文章詳情頁

Spring security基于數據庫中賬戶密碼認證

瀏覽：155日期：2023-09-17 13:30:04

一、原理分析

前臺的登錄請求發送到后端后會由spring security進行攔截，即controller層由框架自己提供。這樣用戶名和密碼的認證就需要在service層完成,所以框架需要在service層獲取到我們自己的數據庫賬號信息。

spring security 提供了一個接口 UserDetailsService 來讓用戶提供賬號和密碼,其內容如下

public interface UserDetailsService { UserDetails loadUserByUsername(String username) throws UsernameNotFoundException;}

用戶實現這個接口中的loadUserByUsername方法，通過數據庫中查詢的賬號和密碼構造一個UserDetails對象返回給spring security，然后框架自己完成認證操作。

其中UserDetails也是一個接口，spring security用它來封裝當前進行認證的用戶信息

public interface UserDetails extends Serializable { Collection<? extends GrantedAuthority> getAuthorities(); String getPassword(); String getUsername(); boolean isAccountNonExpired(); boolean isAccountNonLocked(); boolean isCredentialsNonExpired(); boolean isEnabled();}

spring security 自己提供了一個實現類我們可以直接使用,以下是User中的部分代碼

public class User implements UserDetails, CredentialsContainer {private String password;private final String username;private final Set<GrantedAuthority> authorities;private final boolean accountNonExpired; //帳戶是否過期private final boolean accountNonLocked; //帳戶是否鎖定private final boolean credentialsNonExpired; //認證是否過期private final boolean enabled; //帳戶是否可用｝

所以，使用數據庫完成認證的關鍵就是實現UserDetailsService接口，并在loadUserByUsername方法中封裝一個框架需要的UserDetails對象，即User對象返回給框架，由框架完成后續的認證操作。

