Spring Security с реализацией UserDetailsService

Question

Я пытался настроить Spring Security с помощью UserDetailsService.В качестве примера я использовал учебник baeldung .Приложение запущено без каких-либо исключений, но аутентификация не работает.В настоящее время у меня есть основные настройки Java Spring и Spring Java настройки для каждого модуля приложения.

Core Spring Java Conf:

public class AppInitializer implements WebApplicationInitializer {

@Override
@Autowired
public void onStartup(ServletContext container) throws ServletException {
    AnnotationConfigWebApplicationContext context = getContext();
    container.addListener(new ContextLoaderListener(context));

    container.setInitParameter("spring.profiles.active", "dev"); //Workaround for NamingException
    container.setInitParameter("spring.profiles.default", "dev"); //Workaround for NamingException
    container.setInitParameter("spring.liveBeansView.mbeanDomain", "dev"); //Workaround for NamingException

    ServletRegistration.Dynamic mainDispatcher =
            container.addServlet("dispatcher", new DispatcherServlet(context));
    ServletRegistration.Dynamic businessDispatcher =
            container.addServlet("businessDispatcher", BusinessAppConfig.createDispatcherServlet(context));
    ServletRegistration.Dynamic ppaDispatcher =
            container.addServlet("ppaDispatcher", PpaAppConfig.createDispatcherServlet(context));

    initDispatcher(mainDispatcher, 1, "/");
    initDispatcher(businessDispatcher, 2, "/business");
    initDispatcher(businessDispatcher, 3, "/ppa");
}

private void initDispatcher(ServletRegistration.Dynamic dispatcher, int loadOnStartUp, String mapping) {
    if (dispatcher == null) {
        System.out.println("Servlet" + dispatcher.getName() + " is already added");
    } else {
        dispatcher.setLoadOnStartup(loadOnStartUp);
        dispatcher.addMapping(mapping);
    }
}

public AnnotationConfigWebApplicationContext getContext() {
    AnnotationConfigWebApplicationContext context = new AnnotationConfigWebApplicationContext();
    context.register(MvcConfiguration.class);
    return context;
}

@Bean(name = "propertyConfigurer")
public PropertySourcesPlaceholderConfigurer getPropertyPlaceholderConfigurer() {
    PropertySourcesPlaceholderConfigurer placeholderConfigurer = new PropertySourcesPlaceholderConfigurer();
    placeholderConfigurer.setLocation(new ClassPathResource("common.properties"));
    placeholderConfigurer.setLocation(new ClassPathResource("amazon.S3Storage.properties"));
    placeholderConfigurer.setLocation(new ClassPathResource("local.storage.properties"));
    placeholderConfigurer.setLocation(new ClassPathResource("log4j.properties"));
    placeholderConfigurer.setIgnoreUnresolvablePlaceholders(true);
    return placeholderConfigurer;
}

}

Spring Java Conf длябизнес-модуль

@Configuration
public class BusinessAppConfig {

    public static Servlet createDispatcherServlet(AnnotationConfigWebApplicationContext context) {
        context.register(BusinessMvcConfig.class);
        context.register(BusinessHibernateConfig.class);
        context.register(BusinessSecurityConfig.class);
        return new DispatcherServlet(context);
    }
}

Java Security Spring для бизнес-модуля

@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class BusinessSecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired
    private UserDetailsService userDetailsService;

    @Autowired
    public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
        auth.authenticationProvider(authenticationProvider());
    }

    @Bean
    @Override
    public AuthenticationManager authenticationManagerBean() throws Exception {
        return super.authenticationManagerBean();
    }

    @Autowired
    public DaoAuthenticationProvider authenticationProvider() {
        DaoAuthenticationProvider authProvider = new DaoAuthenticationProvider();
        authProvider.setUserDetailsService(userDetailsService);
        authProvider.setPasswordEncoder(getPasswordEncoder());
        return authProvider;
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests().anyRequest().authenticated().
                and().formLogin().permitAll().
                and().logout().permitAll();
    }

    @Bean(name = "passwordEncoder")
    public PasswordEncoder getPasswordEncoder(){
        return new BCryptPasswordEncoder(11);
    }
}

Реализация UserDetailsService

@Service
public class UserDetailsServiceImpl extends BaseServiceImpl<User, UserRepository<User>> implements UserDetailsService, UserService {

