配置 AuthenticationManagerBuilder 以使用用户存储库

Question

我正在尝试使用 Spring Boot 和 JWT 来保护 Rest API。现在，我已经能够拼凑配置的各个部分，以获得使用硬编码的用户名和密码生成的令牌。我希望使用我的 User 类和存储库。

我已经能够在这里硬编码一个用户

@Override
public void configure(AuthenticationManagerBuilder auth) throws Exception {
    auth.inMemoryAuthentication()
        .withUser("user")
        .password(passwordEncoder().encode("password"))
        .authorities("ROLE_USER");
}

我应该将它指向我的 UserDetailsS​​ervice 吗？我该怎么做？

@Service
public class UserSecurityService implements UserDetailsService {

  private static final Logger LOG = LoggerFactory.getLogger(UserSecurityService.class);

  @Autowired
  private UserRepository userRepository;

  @Override
  public UserDetails loadUserByUsername (String username) throws UsernameNotFoundException {
    User user = userRepository.findByUsername(username);

    if (null == user) {
        LOG.warn("username not found");
        throw new UsernameNotFoundException("Username" + username + "not found");
    }
    return user;
  }
}

Answer 1

对于UserDetailsService，您需要DaoAuthenticationProvider 来处理任何身份验证请求。

这样做：

@Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
    auth.userDetailsService(userDetailsService).passwordEncoder(encoder());
}

// you shouldn't use plain text
@Bean
public PasswordEncoder encoder() {
    return new BCryptPasswordEncoder();
}

上面内部配置了DaoAuthenticationProvider。或者，您可以定义一个要注入的 bean：

@Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
    auth.authenticationProvider(authenticationProvider());
}

@Bean
public DaoAuthenticationProvider authenticationProvider() {
    DaoAuthenticationProvider authProvider = new DaoAuthenticationProvider();
    authProvider.setUserDetailsService(userDetailsService);
    authProvider.setPasswordEncoder(encoder());
    return authProvider;
}