Spring boot安全主体用户更改为新登录的用户详细信息

Question

我正在使用spring security的spring boot 2.2.4。我面临的问题是，每次我与新用户登录时，主要用户名都会重置为新登录用户的详细信息，为什么。然而，正如我所观察到的，会话ID仍然正确。我不理解这种行为。知道吗？

@EnableWebSecurity
public class IctSecurityConfiguration extends WebSecurityConfigurerAdapter {

    @Autowired
    PasswordEncoder passwordEncoder;

    @Autowired
    private UserDetailsService userDetailsService;


    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.userDetailsService(userDetailsService);
    }


    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests()
                //URLs matching for access rights
                .antMatchers("/").permitAll()
                .antMatchers("/signup").permitAll()
                .antMatchers("/signin").permitAll()
                .antMatchers("/ict/**/**").permitAll()
                .antMatchers("/user/queue/reply").hasAnyAuthority(RolesConst.APP_USER)
                .antMatchers("/find").hasAnyAuthority(RolesConst.APP_USER)
                //.anyRequest().authenticated()
                .and()
                //form login
                .csrf().disable().formLogin()
                .loginPage("/login")
                .failureUrl("/login?error=true")
                .defaultSuccessUrl("/dashboard")
                .and()
                //logout
                .logout()
                .logoutRequestMatcher(new AntPathRequestMatcher("/logout"))
                .logoutSuccessUrl("/login").and()
                .exceptionHandling()
                .accessDeniedPage("/access-denied");
    }

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
        //return NoOpPasswordEncoder.getInstance();
    }

}

用户详情服务

@Service
public class IctUserDetailsService implements UserDetailsService {

    @Autowired
    private UserRepository userRepository;

    @Override 
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException { 
        //return new IctUserDetails(username);
        Optional<UserEntity> user = userRepository.findByUsername(username);
        user.orElseThrow(() -> new UsernameNotFoundException("Not found: " + username));
        //UserController.groupname(username);
        return user.map(IctUserDetails::new).get();
    }

}

UserDetails类

   public class IctUserDetails implements UserDetails {

    private static final long serialVersionUID = 1L;

    public static String username;
    private String password;

    private List<? extends GrantedAuthority> authorities;


    public IctUserDetails() {
    }

    public IctUserDetails(UserEntity userEntity) {
        this.username = userEntity.getUsername();


        this.password = userEntity.getPassword();
        List<SimpleGrantedAuthority> authoriteis = getRoleAuthoritiesFromUserEntity(userEntity);
        this.authorities = authoriteis;
    }

    @Override
    public Collection<? extends GrantedAuthority> getAuthorities() {
        return authorities;
    }

    @Override
    public String getPassword() {
        return password;
    }

    @Override
    public String getUsername() {
        return this.username;
    }

    @Override
    public boolean isAccountNonExpired() {
        return true;
    }

    @Override
    public boolean isAccountNonLocked() {
        return true;
    }

    @Override
    public boolean isCredentialsNonExpired() {
        return true;
    }

    @Override
    public boolean isEnabled() {
        return true;
    }

    /**
     * Get list of role authorities from current user entity
     * @param userRoleEntities
     * @return
     */
    @Transactional
    private List<SimpleGrantedAuthority> getRoleAuthoritiesFromUserEntity(UserEntity userEntity) {
        Collection<UserRoleEntity> userRoleEntities = userEntity.getUserRoleEntities();
        List<SimpleGrantedAuthority> authoriteis = userRoleEntities
                .stream()
                .map(ur -> ur.getRole().getRoleName())
                .map(SimpleGrantedAuthority::new)
                .collect(Collectors.toList());
        return authoriteis;
    }

}

Answer 1

所以，这就是问题所在。我在我的用户详细信息类中将用户名声明为静态公共静态字符串用户名；。

我已经将其更改为私有字符串用户名；现在一切都很好。谢谢。