Spring Security Ouath2:主体对象未返回Extended UserDetails

Question

根据这个问题，这是登录失败的结果。AuthenticationToken（在本例中是UsernamePasswordAuthenticationToken）被AuthenticationManager拒绝。我不知道它为什么要做这样的事。默认UserDetails对象的身份验证似乎工作得很好。有人能帮我解决这个问题吗？

关于已实现类的一些细节（如上所述）。由于原因，这里遗漏了一些代码。

CustomUserDetails

public class CustomUserDetails extends User {

  private final Integer custom;

  public CustomUserDetails (...default params..., Integer custom) {
    super(...default params...);
    this.custom = custom;
  }
}

CustomUserDetailsService

@Service
public class CustomUserDetailsService implements UserDetailsService {
  @Override
  public CustomUserDetails loadUserByUsername(String username) throw UsernameNotFoundException {
    return new CustomUserDetails(...default params..., 12345);
  }
}

@Autowired
private CustomUserDetails userDetails;

@Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
  auth.userDetailsService(userDetails);
}

@RequestMapping(value = "/user", method = RequestMethod.GET)
@ResponseBody
public Principal getDetails(Principal user) {
  return user;
}

提前谢了。

Answer 1

通常，您需要注释@authenticationPrincipal，但我建议您构建自己的注释，如下所示：

/**
 * Our own {@link AuthenticationPrincipal} annotation as suggested by
 * http://docs.spring.io/spring-security/site/docs/3.2.x/reference/htmlsingle/#mvc-authentication-principal
 *
 */
@Target({ElementType.PARAMETER, ElementType.TYPE})
@Retention(RetentionPolicy.RUNTIME)
@Documented
@AuthenticationPrincipal
public @interface CurrentUser {}

然后您可以通过以下方式拥有这个主体:

@RequestMapping(..)
public Principal test(@CurrentUser Principal principal){..}

但是，您应该有自己的主体Impl，或者更确切地说，扩展现有的Impl。类似于这样：

public MyPrincipal extends org.springframework.security.core.userdetails.User {..}