同時需要在spring security的配置文件中指定要用來認證的userService 的bean

二、代碼實現

1.新建一個javaWeb工程

新建一個javaweb工程,導入相關依賴,pom文件的內容如下

pom文件

<?xml version='1.0' encoding='UTF-8'?><project xmlns='http://maven.apache.org/POM/4.0.0' xmlns:xsi='http://www.w3.org/2001/XMLSchema-instance' xsi:schemaLocation='http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd'> <modelVersion>4.0.0</modelVersion> <groupId>com.lyy</groupId> <artifactId>spring_security_1</artifactId> <version>1.0-SNAPSHOT</version> <packaging>war</packaging> <name>spring_security_1 Maven Webapp</name>  <url>http://www.example.com</url> <properties> <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding> <spring.version>5.0.2.RELEASE</spring.version> <slf4j.version>1.6.6</slf4j.version> <log4j.version>1.2.12</log4j.version> <mysql.version>5.1.6</mysql.version> <mybatis.version>3.4.5</mybatis.version> <spring.security.version>5.0.1.RELEASE</spring.security.version> </properties> <dependencies> <dependency> <groupId>org.aspectj</groupId> <artifactId>aspectjweaver</artifactId> <version>1.6.8</version> </dependency> <dependency> <groupId>org.springframework</groupId> <artifactId>spring-aop</artifactId> <version>${spring.version}</version> </dependency> <dependency> <groupId>org.springframework</groupId> <artifactId>spring-context</artifactId> <version>${spring.version}</version> </dependency> <dependency> <groupId>org.springframework</groupId> <artifactId>spring-context-support</artifactId> <version>${spring.version}</version> </dependency> <dependency> <groupId>org.springframework</groupId> <artifactId>spring-web</artifactId> <version>${spring.version}</version> </dependency> <dependency> <groupId>org.springframework</groupId> <artifactId>spring-orm</artifactId> <version>${spring.version}</version> </dependency> <dependency> <groupId>org.springframework</groupId> <artifactId>spring-beans</artifactId> <version>${spring.version}</version> </dependency> <dependency> <groupId>org.springframework</groupId> <artifactId>spring-core</artifactId> <version>${spring.version}</version> </dependency> <dependency> <groupId>org.springframework</groupId> <artifactId>spring-test</artifactId> <version>${spring.version}</version> </dependency> <dependency> <groupId>org.springframework</groupId> <artifactId>spring-webmvc</artifactId> <version>${spring.version}</version> </dependency> <dependency> <groupId>org.springframework</groupId> <artifactId>spring-tx</artifactId> <version>${spring.version}</version> </dependency> <dependency> <groupId>junit</groupId> <artifactId>junit</artifactId> <version>4.12</version> <scope>test</scope> </dependency> <dependency> <groupId>javax.servlet</groupId> <artifactId>javax.servlet-api</artifactId> <version>3.1.0</version> <scope>provided</scope> </dependency> <dependency> <groupId>javax.servlet.jsp</groupId> <artifactId>jsp-api</artifactId> <version>2.0</version> <scope>provided</scope> </dependency> <dependency> <groupId>jstl</groupId> <artifactId>jstl</artifactId> <version>1.2</version> </dependency>  <dependency> <groupId>log4j</groupId> <artifactId>log4j</artifactId> <version>${log4j.version}</version> </dependency> <dependency> <groupId>org.slf4j</groupId> <artifactId>slf4j-api</artifactId> <version>${slf4j.version}</version> </dependency> <dependency> <groupId>org.slf4j</groupId> <artifactId>slf4j-log4j12</artifactId> <version>${slf4j.version}</version> </dependency>  <dependency> <groupId>mysql</groupId> <artifactId>mysql-connector-java</artifactId> <version>${mysql.version}</version> </dependency> <dependency> <groupId>org.mybatis</groupId> <artifactId>mybatis</artifactId> <version>${mybatis.version}</version> </dependency> <dependency> <groupId>org.mybatis</groupId> <artifactId>mybatis-spring</artifactId> <version>1.3.0</version> </dependency> <dependency> <groupId>c3p0</groupId> <artifactId>c3p0</artifactId> <version>0.9.1.2</version> <type>jar</type> <scope>compile</scope> </dependency> <dependency> <groupId>com.github.pagehelper</groupId> <artifactId>pagehelper</artifactId> <version>5.1.2</version> </dependency> <dependency> <groupId>org.springframework.security</groupId> <artifactId>spring-security-web</artifactId> <version>${spring.security.version}</version> </dependency> <dependency> <groupId>org.springframework.security</groupId> <artifactId>spring-security-config</artifactId> <version>${spring.security.version}</version> </dependency> <dependency> <groupId>org.springframework.security</groupId> <artifactId>spring-security-core</artifactId> <version>${spring.security.version}</version> </dependency> <dependency> <groupId>org.springframework.security</groupId> <artifactId>spring-security-taglibs</artifactId> <version>${spring.security.version}</version> </dependency> <dependency> <groupId>javax.annotation</groupId> <artifactId>jsr250-api</artifactId> <version>1.0</version> </dependency> <dependency> <groupId>com.fasterxml.jackson.core</groupId> <artifactId>jackson-databind</artifactId> <version>2.9.7</version> </dependency> <dependency> <groupId>com.fasterxml.jackson.core</groupId> <artifactId>jackson-core</artifactId> <version>2.9.7</version> </dependency> <dependency> <groupId>org.projectlombok</groupId> <artifactId>lombok</artifactId> <version>1.16.16</version> </dependency> </dependencies> <build> <plugins> <plugin> <groupId>org.apache.tomcat.maven</groupId> <artifactId>tomcat7-maven-plugin</artifactId> <version>2.1</version> <configuration><port>80</port><path>/</path><uriEncoding>UTF-8</uriEncoding><server>tomcat7</server> </configuration> </plugin> </plugins> </build></project>

