通过 Spring Security 将密码传递给 dao 对象

Question

我正在使用 struts2 和 spring security 创建一个应用程序，并且几乎没有问题/疑问。

1. 如何将密码传递给 DAO，以便将密码和用户名与 DB 的结果进行比较？我知道可以通过实现UserDetailsService 并覆盖该方法来传递用户名

   public UserDetails loadUserByUsername(String username)

2. 第二个问题是我在覆盖loadUserByUsername() 中调用方法SecurityContextHolder.getContext().getAuthentication() 得到了空对象。这是为什么？再说一遍 - 我怎样才能得到用户将在j_password 字段中填写的密码。

下面是我的代码：

web.xml

<?xml version="1.0" encoding="UTF-8"?>
<web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://java.sun.com/xml/ns/javaee" xmlns:web="http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd" xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd" version="2.5">
    <display-name>Frontend</display-name>

<!-- context param to load at startup -->
    <context-param>
        <param-name>contextConfigLocation</param-name>
        <param-value>classpath:applicationContext.xml</param-value>
    </context-param>
    <context-param>
        <param-name>org.apache.tiles.impl.BasicTilesContainer.DEFINITIONS_CONFIG</param-name>
        <param-value>/WEB-INF/configs/tiles-resources.xml</param-value>
  </context-param>

  <!-- filters -->

    <!-- ============ Spring Security Filter ============= -->
    <filter>
        <filter-name>springSecurityFilterChain</filter-name>
        <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
    </filter>
    <filter-mapping>
      <filter-name>springSecurityFilterChain</filter-name>
      <url-pattern>/*</url-pattern>
    </filter-mapping>

    <!-- struts2 filter -->      
  <filter>
    <filter-name>struts2</filter-name>
    <filter-class>org.apache.struts2.dispatcher.ng.filter.StrutsPrepareAndExecuteFilter</filter-class>
    <init-param>
            <param-name>actionPackages</param-name>
            <param-value>fe.web.actions</param-value>
    </init-param>
  </filter>
   <filter-mapping>
        <filter-name>struts2</filter-name>
        <url-pattern>/*</url-pattern>
  </filter-mapping>

  <!-- listeners -->
  <listener>
    <listener-class>org.springframework.web.context.request.RequestContextListener</listener-class>
  </listener>
  <listener>
    <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
  </listener>
 <listener>
    <listener-class>org.apache.tiles.web.startup.TilesListener</listener-class>
  </listener>
  <listener>
    <listener-class> org.springframework.security.web.session.HttpSessionEventPublisher</listener-class>
  </listener>
</web-app>

spring-security.xml

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
       xmlns:lang="http://www.springframework.org/schema/lang"
       xmlns:context="http://www.springframework.org/schema/context"
       xmlns:tx="http://www.springframework.org/schema/tx"
       xmlns:sec="http://www.springframework.org/schema/security" 
       xsi:schemaLocation="http://www.springframework.org/schema/beans 
        http://www.springframework.org/schema/beans/spring-beans-3.2.xsd
        http://www.springframework.org/schema/context 
        http://www.springframework.org/schema/context/spring-context-3.2.xsd
        http://www.springframework.org/schema/tx 
        http://www.springframework.org/schema/tx/spring-tx-3.2.xsd
        http://www.springframework.org/schema/security 
        http://www.springframework.org/schema/security/spring-security-3.2.xsd">

       <sec:global-method-security secured-annotations="enabled" />

       <sec:http auto-config="true">
            <sec:intercept-url pattern="/**" access="ROLE_USER" />          
       </sec:http>

       <sec:authentication-manager>
            <sec:authentication-provider user-service-ref="UserAuthenticator">
                <sec:password-encoder hash="bcrypt" />
            </sec:authentication-provider>                  
        </sec:authentication-manager>       

        <bean id="UserAuthenticator" class="fe.security.UserAuthenticator"> 
        </bean>

</beans>

用户验证器

package fe.security;

import java.util.Collection;

import org.springframework.security.core.Authentication;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.context.SecurityContext;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.core.userdetails.UsernameNotFoundException;

public class UserAuthenticator implements UserDetailsService{

    @Override
    public UserDetails loadUserByUsername(String username)
            throws UsernameNotFoundException {

        System.out.println(username);
        SecurityContext con = SecurityContextHolder.getContext();
        Authentication auth = con.getAuthentication(); //--the authentication object here is NULL

        String credentials = (String) auth.getCredentials();
        System.out.println("Username=" + username);
        System.out.println("pass=" + credentials);
        return null;
    }


}

提前致谢！

================================================ ===================================

由于我没有足够的声誉，这里是解决方案：

好的，仔细阅读Spring Security reference documentation我明白了。

问题是 Spring Security 将来自函数 UserDetailsService.loadUserByUsername 返回的 UserDetails 的用户名和密码与 j_username 和 j_password 字段进行比较。 这意味着 DAO 对象应该返回带有设置字段用户名和密码的 UserDetails。

关于可空SecurityContextHolder.getContext().getAuthentication() 问题的答案是，在成功验证后SecurityContextHolder.getContext().getAuthentication() 应该返回not-nullable 对象。

问候

Answer 1

好的，仔细阅读Spring Security参考文档我明白了。

问题是 Spring Security 将来自函数 UserDetailsService.loadUserByUsername 返回的 UserDetails 的用户名和密码与 j_username 和 j_password 字段进行比较。这意味着 DAO 对象应该返回 UserDetails 并设置字段用户名和密码。

关于可空SecurityContextHolder.getContext().getAuthentication() 问题的答案是，在成功认证后SecurityContextHolder.getContext().getAuthentication() 应该返回不可空对象。

问候