Spring boot HTTP基本传递到JDBC

Question

auth.inMemoryAuthentication()
                .withUser("user").password("password").roles("USER");

@Bean
@Primary
public DataSource dataSource() {
    return DataSourceBuilder
        .create()
        .username("")
        .password("")
        .url("")
        .driverClassName("")
        .build();
}

Answer 1

使用UserCredentialsDatasourceAdapter作为@“M.Deinum”建议的某种筛选器或处理AuthenticationSuccessEvent。

基本上，您应该只使用当前主体username和password调用SetCredentialsForCurrentThread方法。

您必须禁用身份验证管理器的凭据擦除，以便能够在身份验证后检索用户密码。

@EnableWebSecurity
public static class Security extends WebSecurityConfigurerAdapter {
    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.eraseCredentials(false) // for password retrieving
            .inMemoryAuthentication()
            .withUser("postgres").password("postgres1").roles("USER");
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.httpBasic().and().authorizeRequests().mvcMatchers("/").fullyAuthenticated();
    }
}

数据源适配器：

@Bean
public UserCredentialsDataSourceAdapter dataSource(DataSourceProperties properties) {
    final UserCredentialsDataSourceAdapter dataSourceAdapter = new UserCredentialsDataSourceAdapter();
    dataSourceAdapter.setTargetDataSource(DataSourceBuilder.create()
            .driverClassName(properties.getDriverClassName())
            .url(properties.getUrl())
            .username(properties.getUsername())
            .password(properties.getPassword())
            .type(SimpleDriverDataSource.class) // disable pooling
            .build());

    ((SimpleDriverDataSource) dataSourceAdapter.getTargetDataSource()).setDriverClass(org.postgresql.Driver.class); //binder won't set it automatically
    return dataSourceAdapter;
}

AuthenticationSuccessHandler：

@Component
public static class AuthenticationHandler /*implements ApplicationListener<AuthenticationSuccessEvent> use that if your spring version is less than 4.2*/ {
    private final UserCredentialsDataSourceAdapter dataSourceAdapter;

    @Autowired
    public AuthenticationHandler(UserCredentialsDataSourceAdapter dataSourceAdapter) {
        this.dataSourceAdapter = dataSourceAdapter;
    }

    @EventListener(classes = AuthenticationSuccessEvent.class)
    public void authenticationSuccess(AuthenticationSuccessEvent event) {
        final Authentication authentication = event.getAuthentication();
        final User user = (User) authentication.getPrincipal();
        dataSourceAdapter.setCredentialsForCurrentThread(user.getUsername(), user.getPassword()); // <- the most important part
    }
}

也可以使用筛选器代替事件侦听器：

@Component
public static class DataSourceCredentialsFilter extends GenericFilterBean {
    private final UserCredentialsDataSourceAdapter dataSourceAdapter;

    @Autowired
    public DataSourceCredentialsFilter(UserCredentialsDataSourceAdapter dataSourceAdapter) {
        this.dataSourceAdapter = dataSourceAdapter;
    }

    @Override
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
            throws IOException, ServletException {
        final Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
        final User user = (User) authentication.getPrincipal();
        dataSourceAdapter.setCredentialsForCurrentThread(user.getUsername(), user.getPassword());
        chain.doFilter(request, response);
        dataSourceAdapter.removeCredentialsFromCurrentThread();
    }
}