弹簧安全5.7-如何返回自定义用户尾巴

Question

我已经看到了很多示例，其中一个用户创建自定义userDetailsservice，以覆盖loaduserByUsername方法并返回userDetails 对象。

这是以前使用这样的STH完成的，

@Override
public void configure(AuthenticationManagerBuilder authenticationManagerBuilder) throws Exception {
    authenticationManagerBuilder.userDetailsService(userDetailsService).passwordEncoder(passwordEncoder());
}

现在对新版本进行了我对如何执行此操作感到困惑的新版本，

我创建了bean，并使用了jdbcuserdetailsmanager，我可以配置我的自定义对用户和当局表的查询

  @Bean
  public UserDetailsManager userDetailsManager(DataSource dataSource) {
    String usersByUsernameQuery = "select username, password, enabled from tbl_users where username = ?";
    String authsByUserQuery = "select username, authority from tbl_authorities where username = ?";
    
    JdbcUserDetailsManager userDetailsManager = new JdbcUserDetailsManager(dataSource);
      
    userDetailsManager.setUsersByUsernameQuery(usersByUsernameQuery);
    userDetailsManager.setAuthoritiesByUsernameQuery(authsByUserQuery);
    
    return userDetailsManager;
  }

，但是如何使用额外字段返回自定义用户访问对象，例如带有新版本的电子邮件？

Answer 1

好的，经过许多尝试，我所做的就是完全删除jdbcuserdetailsmanager从我的自定义security> securityconfig类中的东西，我创建了一个自定义userdetailsservice和code > USERDETAILS类，它起作用。

因此，安全配置类没有有关用户身份验证的代码。
我很困惑，因为我认为我必须以某种方式在配置类中创建一个@Bean，我自己实现身份验证，并且总的来说，所有这些身份验证代码 在配置类内完成，但它可以使用这种方法。

@Service
public class MyCustomUserDetailsService implements UserDetailsService {

  @Autowired
  UserRepository userRepository;
  
  @Override
  public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
    User user = userRepository.findByUsername(username);
    
    if (user == null) {
      throw new UsernameNotFoundException("User Not Found with username: " + username);
    }
    return MyUserDetails.build(user);
  }
}

详细信息类

public class MyUserDetails implements UserDetails {

  private String username;
  private String firstName;
  private String lastName;

  @JsonIgnore
  private String password;

  private Collection<? extends GrantedAuthority> authorities;

  public MyUserDetails(String username, String firstName, String lastName, String password,
      Collection<? extends GrantedAuthority> authorities) {
    this.username = username;
    this.firstName = firstName;
    this.lastName = lastName;
    this.password = password;
    this.authorities = authorities;
  }

  public static MyUserDetails build(User user) {
    List<GrantedAuthority> authorities = user.getRoles().stream()
        .map(role -> new SimpleGrantedAuthority(role.getAuthority()))
        .collect(Collectors.toList());

    return new MyUserDetails(
        user.getUsername(), 
        user.getFirstName(),
        user.getLastName(),
        user.getPassword(), 
        authorities);
  }

  @Override
  public Collection<? extends GrantedAuthority> getAuthorities() {
    return authorities;
  }

  public String getFirstName() {
    return firstName;
  }

  public String getLastName() {
    return lastName;
  }

  @Override
  public String getPassword() {
    return password;
  }

  @Override
  public String getUsername() {
    return username;
  }

  @Override
  public boolean isAccountNonExpired() {
    return true;
  }

  @Override
  public boolean isAccountNonLocked() {
    return true;
  }

  @Override
  public boolean isCredentialsNonExpired() {
    return true;
  }

  @Override
  public boolean isEnabled() {
    return true;
  }

  @Override
  public boolean equals(Object o) {
    if (this == o)
      return true;
    if (o == null || getClass() != o.getClass())
      return false;
    MyUserDetails user = (MyUserDetails) o;
    
    return Objects.equals(username, user.username);
  }
}

还检查 Spring Security Security Architecture