带有额外字段的Spring Boot UserDetailsservice多用户

Question

我有一个Spring Boot项目，该项目有3种类型的用户（管理员，专家，客户），并且该应用程序适用于在现场注册的专家，以提供诸如将计算机修复的服务诸如向网站询问帮助的客户固定计算机之类的服务。

我具有不同类型的用户类型的继承。

@Entity
@Inheritance(strategy = InheritanceType.SINGLE_TABLE)
@DiscriminatorColumn(name = "USER_TYPE", discriminatorType = DiscriminatorType.INTEGER)
public abstract class User {

    @Id 
    @GeneratedValue(strategy = GenerationType.IDENTITY)
    private int id;

    private String username;
    private String password;
    private Set<String> roles = new HashSet<>();

    // getter & setter...
}


@Entity
@DiscriminatorValue("1")
public class Admin extends User {
}


@Entity
@DiscriminatorValue("2")
public class Expert extends User {

    private Byte[] expertPhoto;
    private String password;

    // some other fields & getter & setter...
}


@Entity
@DiscriminatorValue("3")
public class Customer extends User {

    private Long credit;
    private Set<CustomerOrder> orders = new HashSet<>();

    // some other fields & getter & setter...
}

我想使用Spring Boot Security并实现UserDetailsservice，我的问题是当我有不同的用户类型（专家，客户等）时如何设计？

我希望用户能够使用一个用户名担任不同的角色（管理员，专家，客户）。

我应该如何设计我的系统来解决这些要求？

Answer 1

您的角色模式似乎有些偏离。最好拥有一种用户的单一类型，然后用新的角色实体填充它。新的用户实体将看起来如下：

@Table(name = "user")
@Entity
public class User {

    @Id
    @Column(name = "id")
    @GeneratedValue(strategy = GenerationType.IDENTITY)
    private Long id;

    @Column(name = "username", unique = true, nullable = false)
    private String username;

    @Column(name = "password", nullable = false)
    private String password;

    @ManyToMany(fetch = FetchType.EAGER)
    @JoinTable(
            name = "user_role",
            joinColumns = {@JoinColumn(name = "user_id")},
            inverseJoinColumns = {@JoinColumn(name = "role_id")},
    )
    private Set<Role> roles;

// getters and setters & other fields user can have

}

角色实体看起来像这样：

@Entity
@Table(name = "role")
public class Role {

    @Id
    @Column(name = "id")
    @GeneratedValue(strategy = GenerationType.IDENTITY)
    private Long id;

    @Column(name = "role_name", unique = true, nullable = false)
    private String roleName;

    @ManyToMany(mappedBy = "roles")
    private Set<User> users;
}

然后，您需要实现org.springframework.security.core.core。 UserDetails.user接口用作userDetailsS​​ervice的Spring Security Class user 的具体实现。请注意，此类也称为用户，并且与系统上的用户类不同。

public class MyUserDetail extends User {

    private String otherFieldsLikePhoto; // you can add different fields like this to keep extra information

    public MyUserDetail(String username, String password, Collection<? extends GrantedAuthority> authorities, String otherFieldsLikePhoto) {
        super(username, password, authorities);
        this.otherFieldsLikePhoto = otherFieldsLikePhoto;
    }
}

然后，您可以通过实现org.springframework.security.core.core.userdetails.userdetailsservice，可以创建userDetailsS​​ervice。

您将获得userDetailsservice是在我们刚创建的myuserdetail格式中加载用户。这样就是这样：

public class MyUserDetailsService implements UserDetailsService {

    private final UserReadService userReadService; // put your service to get user from db

    public MyUserDetailsService(UserReadService UserReadService) {
        this.userReadService = UserReadService;
    }

    @Override
    public UserDetails loadUserByUsername(String username) {
        User user = userReadService.getByUsername(username); // get user from db
        String otherFieldsLikePhoto = getUserPhotoOrAnythingElse(user); // get your extra fields however you want

        return new MyUserDetail(
                user.getUsername(),
                user.getPassword(),
                getAuthoritySetOfUser(user), // notice how we embed roles to UserDetail
                otherFieldsLikePhoto
        );
    }

    // this function is not necessary but useful to calculate authority set calculation on helper
    private Set<SimpleGrantedAuthority> getAuthoritySetOfUser(User user) {
        Set<Role> userRoles = user.getRoles();  // get roles of user like ADMIN, EXPERT etc.
        Set<SimpleGrantedAuthority> authorities = roles.stream()
            .map(rolex -> new SimpleGrantedAuthority(rolex.getRoleName()))
            .collect(Collectors.toSet());
       

        return authorities;
    }

}