Spring Security未授权

Question

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired
    private Environment env;

    @Autowired
    private UserSecurityService userSecurityService;

    private static final String[] PUBLIC_MATCHERS = { 
        "/webjars/**", 
        "/css/**", 
        "/js/**", 
        "/images/**", 
        "/",
        "/about/**", 
        "/contact/**", 
        "/error/**/*",
        "/h2-console/**"
    };

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        List<String> activeProfiles = Arrays.asList(env.getActiveProfiles());
        // Required by h2 console to work
        if(activeProfiles.contains("dev")) {
            http.csrf().disable();
            http.headers().frameOptions().disable();
        }
        http
            .authorizeRequests()
            .antMatchers(PUBLIC_MATCHERS).permitAll()
            .anyRequest().authenticated()
            .and()
            .formLogin().loginPage("/login").defaultSuccessUrl("/payload")
            .failureUrl("/login?error").permitAll()
            .and()
            .logout().permitAll();
    }

    @Autowired
    public void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.userDetailsService(userSecurityService);   
    }    
}

spring.datasource.url=jdbc:h2:mem:testdb;MODE=MySQL;DB_CLOSE_ON_EXIT=FALSE
spring.datasource.username=sa
spring.datasource.password=
hibernate.dialect=org.hibernate.dialect.H2Dialect

调试O.S.S.W.A.I.FilterSecurityInterceptor-以前已通过身份验证:org.springframework.security.authentication.anonymousauthenticationtoken@2dafa81d:principal:anonymouser；全权证书:[受保护]；已认证：真实；详细信息:org.springframework.security.web.authentication.webauthenticationdetails@2cd90:RemoteIpAddress:0:0:0:0:0:0:0:0:0:0:0:1；会话ID:0D60174BBA25377F65443D95DB72F713；授予的权限：ROLE_ANONYMOUS

DEBUG o.ss.access.vote.afirmativeBased-voter:org.springframework.security.web.access.expression.webexpressionvoter@7a27baf6,返回：1

调试O.S.S.W.A.I.FilterSecurityInterceptor-授权成功

调试o.security.web.filterchainproxy-/js/scripts.js已到达附加筛选器链的末端；按原始链进行

DEBUG o.ss.w.c.httpsessionSecurityContextrepository-SecurityContext为空或内容为匿名-context不会存储在HttpSession中。

调试O.S.S.W.A.ExceptionTranslationFilter-链已正常处理

DEBUG O.S.S.W.C.SecurityContextPersistenceFilter-SecurityContextThOlder现在已清除，因为请求处理已完成

Answer 1

在身份验证期间,应用程序抛出以下错误：

java.lang.IllegalArgumentException: There is no PasswordEncoder mapped for the id "null"

引发此异常，因为提供的（纯文本）密码缺少password-encoder{id}-前缀。Spring Security 5现在使用以下格式存储密码（Spring Security以前的版本不是这样的）：

{id}encodedPassword

这意味着对于纯文本口令，{noop}id告诉spring使用noopPasswordEncoder匹配口令（它基本上将口令作为纯文本处理）。

import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;

@Configuration
class Config {

    @Bean
    public PasswordEncoder passwordEncoder() {
        // Create an encoder with strength 31
        // values from 4 .. 31 are valid; the higher the value, the more work has to be done to calculate the hash
        return new BCryptPasswordEncoder(12);
    }
}

@Configuration
class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired
    PasswordEncoder passwordEncoder;

    ...

    @Autowired
    public void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.userDetailsService(userSecurityService)
            .passwordEncoder(passwordEncoder);
    }
}

密码编码

@Service
class UserService implements UserDetailsService {
    private UserRepository userRepository;
    private PasswordEncoder passwordEncoder;

    UserService(UserRepository userRepository, PasswordEncoder passwordEncoder) {
        this.userRepository = userRepository;
        this.passwordEncoder = passwordEncoder;
    }    

    User createUser(String username, String password) {
        // encrypt the plain-text password
        String encodedPassword = passwordEncoder.encode(password);
        User user = new User(username, encodedPassword));
        //...
        return userRepository.save(user);
    }
}

要支持多个编码器，可能需要查看DelegatingPasswordEncoder和PasswordEncoderFactors。

欲了解更多详细信息，请参阅https://spring.io/blog/2017/11/01/spring-security-5-0-0-rc1-released#password-storage-format