通过密码通过春季安全DAO对象 [英] passing password through spring security to dao object

问题描述

我创建使用Struts2的春季安全的应用程序，并有几个问题/问题。

I am creating an application using struts2 and spring security and have few problems/questions.

1. 我怎么能以比较密码和用户名与DB结果传递给DAO的密码？据我了解，用户名可以通过实现传递了的UserDetailsS​​ervice 并重写方法

公开的UserDetails loadUserByUsername（字符串的用户名）

第二个问题是，我得到了空对象从调用方法 SecurityContextHolder.getContext（）。getAuthentication（）在被覆盖的 loadUserByUsername （）。这是为什么？并再次 - 我怎么能得到密码的用户将在为j_password 栏填写

The second question is that I got null object from invoking the method SecurityContextHolder.getContext().getAuthentication() in overriden loadUserByUsername(). Why is that? And again - how can I get the password that the users will fill in the j_password field.

下面是我的code：

<?xml version="1.0" encoding="UTF-8"?>
<web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://java.sun.com/xml/ns/javaee" xmlns:web="http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd" xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd" version="2.5">
    <display-name>Frontend</display-name>

<!-- context param to load at startup -->
    <context-param>
        <param-name>contextConfigLocation</param-name>
        <param-value>classpath:applicationContext.xml</param-value>
    </context-param>
    <context-param>
        <param-name>org.apache.tiles.impl.BasicTilesContainer.DEFINITIONS_CONFIG</param-name>
        <param-value>/WEB-INF/configs/tiles-resources.xml</param-value>
  </context-param>

  <!-- filters -->

    <!-- ============ Spring Security Filter ============= -->
    <filter>
        <filter-name>springSecurityFilterChain</filter-name>
        <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
    </filter>
    <filter-mapping>
      <filter-name>springSecurityFilterChain</filter-name>
      <url-pattern>/*</url-pattern>
    </filter-mapping>

    <!-- struts2 filter -->      
  <filter>
    <filter-name>struts2</filter-name>
    <filter-class>org.apache.struts2.dispatcher.ng.filter.StrutsPrepareAndExecuteFilter</filter-class>
    <init-param>
            <param-name>actionPackages</param-name>
            <param-value>fe.web.actions</param-value>
    </init-param>
  </filter>
   <filter-mapping>
        <filter-name>struts2</filter-name>
        <url-pattern>/*</url-pattern>
  </filter-mapping>

  <!-- listeners -->
  <listener>
    <listener-class>org.springframework.web.context.request.RequestContextListener</listener-class>
  </listener>
  <listener>
    <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
  </listener>
 <listener>
    <listener-class>org.apache.tiles.web.startup.TilesListener</listener-class>
  </listener>
  <listener>
    <listener-class> org.springframework.security.web.session.HttpSessionEventPublisher</listener-class>
  </listener>
</web-app>

弹簧security.xml文件

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
       xmlns:lang="http://www.springframework.org/schema/lang"
       xmlns:context="http://www.springframework.org/schema/context"
       xmlns:tx="http://www.springframework.org/schema/tx"
       xmlns:sec="http://www.springframework.org/schema/security" 
       xsi:schemaLocation="http://www.springframework.org/schema/beans 
        http://www.springframework.org/schema/beans/spring-beans-3.2.xsd
        http://www.springframework.org/schema/context 
        http://www.springframework.org/schema/context/spring-context-3.2.xsd
        http://www.springframework.org/schema/tx 
        http://www.springframework.org/schema/tx/spring-tx-3.2.xsd
        http://www.springframework.org/schema/security 
        http://www.springframework.org/schema/security/spring-security-3.2.xsd">

       <sec:global-method-security secured-annotations="enabled" />

       <sec:http auto-config="true">
            <sec:intercept-url pattern="/**" access="ROLE_USER" />          
       </sec:http>

       <sec:authentication-manager>
            <sec:authentication-provider user-service-ref="UserAuthenticator">
                <sec:password-encoder hash="bcrypt" />
            </sec:authentication-provider>                  
        </sec:authentication-manager>       

        <bean id="UserAuthenticator" class="fe.security.UserAuthenticator"> 
        </bean>

</beans>

UserAuthenticator

package fe.security;

import java.util.Collection;

import org.springframework.security.core.Authentication;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.context.SecurityContext;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.core.userdetails.UsernameNotFoundException;

public class UserAuthenticator implements UserDetailsService{

    @Override
    public UserDetails loadUserByUsername(String username)
            throws UsernameNotFoundException {

        System.out.println(username);
        SecurityContext con = SecurityContextHolder.getContext();
        Authentication auth = con.getAuthentication(); //--the authentication object here is NULL

        String credentials = (String) auth.getCredentials();
        System.out.println("Username=" + username);
        System.out.println("pass=" + credentials);
        return null;
    }


}

在此先感谢！

=============================================== =================================

================================================================================

由于我没有足够的声誉，这里是解决方案：

As I don't have enough reputation, here is the solution:

好吧，经过仔细阅读 Spring Security的参考文档我明白了。

Ok, after carefully reading the Spring Security reference documentation I understand.

事情是Spring Security从的UserDetails 从函数返回 UserDetailsS​​ervice.loadUserByUsername 与<$比较的用户名和密码C $ C>为j_username 和为j_password 字段。
这意味着，DAO对象应与组字段的用户名和密码，返回的UserDetails。

The thing is that Spring Security compares username and password from UserDetails returned from function UserDetailsService.loadUserByUsername with j_username and j_password field. It means that the DAO object should return the UserDetails with set fields username and password.

可空 SecurityContextHolder.getContext（）来问题的答案。getAuthentication（）是认证成功后， SecurityContextHolder.getContext（）。getAuthentication （）应该返回不为空对象。

The answer to question about nullable SecurityContextHolder.getContext().getAuthentication() is that after successful authentication the SecurityContextHolder.getContext().getAuthentication() should return not-nullable object.

问候

推荐答案

好吧，经过仔细阅读Spring Security的参考文档我明白了。

Ok, after carefully reading the Spring Security reference documentation I understand.

事情是Spring Security从的UserDetails 从函数返回 UserDetailsS​​ervice.loadUserByUsername 与为j_username和比较的用户名和密码为j_password场。这意味着，DAO对象应该返回的UserDetails 与组字段名和密码。

The thing is that Spring Security compares username and password from UserDetails returned from function UserDetailsService.loadUserByUsername with j_username and j_password field. It means that the DAO object should return the UserDetails with set fields username and password.

可空 SecurityContextHolder.getContext（）来问题的答案。getAuthentication（）是认证成功后， SecurityContextHolder.getContext（）。getAuthentication （）应返回不为空的对象。

The answer to question about nullable SecurityContextHolder.getContext().getAuthentication() is that after successful authentication the SecurityContextHolder.getContext().getAuthentication() should return not-nullable object.

问候

这篇关于通过密码通过春季安全DAO对象的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！