存储库在 Spring Security 中返回 null

Question

我是 Spring Security 的新手，并试图在我的 spring-boot Web 应用程序中实现 Spring Security。我正在关注SpringSecurity 博客通过user 和role 使用数据库来实现安全性。代码也可以在github 找到。这个博客说

---

注意

我们将 bean UserRepository 传递给 UserDetailsS​​ervice，因为这个 bean 将在存储库加载之前被加载，所以我们可能会在 SSUserDetailsS​​ervice 中将 useeRepository bean 设为 null。

---

注意：我已将 SSUserDetailsService 更改为 WebUserDetailsService

我有

实体： User 和 Role 创建 3 个表（user、role 和 user_roles）

/*------------------------------------- User entity -------------------------------------*/
@Entity
public class User {

    @Id
    @GeneratedValue(strategy = GenerationType.AUTO)
    private long id;
    private String username;
    private String password;
    private boolean enabled;

    @ManyToMany(fetch = FetchType.EAGER, cascade = CascadeType.ALL)
    @JoinTable(joinColumns = @JoinColumn(name = "user_id"), inverseJoinColumns = @JoinColumn(name = "role_id"))
    private Set<Role> roles;

    // getters, setters & toString

}


/*------------------------------------- Role entity -------------------------------------*/
@Entity
public class Role {

    @Id
    @GeneratedValue(strategy = GenerationType.AUTO)
    private long id;
    private String role;

    @ManyToMany(mappedBy = "role", fetch = FetchType.LAZY)
    private Set<User> users;

    //getters, setters & toString 

}

存储库： UserRepository 从数据库中获取数据

/*----------------------------------- User repository ----------------------------------*/
@Repository
public interface UserRepository extends JpaRepository<User, Long> {

    User findByUsername(String username);

}

安全配置： WebSecurityConfigurer & WebUserDetailsService

/*------------------------------- WebSecurityConfigurer -------------------------------*/
@Configuration
@EnableWebSecurity
public class WebSecurityConfigurer extends WebSecurityConfigurerAdapter {

    @Autowired
    private UserRepository userRepository;

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.userDetailsService(userDetailsServiceBean());
    }

    @Override
    public UserDetailsService userDetailsServiceBean() throws Exception {
        return new WebUserDetailsService(userRepository);
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
                .authorizeRequests()
                    .antMatchers("/css/**", "/img/**", "/js/**").permitAll()
                    .antMatchers("/", "/home").permitAll()
                    .antMatchers("/admin/**").hasAuthority("ADMIN")
                    .antMatchers("/user/**").hasAuthority("USER")
                    .anyRequest().authenticated()
                .and()
                    .formLogin()
                        .loginPage("/login")
                            .usernameParameter("username").passwordParameter("password").permitAll()
                .and()
                    .logout()
                        .logoutRequestMatcher(new AntPathRequestMatcher("/logout"))
                        .logoutSuccessUrl("/")
        ;
    }

}



/*------------------------------- WebUserDetailsService -------------------------------*/
@Transactional
public class WebUserDetailsService implements UserDetailsService {

    private static final org.slf4j.Logger LOGGER = LoggerFactory.getLogger(WebUserDetailsService.class);

    private UserRepository userRepository;

    public WebUserDetailsService(UserRepository userRepository) {
        this.userRepository = userRepository;
    }

    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        try {
            User user = userRepository.findByUsername(username);
            if (user == null) {
                LOGGER.debug("user not found with the provided username");
                return null;
            }
            LOGGER.debug(" user from username " + user.toString());
            return new org.springframework.security.core.userdetails.User(user.getUsername(), user.getPassword(), getAuthorities(user));
        }
        catch (Exception e){
            throw new UsernameNotFoundException("User not found");
        }
    }

    private Set<GrantedAuthority> getAuthorities(User user){
        Set<GrantedAuthority> authorities = new HashSet<>();
        for(Role role : user.getRoles()) {
            GrantedAuthority grantedAuthority = new SimpleGrantedAuthority(role.getRole());
            authorities.add(grantedAuthority);
        }
        LOGGER.debug("user authorities are " + authorities.toString());
        return authorities;
    }

}

数据库连接： application.properties

#defauls
#security.user.name=user
#security.user.password=password
#security.user.role=ROLE_USER, ROLE_ADMIN

#configurations
spring.jpa.properties.hibernate.dialect=org.hibernate.dialect.MySQLDialect
spring.jpa.properties.hibernate.current_session_context_class=org.springframework.orm.hibernate4.SpringSessionContext

#initializations
spring.jpa.hibernate.ddl-auto=update
spring.jpa.show-sql=false

#credentials
spring.datasource.driver-class-name=com.mysql.jdbc.Driver
spring.datasource.url=jdbc:mysql://localhost/spring_boot_security
spring.datasource.username=root
spring.datasource.password=root
spring.datasource.schema=classpath:/data/schema.sql

#query-configurations
spring.datasource.maxActive=10
spring.datasource.max-idle=4
spring.datasource.min-idle=2
spring.datasource.test-while-idle=true
spring.datasource.test-on-borrow=true
spring.datasource.validation-query=SELECT 1
spring.datasource.time-between-eviction-runs-millis=60000
spring.datasource.min-evictable-idle-time-millis=300000

#server-configurations
hazelcast.server.address=127.0.0.1

问题：

1. userRepository.findByUsername() 为WebUserDetailsService > loadUserByUsername() 中的有效凭据返回空值。我观察到，如果我将以下代码（注释掉User user = userRepository.findByUsername(username); 行）作为测试目的，那么就会看到验证没有错误。那就是userRepository 不起作用。我应该怎么做才能使用userRepository通过用户名拉用户？

   @Override
   public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
       try {
           //User user = userRepository.findByUsername(username);
           Role role = new Role();
           role.setId(1L);
           role.setRole("USER");
   
           Set<Role> roles = new HashSet<>();
           roles.add(role);
   
           User user = new User();
           user.setEnabled(true);
           user.setId(1L);
           user.setPassword("12345");
           user.setUsername("johir1");
           user.setRoles(roles);
   
           if (user == null) {
               LOGGER.debug("user not found with the provided username");
               return null;
           }
           LOGGER.debug(" user from username " + user.toString());
           return new org.springframework.security.core.userdetails.User(user.getUsername(), user.getPassword(), getAuthorities(user));
       } catch (Exception e){
           throw new UsernameNotFoundException("User not found");
       }
   }
   

2. 我在我的"/" URL 映射中调用userRepository.findByUsername() 来测试存储库是否正常工作。我发现User 中声明的toString() 存在错误。如果我注释掉 ", roles=" + roles + 行，则没有错误。如何加载相应用户的角色？看一下 User 中的 toString()

   @Override
   public String toString() {
       return "User{" +
               "id=" + id +
               ", username='" + username + '\'' +
               ", password='" + password + '\'' +
               ", enabled=" + enabled +
               ", roles=" + roles +
               '}';
   }
   

Answer 1

创建一个data.sql 并将其放在您的src/main/resources 文件夹中。它必须至少具有以下内容。

INSERT INTO user(username, password, enabled) VALUES('abc@bca.com', 'abc123', true);

INSERT INTO role(role) VALUES('ROLE_USER');

INSERT INTO user_roles(user_id, role_id) VALUES(1, 1);