在web.xml中配置spring security的過濾器

web.xml

<web-app xmlns='http://java.sun.com/xml/ns/javaee' xmlns:xsi='http://www.w3.org/2001/XMLSchema-instance' xsi:schemaLocation='http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd' version='3.0'> <display-name>spring security 01</display-name> <context-param> <param-name>contextConfigLocation</param-name> <param-value>classpath:spring-security.xml,classpath*:applicationContext.xml</param-value> </context-param>  <listener> <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class> </listener> <filter> <filter-name>springSecurityFilterChain</filter-name> <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class> </filter> <filter-mapping> <filter-name>springSecurityFilterChain</filter-name> <url-pattern>/*</url-pattern> </filter-mapping>  <filter> <filter-name>characterEncodingFilter</filter-name> <filter-class>org.springframework.web.filter.CharacterEncodingFilter</filter-class> <init-param> <param-name>encoding</param-name> <param-value>UTF-8</param-value> </init-param> </filter> <filter-mapping> <filter-name>characterEncodingFilter</filter-name> <url-pattern>/*</url-pattern> </filter-mapping> <welcome-file-list> <welcome-file>index.html</welcome-file> <welcome-file>index.htm</welcome-file> <welcome-file>index.jsp</welcome-file> <welcome-file>default.html</welcome-file> <welcome-file>default.htm</welcome-file> <welcome-file>default.jsp</welcome-file> </welcome-file-list></web-app>

整合spring和mybatis,spring的配置文件applicationContext.xml

spring配置文件

<?xml version='1.0' encoding='UTF-8'?><beans xmlns='http://www.springframework.org/schema/beans' xmlns:xsi='http://www.w3.org/2001/XMLSchema-instance' xmlns:context='http://www.springframework.org/schema/context' xmlns:aop='http://www.springframework.org/schema/aop' xmlns:tx='http://www.springframework.org/schema/tx' xsi:schemaLocation='http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd http://www.springframework.org/schema/aop http://www.springframework.org/schema/aop/spring-aop.xsd http://www.springframework.org/schema/tx http://www.springframework.org/schema/tx/spring-tx.xsd'>  <context:component-scan base-package='com.lyy.service'> </context:component-scan> <context:component-scan base-package='com.lyy.dao'> </context:component-scan> <context:property-placeholder location='classpath:db.properties'/>  <bean class='com.mchange.v2.c3p0.ComboPooledDataSource'> <property name='driverClass' value='${jdbc.driver}'/> <property name='jdbcUrl' value='${jdbc.url}'/> <property name='user' value='${jdbc.username}'/> <property name='password' value='${jdbc.password}'/> </bean>  <bean class='org.mybatis.spring.SqlSessionFactoryBean'> <property name='dataSource' ref='dataSource' /> <property name='typeAliasesPackage' value='com.lyy.domain'/> </bean>  <bean class='org.mybatis.spring.mapper.MapperScannerConfigurer'> <property name='basePackage' value='com.lyy.dao'/> </bean>   <bean class='org.springframework.jdbc.datasource.DataSourceTransactionManager'> <property name='dataSource' ref='dataSource'/> </bean> <tx:annotation-driven transaction-manager='transactionManager'/></beans>

spring security配置文件

spring security的配置文件的內容,spring-security.xml

<?xml version='1.0' encoding='UTF-8'?><beans xmlns='http://www.springframework.org/schema/beans' xmlns:security='http://www.springframework.org/schema/security' xmlns:xsi='http://www.w3.org/2001/XMLSchema-instance' xsi:schemaLocation='http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security.xsd'>   <security:http security='none' pattern='/login.html'/> <security:http security='none' pattern='/failed.html'/> <security:http auto-config='true' use-expressions='false'>  <security:intercept-url pattern='/**' access='ROLE_USER'/>  <security:form-login login-page='/login.html' login-processing-url='/login' username-parameter='username' password-parameter='password' authentication-failure-forward-url='/failed.html' default-target-url='/index.html' />  <security:csrf disabled='true'/>  <security:logout invalidate-session='true' logout-url='/logout.do' logout-success-url='/login.html' /> </security:http> <security:authentication-manager>  <security:authentication-provider user-service-ref='userService'> </security:authentication-provider> </security:authentication-manager></beans>

