为什么UsernamePasswordAuthenticationToken中的授权为空？

Question

我被这个JavaSpring Boot问题困住了。我已经在loadUserByUsername方法的返回语句中填写了自动权限：this.get权限（user）。但是当我打印身份验证对象时，它说授予权限为空：

UsernamePasswordAuthenticationToken[Principal=mark，Credentials=PROTECTED]，Authenticated=true，Details=null，授予的权限=[]]

有人知道吗？

    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        User user = userRepository.findByUsername(username);
        if (user == null) throw new UsernameNotFoundException(username);
        return new org.springframework.security.core.userdetails.User(user.getUsername(), user.getPassword(), this.getAuthorities(user));
    }

    @GetMapping(path = "authenticated")
    @PreAuthorize("hasAuthority('ROLE_DEFAULT')")
    public User getAuthenticatedUser() {
        Authentication auth = SecurityContextHolder.getContext().getAuthentication();
        System.out.println(auth);
        User user = this.getUserByUsername(auth.getPrincipal().toString());
        return user;
    }

    private Collection<GrantedAuthority> getAuthorities(User user) {
        Collection<GrantedAuthority> authorities = new ArrayList<>();
        authorities.add(new SimpleGrantedAuthority(user.getRole()));
        return authorities;
    }

Answer 1

我也遇到了这个问题。我有一个自定义的用户凭据实现org.springframework.security.core.userdetails.用户详细信息，其中get授权（）实现返回值-但注意到工作授权数组是空的：

o.s.s.w.a.i.FilterSecurityInterceptor:317 - Re-authenticated UsernamePasswordAuthenticationToken [Principal=dto.UserCredentials@585027b7, Credentials=[PROTECTED], Authenticated=true, Details=null, **Granted Authorities=[]**] before authorizing

问题是我的身份验证提供者的实现是错误的，它返回：

new UsernamePasswordAuthenticationToken(userCredentials, authentication, Collections.emptyList());

new UsernamePasswordAuthenticationToken(userCredentials, authentication, **userCredentials.getAuthorities()**);