAuthentication((HttpServletRequest)request);

    SecurityContextHolder.getContext()
            .setAuthentication(authentication);
    filterChain.doFilter(request,response);
}
}

Answer 1

您需要实现UserDetailsService接口（访问您的数据库），并将其配置为Spring Security使用。

一个很好的例子（没有JWT，但这不是重点）可以在这里找到：Spring Security：Authentication with A Database-backed UserDetailsService