spring-security使用-自定义数据源(二)

合集 - spring-security源码阅读(28)

1.Spring-Security系列导航2021-11-152.spring-security使用-登录(一)2020-12-10

3.spring-security使用-自定义数据源(二)2020-12-22

4.spring-security使用-更友好的方式扩展登录AuthenticationProvider(三)2021-01-045.spring-security使用-获得当前用户信息(四)2021-01-056.spring-security使用-同一个账号只允许登录一次(五)2021-01-067.spring-security使用-session共享(六)2021-01-078.spring-security使用-安全防护HttpFirewall(七)2021-01-299.spring-security使用-权限控制(八)2021-11-0310.spring-security源码-初始化(九)2021-11-0411.spring-security源码-如何初始化SecurityFilterChain到Servlet2024-03-1012.spring-security源码-FilterChainProxy2024-03-1013.spring-security源码-Filter之WebAsyncManagerIntegrationFilter(十)2021-11-0914.Spring-security源码-Filter之SecurityContextPersistenceFilter(十一)2021-11-0915.Spring-security源码-Filter之HeaderWriterFilter(十二)2021-11-1016.Spring-security源码-Filter之LogoutFilter(十三)2021-11-1017.Spring-security源码-Filter之UsernamePasswordAuthenticationFilter(十四)2021-11-1018.Spring-security源码-Filter之ConcurrentSessionFilter(十五)2021-11-1019.Spring-security源码-Filter之SessionManagementFilter(十六)2021-11-1120.Spring-security源码-Filter之RememberMeAuthenticationFilter(十七)2021-11-1121.Spring-security源码-Filter之ExceptionTranslationFilter(十八)2021-11-1222.Spring-security源码-Filter之FilterSecurityInterceptor(十九)2021-11-1323.Spring-security源码-注解权限原理(二十)2021-11-1324.Spring-security源码-注解权限原理之MethodSecurityInterceptor(二十一)2021-11-1525.Spring-Security基于源码扩展-一套系统多套登录逻辑(二十二)2021-11-1526.Spring-Security基于源码扩展-自定义登录(二十三)2021-11-1527.Spring-Security基于源码扩展-自定义认证失败返回(二十四)2021-11-1528.Spring-Security基于源码扩展-自定义授权注解(二十五)2021-11-15

收起

文章主目录

• 部分源码
• 自定义UserDetailsService

回到顶部

部分源码

1.前面一demo的配置是基于内存数据源配置,但是再实际应用中我们都是查库

   @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        /**
         *  inMemoryAuthentication 开启在内存中定义用户
         *  多个用户通过and隔开
         */
        auth.inMemoryAuthentication()
                .withUser("liqiang").password("liqiang").roles("admin")
                 .and()
                .withUser("admin").password("admin").roles("admin");
    }

2.查看具体方法org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder#inMemoryAuthentication

   public InMemoryUserDetailsManagerConfigurer<AuthenticationManagerBuilder> inMemoryAuthentication() throws Exception {
        return (InMemoryUserDetailsManagerConfigurer)this.apply(new InMemoryUserDetailsManagerConfigurer());
    }

 private <C extends UserDetailsAwareConfigurer<AuthenticationManagerBuilder, ? extends UserDetailsService>> C apply(C configurer) throws Exception {
        //这里实际拿到对应的Configer的的UserDetailsService
        this.defaultUserDetailsService = configurer.getUserDetailsService();
        //这里先不管
        return (UserDetailsAwareConfigurer)super.apply(configurer);
    }

3.查看UserDetailsService接口定义

 public interface UserDetailsService {
        //根据用户名查询用户信息
        UserDetails loadUserByUsername(String var1) throws UsernameNotFoundException;
    }

4.UserDetails接口定义

public class UserDetails {
    /**
     * 用户的权限信息
     * @return
     */
    Collection<? extends GrantedAuthority> getAuthorities();

    /**
     * 用户密码
     * @return
     */
    String getPassword();
    /***
     * 用户名
     * @return
     */
    String getUsername();
    /**
     *表示帐号是否未过期
     * @return
     */
    boolean isAccountNonExpired();
    /**
     *表示帐号是否未锁定
     * @return
     */
    boolean isAccountNonLocked();
    /**
     * 表示登录凭据是否未过期
     * @return
     */
    boolean isCredentialsNonExpired();
    /**
     * 是否启用
     * @return
     */
    boolean isEnabled();
}

回到顶部

自定义UserDetailsService

1.先自定义封装查询用户信息的dto

public class UserInfoDto implements UserDetails {
    private List<?extends GrantedAuthority> authorities;
    private String password;
    private String username;

    public void setAuthorities(List<? extends GrantedAuthority> authorities) {
        this.authorities = authorities;
    }

    public void setPassword(String password) {
        this.password = password;
    }

    public void setUsername(String username) {
        this.username = username;
    }

    /**
     * 用户的权限信息
     * @return
     */
    @Override
    public Collection<? extends GrantedAuthority> getAuthorities() {
        return authorities;
    }
    /**
     * 用户密码
     * @return
     */
    @Override
    public String getPassword() {
        return password;
    }
    /***
     * 用户名
     * @return
     */
    @Override
    public String getUsername() {
        return username;
    }
    /**
     *表示帐号是否未过期
     * @return
     */
    @Override
    public boolean isAccountNonExpired() {
        return true;
    }
    /**
     *表示帐号是否未锁定
     * @return
     */
    @Override
    public boolean isAccountNonLocked() {
        return true;
    }
    /**
     * 表示登录凭据是否未过期
     * @return
     */
    @Override
    public boolean isCredentialsNonExpired() {
        return true;
    }
    /**
     * 是否启用
     * @return
     */
    @Override
    public boolean isEnabled() {
        return true;
    }
}

2.实现自定义UserDetailService

@Service
public class UserService  implements UserDetailsService {
    /**
     * 根据用户名查询用户信息
     * @param s
     * @return
     * @throws UsernameNotFoundException
     */
    @Override
    public UserDetails loadUserByUsername(String s) throws UsernameNotFoundException {
        //模拟查询db
        System.out.println("模拟查询db");
        //将db查询结果封装返回
        UserInfoDto userInfoDto=new UserInfoDto();
        userInfoDto.setUsername(s);
        userInfoDto.setPassword("22222");
        //权限标识
        userInfoDto.setAuthorities(null);
        return userInfoDto;
    }
}

3.设置自定义的userServuce

 @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        //设置自定义的userDetailService
        auth.userDetailsService(userService);
    }