将用户注册到存储库Spring Security

Question

我有一个运行时账户库(我没有使用数据库)，我希望能够在运行时注册新账户。我有一个专门的控制器。

除此之外，我有一个需要身份验证的控制器。请注意，我没有任何图形形式，只有API，因此身份验证必须来自HTTP请求。

RegisterAccountController.java：保存到存储库并返回JSON密码

@Autowired
private AccountService service;

@RequestMapping(method = RequestMethod.POST, value = "/account", produces = "application/json")
public String create(@RequestBody String accountId) {
        String password = service.generatePassword();
        service.save(accountId, password);

        return password;
    }
}

AccountService。java：将用户保存到本地运行时存储库

@Autowired
private AccountRepository repository;

@Autowired
private PasswordGenerator pwGenerator;

public void save(String accountId, String password) {
    repository.save(new Account(accountId, password));
}

public String generatePassword() {
    // random password is returned
    return pwGenerator.generate();
}

AccountRepository.java

// accountId --> account
private Map<String, Account> accounts = new HashMap<>();


public Account findById(String accountId) {
    return accounts.get(accountId);
}


public void save(Account account) {     
    accounts.put(account.getAccountId(), account);
}

SecurityConfig.java

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired  
    private AccountDetailsService accountDetailsService;

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.userDetailsService(accountDetailsService).passwordEncoder(new BCryptPasswordEncoder());
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {

        // permit public POST to '/account' endpoint
        http.authorizeRequests()
                            .antMatchers("/account").permitAll() // allow everyone to open account
                            .anyRequest().fullyAuthenticated() // all other endpoints authenticated
                            .and().httpBasic();

        http.csrf().disable();
    }
}

AccountDetailsService.java

@Service
public class AccountDetailsService implements UserDetailsService {

    @Autowired
    private final AccountRepository repository;

    @Override
    public UserDetails loadUserByUsername(String accountId) throws UsernameNotFoundException {
        Account account = repository.findById(accountId);
        return new User(account.getId(), account.getPassword(), Collections.emptySet()); // no granted authorities
    }
}

AuthorizedController.java:只有授权的帐户才能访问它

@RequestMapping(method = RequestMethod.POST, value = "/hello", produces = "application/json")
public String hello() {
    return "Hello, authenticated!";
}

现在的问题是，每当我在我的注册表中注册一个新用户，然后尝试点击AuthorizedController，我就无法使用注册用户的凭据登录。

例如，用户“Joe”已注册，并获得随机密码“12345678”。现在，我用凭证“Joe”、“12345678”点击了“/hello”endpoint，我遇到了未经授权的异常，好像应用程序的身份验证部分没有从帐户存储库中获取信息。

请尝试提供一些建议。

Answer 1

我认为你不断得到未授权的异常的原因是在你的AccountDetailsService.java中你没有指定它的许可。您的代码必须类似于

@Service
public class AccountDetailsService implements UserDetailsService {
@Autowired
private final AccountRepository repository;

@Override
public UserDetails loadUserByUsername(String accountId) throws UsernameNotFoundException {
    Account account = repository.findById(accountId);
    Set<GrantedAuthority> authorities = new HashSet<GrantedAuthority>();
    authorities.add(new SimpleGrantedAuthority("ROLE_USER"));
    return new User(account.getId(), account.getPassword(), 
   authorities);
}
}