尽管用户名和密码正确，Spring Security登录仍失败

Question

早上好，我在登录使用Spring Security的应用程序时遇到了问题。每次我尝试登录时（即使用户名和密码正确），应用程序都会将我重定向到失败url（在我的情况下是：/login？error=true）。密码是用BCrypt加密的，我使用MySQL数据库来存储它们。

应用程序基于Spring in Action 5：https://github.com/habuma/spring-in-action-5-samples/tree/master/ch04/tacos的代码

我的代码：

用户类

@Entity
@Data
@NoArgsConstructor
@Table(name = "Users")
public class User implements UserDetails {

    @Id
    @GeneratedValue(strategy = GenerationType.IDENTITY)
    private Long id;
    private String username;
    private String password;
    private String email;

    public User(String username, String password, String email) {
        this.username = username;
        this.password = password;
        this.email = email;
    }

    @Override
    public Collection<? extends GrantedAuthority> getAuthorities() {
        return null;
    }

    @Override
    public boolean isAccountNonExpired() {
        return false;
    }

    @Override
    public boolean isAccountNonLocked() {
        return false;
    }

    @Override
    public boolean isCredentialsNonExpired() {
        return false;
    }

    @Override
    public boolean isEnabled() {
        return false;
    }

}

安全配置

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Qualifier("userService")
    @Autowired
    private UserDetailsService userDetailsService;

    @Bean
    public PasswordEncoder encoder() {
        return new BCryptPasswordEncoder();
    }

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception{
        auth.userDetailsService(userDetailsService)
            .passwordEncoder(encoder());
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception{
        http.authorizeRequests()
                .antMatchers("/calendar")
                    .hasRole("USER")
                .antMatchers("/","/**").permitAll()
                .and()
                    .formLogin()
                        .loginPage("/login")
                        .defaultSuccessUrl("/calendar")
                        .failureUrl("/login?error=true")
                .and()
                    .logout()
                        .logoutSuccessUrl("/");
    }

}

用户服务

@Service
public class UserService implements UserDetailsService {

    private UserRepository userRepository;

    @Autowired
    public UserService(UserRepository userRepository){
        this.userRepository = userRepository;
    }

    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        User user = userRepository.findByUsername(username);
        if(user != null){
            return user;
        }
        throw new UsernameNotFoundException("Username not found: "+username);
    }
}

控制器

@Controller
@RequestMapping("/register")
public class UserController {

    private UserRepository userRepository;
    private PasswordEncoder passwordEncoder;

    @Autowired
    public UserController(UserRepository userRepository, PasswordEncoder passwordEncoder){
        this.userRepository = userRepository;
        this.passwordEncoder = passwordEncoder;
    }

    @ModelAttribute
    public void calendar(Model model){
        model.addAttribute("user", new User());
    }

    @GetMapping
    public String register(){
        return "register";
    }

    @PostMapping
    public String addUser(@ModelAttribute User user){
        User newUser = new User(user.getUsername(),passwordEncoder.encode(user.getPassword()),user.getEmail());
        userRepository.save(newUser);
        return "redirect:/login";
    }

}

登录表格（Thymeleaf）

    <form th:method="POST" th:action="@{/login}">
        <div class="formInputs">
            <label for="username">Username</label>
            <input id="username" name="username" type="text">
        </div>
        <div class="formInputs">
            <label for="password">Password</label>
            <input id="password" name="password" type="password">
        </div>
        <div style="clear: both"></div>
        <input type="submit" value="Log in">
    </form>

登记表

<form method="POST" th:action="@{/register}" th:object="${user}">
            <div class="formInputs">
                <label for="username">Username</label>
                <input id="username" type="text" th:field="*{username}">
            </div>
            <div class="formInputs">
                <label for="password">Password</label>
                <input id="password" type="password" th:field="*{password}">
            </div>
            <div class="formInputs">
                <label for="email">Email</label>
                <input id="email" type="email" th:field="*{email}">
            </div>
            <div style="clear: both"></div>
            <input type="submit" value="Register">
            <input type="reset" value="Reset">
        </form>

如果有人能帮我找到解决方案，我将不胜感激，提前谢谢。

Answer 1

确保您的用户返回启用=true，以及isAccount tNonExpired=true（以及所有其他人，如isAccount tNonLocked）。还返回一个空的权限列表，而不是null。

否则，Spring Security会将您的用户视为已禁用/锁定/无论什么，并且不允许您登录。