在這個配置文件中要注意的是配置用來認證的userService Bean

<security:authentication-provider user-service-ref='userService'>

創建登錄頁面和登錄失敗的頁面login.html,failed.html

2.用戶認證的實現

新建一個IUserService接口繼承UserDetailsService

package com.lyy.service;import org.springframework.security.core.userdetails.UserDetailsService;public interface IUserService extends UserDetailsService {}

實現類如下

@Service('userService')public class UserServiceImpl implements IUserService { @Autowired private IUserDao userDao; public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException { UserInfo userInfo = userDao.findByUsername(username); User user=new User(userInfo.getUsername(),'{noop}'+userInfo.getPassword(),getRoles()); return user; } /*給用戶賦值角色信息*/ private List<SimpleGrantedAuthority> getRoles(){ List<SimpleGrantedAuthority> list=new ArrayList<SimpleGrantedAuthority>(); list.add(new SimpleGrantedAuthority('ROLE_USER')); list.add(new SimpleGrantedAuthority('ROLE_ADMIN')); return list; }}

其中在loadUserByUsername方法中完成查詢數據庫信息，封裝成框架需要的用戶信息。

注意 :

UserInfo是封裝數據庫用戶信息的實體類

getRoles用來給用戶賦角色信息，spring security認證時用戶必須有角色信息，角色信息可以從數據庫中查詢，在這里直接在代理中寫固定值來示意。

用戶密碼中拼接的'{noop}'字符串是因為我們沒有對密碼進行加密，所以要告訴框架認證密碼時不需要加密。

3.測試

啟動工程，訪問localhost,會跳轉到登錄頁面，輸入數據庫中存在的賬戶和密碼就會登錄成功并跳轉到首頁index.html

三、總結

使用數據庫完成認證的關鍵就是實現UserDetailsService接口，并在loadUserByUsername方法中封裝一個框架需要的UserDetails對象，即User對象返回給框架，由框架完成后續的認證操作。

同時需要在spring security的配置文件中指定要用來認證的userService 的bean，即實現了loadUserByUsername方法的userService

如果需要查看示例工程的具體代碼，可以點擊下方的鏈接在碼云上查看

示例工程地址

以上就是本文的全部內容，希望對大家的學習有所幫助，也希望大家多多支持好吧啦網。

Spring

上一條：Spring Boot webflux使用方法解析下一條：Spring security實現記住我下次自動登錄功能過程詳解

相關文章：

1. 用Spring JMS使異步消息變得簡單2. PHP驗證碼工具－Securimage3. 關于IDEA 2020.3 多窗口視圖丟失的問題4. js實現碰撞檢測5. 一文帶你徹底理解Java序列化和反序列化6. JS實現前端動態分頁碼代碼實例7. PHP使用Swagger生成好看的API文檔8. ASP.NET MVC使用jQuery ui的progressbar實現進度條9. Python 下載Bing壁紙的示例10. Python 制作查詢商品歷史價格的小工具

排行榜

					
					一文帶你徹底理解Java序列化和反序列化
用Spring JMS使異步消息變得簡單
關于IDEA 2020.3 多窗口視圖丟失的問題
PHP驗證碼工具－Securimage
js實現碰撞檢測
JS實現前端動態分頁碼代碼實例
AspectJ 支持JAVA 5的新特性
Android 簡單的實現滑塊拼圖驗證碼功能
Java源碼解析之SortedMap和NavigableMap
ASP.NET MVC使用jQuery ui的progressbar實現進度條
Django 模板中常用的過濾器實現
				