如何在Spring Security中检查加盐密码？

Question

我正在使用Spring3，并从MySQL数据库中获取用户。

MD5(username + salt + password)

public class UserDao {

    public static Users findUserByUsername(String paUsername) {
        String hql = "from Users where username = :username";

        List<Users> list = null;
        Users user = null;

        try {
            IO io = new IO("web");   // custom Hibernate framework
            IOQuery query = new IOQuery();
            query.setStatement(hql);
            query.setParameter(new IOParameter("username", paUsername));

            list = io.runQuery(query);

            if (list.isEmpty()) {
                return null;
            }

            return list.get(0);

        } catch (Exception ex) {
            return null;
        }
    }
}

@Service("userDetailsService")
public class UserDetailsServiceImpl implements UserDetailsService {

    @Autowired
    private UserDao userDao;

    @Override
    public UserDetails loadUserByUsername(String paUsername) throws UsernameNotFoundException {
        Users user = userDao.findUserByUsername(paUsername);

        if(user == null) {
            throw new UsernameNotFoundException("User not found");
        }

        return new User(
                user.getUsername(),
                user.getPassword(),
                user.getEnabled(),
                true,
                true,
                true,
                getAuthorities(Enums.UserRoles.IT));
    }

    private Collection<? extends GrantedAuthority> getAuthorities(Enums.UserRoles paRole) {
        List<GrantedAuthority> authList = getGrantedAuthorities(getRoles(paRole));
        return authList;
    }

    private List<String> getRoles(Enums.UserRoles paRole) {
        List<String> roles = new ArrayList<>();

        if (paRole.equals(Enums.UserRoles.USER)) {
            roles.add(Enums.UserRoles.USER.name());
        } else if (paRole.equals(Enums.UserRoles.IT)) {
            roles.add(Enums.UserRoles.USER.name());
            roles.add(Enums.UserRoles.IT.name());
        }

        return roles;
    }

    private static List<GrantedAuthority> getGrantedAuthorities(List<String> paRoles) {
        List<GrantedAuthority> authorities = new ArrayList<>();
        for (String role : paRoles) {
            authorities.add(new SimpleGrantedAuthority(role));
        }
        return authorities;
    }
}

public class UserDetailService implements UserDetailsService {

    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        return new UserDetailsServiceImpl().loadUserByUsername(username);        
    }
}

<beans:bean id="loginSuccessHandler" class="com.myapp.security.LoginSuccessHandler" />
<beans:bean id="loginFailureHandler" class="com.myapp.security.LoginFailureHandler" />
<beans:bean id="detailsService" class="com.myapp.security.UserDetailService" />

对我需要做什么有什么想法吗？

谢谢

Answer 1

这是我的应用程序用于设置密码编码的安全配置的一个片段：

<sec:authentication-manager alias="authenticationManager">
    <sec:authentication-provider ref="authenticationProvider" />
</sec:authentication-manager>


<bean id="authenticationProvider" class="org.springframework.security.authentication.dao.DaoAuthenticationProvider">
    <property name="userDetailsService" ref="userDetailsServiceImpl"/>
    <property name="passwordEncoder" ref="cryptoPasswordEncoder" />
</bean>


<bean id="cryptoPasswordEncoder" class="org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder" />

我们不需要在DaoAuthenticationProvider中设置Salt源，因为BCryptPasswordEncoder使用它自己的源。