Spring Boot 1.3.3,Spring Security基本自定义配置

Question

我知道这是N。关于Spring Security的文章，我读了很多关于它的文章，直到我决定发表我的问题，因为--我假设--由于Spring Boot的性质，在引擎盖下面一定隐藏着某种问题，这是我使用的启动版本/安全类型的星座特有的。

让我直接进去。

pom.xml：

<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-data-jpa</artifactId>
</dependency>

<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-jersey</artifactId>
</dependency>

<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-web</artifactId>
</dependency>

<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-security</artifactId>
    <version>1.2.5.RELEASE</version>
</dependency>

<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-test</artifactId>
    <scope>test</scope>
</dependency>

我的基本安全配置：

@Configuration
@EnableWebSecurity
public class SpringSecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired
    private UserDetailsService userDetailsService;

    @Autowired
    private StudentRepository studentRepository;

    @Override
    protected void configure(HttpSecurity http) throws Exception {

    http.csrf().disable()
        .authorizeRequests()
            .antMatchers("/").access("hasRole('ROLE_STUDENT')")
            .antMatchers("/**").permitAll();
        .and()
            .formLogin()
            .loginPage("/login")
            .failureUrl("/login?error=true");
    }

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth
        .userDetailsService(new UserDetailsService() {
            @Override
            public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
                Iterable<Student> studentsWithIds = studentRepository.findAll();

                for (Student student: studentsWithIds) {
                    if (student.getName() == username) {
                        return studentRepository.findOne(student.getId());
                    }
                }
                  throw new UsernameNotFoundException("User '" + username + "' not found.");
            }
        });     
    }
}

@Entity
public class Student implements UserDetails {

    @Id @GeneratedValue(strategy=GenerationType.AUTO)
    private Integer id;

    @Column(unique=true)
    private Integer facebookId;

    @Column(unique=true)
    private Integer googleId;

    private String name = "";
    private String password = "";


    public void setName(String name) {
        this.name = name;
    }


    public String getName() {
        return this.name;
    }

    public String getPassword() {
        return this.password;
    }

    public void initialize(String studentName) {
        this.name = "student1";
        this.password = "password";
    }

    @Override
    public String toString(){
        return "Student with name " + name + "id: " + id;
    }

    public Integer getId() {
        return id;
    }

    @Override
    public Collection<? extends GrantedAuthority> getAuthorities() {
        return Arrays.asList(new SimpleGrantedAuthority("ROLE_STUDENT"));
    }

    @Override
    public String getUsername() {
        return this.name;
    }

    @Override
    public boolean isAccountNonExpired() {
        // TODO Auto-generated method stub
        return true;
    }

    @Override
    public boolean isAccountNonLocked() {
        // TODO Auto-generated method stub
        return true;
    }

    @Override
    public boolean isCredentialsNonExpired() {
        // TODO Auto-generated method stub
        return true;
    }

    @Override
    public boolean isEnabled() {
        // TODO Auto-generated method stub
        return true;
    }

}

结尾似乎是最有趣的,虽然剩下的也很难看：

O.S.S.Authentication.DAO.DAOAuthenticationProvider-未找到用户“Student1”

这里是我在Student上调用initialize的地方（这是作弊，因为应该在POST上调用它，但我还是作弊，只是为了将一个Student放入数据库，并使用它进行身份验证。以后显然会有所不同。当然，我只能在暂时停用应用程序上的安全性时才会这样做）：

@RequestMapping(value="/students", method=RequestMethod.GET, produces=MediaType.APPLICATION_JSON_UTF8_VALUE)
public ResponseEntity<Iterable<Student>> listStudents() {
    LOGGER.info("/students controller method call"+new SimpleDateFormat("yyyy.MM.dd.HH.mm.ss").format(new Date()));
    Iterable<Student> studentsFound = studentRepository.findAll();

    Student newStudent = new Student();
    newStudent.initialize("student1");
    studentRepository.save(newStudent);

    return new ResponseEntity<Iterable<Student>>(studentsFound, HttpStatus.OK);         
}

你认为学生实例本身是不正确的吗？

Answer 1

问题是，当我启动应用程序时，我仍然无法使用“student1”/“password”进行身份验证，而只能使用默认的“user”/进行身份验证。

这意味着默认用户（通过默认authenticationManager配置）仍然启用。为了解决此问题，只需将AuthenticationManagerBuilder注入configure方法：

@Override
@Autowired
protected void configure(AuthenticationManagerBuilder auth) throws Exception { ... }

基于Spring Boot文档：

因此，为了禁用默认的authenticationManager，您应该将authenticationManagerBuilder自动连接到配置方法。

我知道这离题了，但下面的代码在我看来效率极低：

Iterable<Student> studentsWithIds = studentRepository.findAll();
for (Student student: studentsWithIds) {
    if (student.getName() == username) {
        return studentRepository.findOne(student.getId());
    }
}