Spring Security 角色前缀和自定义用户详细信息服务

Question

如何在 Spring 中使用自定义用户详细信息服务将角色前缀设置为 "" ？

    <beans:bean id="authService" class="com.cisco.badges.business.services.AuthenticationService"/>

<authentication-manager>
        <authentication-provider user-service-ref="authService">
            <password-encoder ref="passwordEncoder">
                <salt-source ref="saltSource" />
            </password-encoder>
        </authentication-provider>
    </authentication-manager>

---

@Service("authService")
public class AuthenticationService extends BaseService implements UserDetailsService, IAuthenticationService {

    @Autowired
    IUserRepository userRepository;

    @Autowired
    IAuthorityRepository authorityRepository;

    public AuthenticationService() {

    }

    public UserDetails loadUserByUsername(String username)
            throws UsernameNotFoundException {

        User user = userRepository.findByUsername(username);

        if(user == null)
            throw new UsernameNotFoundException("No user with username '" + username + "' found!");

        List<GrantedAuthority> authList = new ArrayList<GrantedAuthority>();

        for (Role role : user.getRoles()) {
            authList.add(new GrantedAuthorityImpl(role.getName()));
        }

        UserAuthentication userAuthentication = new UserAuthentication(user.getUsername(), user.getPassword(), user.getEnabled() == 0 ? false : true, true, true, true, authList);

        userAuthentication.setSalt(user.getSalt());
        userAuthentication.setId(user.getId());

        return (UserDetails)userAuthentication;
    }
}

Answer 1

<beans:bean id="roleVoter" class="org.springframework.security.access.vote.RoleVoter">
    <beans:property name="rolePrefix" value="" />
</beans:bean>

就像这样

Answer 2

还可以使用映射器将 _ROLE 附加到您当前的角色。在 Spring Boot 中：

@Bean
public GrantedAuthoritiesMapper grantedAuthoritiesMapper() {
    SimpleAuthorityMapper simpleMapper = new SimpleAuthorityMapper();
    simpleMapper.setPrefix("ROLE_");

    return simpleMapper;
}

之后，您应该将此映射器添加到您的提供程序中：

@Bean
public DaoAuthenticationProvider authenticationProvider() {
    DaoAuthenticationProvider provider = new DaoAuthenticationProvider();
    provider.setAuthoritiesMapper(authoritiesMapper());

    return provider;
}