Spring Security inmemory 身份验证问题

Question

我正在使用 Spring Security 内存身份验证，但它无法正常工作。 它正在生成默认密码，但没有采用我在配置中生成的 用户和密码。下面是我的控制器：

@CrossOrigin(origins = "*")
@EnableAutoConfiguration
@RestController
@RequestMapping("/api")
public class AppController {

     @RequestMapping(value="/hello", method=RequestMethod.GET, produces="text/plain")
     public String sayHello() {
         return "Hello welcome to spring security!!!!";
     }
}

下面是我的安全配置类：

@Component
@EnableWebSecurity
/*@EnableGlobalMethodSecurity*/
@EnableAutoConfiguration(exclude = { 
        org.springframework.boot.autoconfigure.security.SecurityAutoConfiguration.class 
    })
public class SecurityProvider extends WebSecurityConfigurerAdapter {

    @Override
    public void configure(HttpSecurity http) throws Exception {
        http
            .authorizeRequests()
                .antMatchers("/api/*").hasRole("ADMIN")
                .and()
            .formLogin();
    }

    @Autowired
    public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {           
        auth
            .inMemoryAuthentication()
                .withUser("ramu")
                    .password("password")
                    .roles("ADMIN")
                    .and()
                .withUser("gopal")
                    .password("password")
                    .roles("USER");
    }

    @Bean
    public AuthenticationManager authenticationManagerBean() throws Exception {
        // ALTHOUGH THIS SEEMS LIKE USELESS CODE,
        // ITS REQUIRED TO PREVENT SPRING BOOT AUTO-CONFIGURATION
        return super.authenticationManagerBean();
    }
}

我还尝试通过使用以下注释在主应用程序中排除 SecurityAutoconfiguration.class：

@SpringBootApplication(exclude = {SecurityAutoConfiguration.class })
public class App {
    public static void main( String[] args ) {
        SpringApplication.run(App.class, args);
    }
}

但运气不好，它没有使用我在配置类中配置的用户名和密码。

Answer 1

我已修复您的设置，请参阅下面的代码。

WebSecurityConfig（而不是之前的ServiceProvider 组件）：

@Configuration
@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

    @Override
    public void configure(HttpSecurity http) throws Exception{
        http.authorizeRequests().antMatchers("/api/*").hasRole("ADMIN").and().formLogin();

    }

    PasswordEncoder passwordEncoder =
            PasswordEncoderFactories.createDelegatingPasswordEncoder();

    @Autowired
    public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception{
        auth.inMemoryAuthentication()
                .passwordEncoder(passwordEncoder)
                .withUser("ramu")
                .password("password")
                .roles("ADMIN")
            .and()
                .passwordEncoder(passwordEncoder)
                .withUser("gopal")
                .password("password")
                .roles("USER");
    }
}

RestController：

@CrossOrigin(origins = "*")
@EnableAutoConfiguration
@RestController
@RequestMapping("/api")
public class AppController {

@RequestMapping(value="/hello",method=RequestMethod.GET,produces="text/plain")
   public String sayHello(){

       return "Hello welcome to spring security!!!!";
   }

}

我必须改变的地方：

1. ServiceProvider @Component -> WebSecurityConfig @Configuration
2. 我注册了PasswordEncoder
3. 我还原了所有 @EnableAutoConfiguration 注释
4. 我恢复了AuthenticationManager Bean

我使用了spring-parent：

<parent>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-parent</artifactId>
    <version>2.0.4.RELEASE</version>
    <relativePath/> <!-- lookup parent from repository -->
</parent>

---

spring-boot-starter-parent版本1.5.7.RELEASE的解决方案：

@Configuration
@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

    @Override
    public void configure(HttpSecurity http) throws Exception{
        http.authorizeRequests().antMatchers("/api/*").hasRole("ADMIN").and().formLogin();

    }


    @Autowired
    public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception{
        auth.inMemoryAuthentication()
                .withUser("ramu")
                .password("password")
                .roles("ADMIN")
            .and()
                .withUser("gopal")
                .password("password")
                .roles("USER");
    }}

也许考虑在这里也使用一种passwordEncoder。