    @Override
    public UserDetails loadUserByUsername(String login) throws UsernameNotFoundException {

        User user = dao.findUserByLogin(login);

        if (user == null) {
            throw new UsernameNotFoundException(login);
        }

        return new UserPrincipal(user);
    }
}

UserDetails на основе модели пользователя

public class UserPrincipal implements UserDetails, Serializable {

    private User user;

    public UserPrincipal(User user) {
        this.user = user;
    }

    @Override
    public Collection<? extends GrantedAuthority> getAuthorities() {
        return null;
    }

    @Override
    public String getPassword() {
        return user.getPassword();
    }

    @Override
    public String getUsername() {
        return user.getName();
    }

    @Override
    public boolean isAccountNonExpired() {
        return user.isAccountNonExpired();
    }

    @Override
    public boolean isAccountNonLocked() {
        return user.isAccountNonLocked();
    }

    @Override
    public boolean isCredentialsNonExpired() {
        return user.isCredentialsNonExpired();
    }

    @Override
    public boolean isEnabled() {
        return user.isEnabled();
    }
}

В режиме отладки я столкнулся с парой исключений

2018-05-16 22:23:51 DEBUG InjectionMetadata:74 - Registered injected element on class [business.config.BusinessSecurityConfig$$EnhancerBySpringCGLIB$$c0bd9f7f]: AutowiredMethodElement for public org.springframework.security.authentication.dao.DaoAuthenticationProvider business.config.BusinessSecurityConfig.authenticationProvider()
2018-05-16 22:23:51 DEBUG InjectionMetadata:74 - Registered injected element on class [business.config.BusinessSecurityConfig$$EnhancerBySpringCGLIB$$c0bd9f7f]: AutowiredMethodElement for public void business.config.BusinessSecurityConfig.configureGlobal(org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder) throws java.lang.Exception
2018-05-16 22:23:51 DEBUG DefaultListableBeanFactory:569 - Eagerly caching bean 'businessSecurityConfig' to allow for resolving potential circular references

И

[org.springframework.security.config.annotation.authentication.configuration.AuthenticationConfiguration$$EnhancerBySpringCGLIB$$3d61bda9]: AutowiredMethodElement for public void org.springframework.security.config.annotation.authentication.configuration.AuthenticationConfiguration.setGlobalAuthenticationConfigurers(java.util.List) throws java.lang.Exception

И

2018-05-16 22:24:11 DEBUG AnnotationUtils:1889 - Failed to meta-introspect annotation interface org.springframework.beans.factory.annotation.Autowired: java.lang.NullPointerException

Итак, что не так в этой конфигурации

Answer 1

Итак, я сделал пару ошибок при настройке Spring Security.Найти эти ошибки помог анализ отладочных сообщений.

Отладка сообщений для запроса до внесения изменений:

2018-06-03 00:14:26 DEBUG DispatcherServlet:891 - DispatcherServlet with name 'dispatcher' processing GET request for [/]
2018-06-03 00:14:26 DEBUG RequestMappingHandlerMapping:312 - Looking up handler method for path /
2018-06-03 00:14:26 DEBUG RequestMappingHandlerMapping:319 - Returning handler method [public java.lang.String business.controller.HomePageController.getHomePage(java.util.Map<java.lang.String, java.lang.Object>)]
2018-06-03 00:14:26 DEBUG DefaultListableBeanFactory:254 - Returning cached instance of singleton bean 'homePageController'
2018-06-03 00:14:26 DEBUG DispatcherServlet:979 - Last-Modified value for [/] is: -1
2018-06-03 00:14:26 DEBUG DispatcherServlet:1319 - Rendering view [org.springframework.web.servlet.view.JstlView: name 'index'; URL [/WEB-INF/views/index.jsp]] in DispatcherServlet with name 'dispatcher'
2018-06-03 00:14:26 DEBUG DefaultListableBeanFactory:254 - Returning cached instance of singleton bean 'requestDataValueProcessor'
2018-06-03 00:14:26 DEBUG JstlView:168 - Forwarding to resource [/WEB-INF/views/index.jsp] in InternalResourceView 'index'
2018-06-03 00:14:26 DEBUG DispatcherServlet:1000 - Successfully completed request
2018-06-03 00:14:31 DEBUG DispatcherServlet:891 - DispatcherServlet with name 'dispatcher' processing GET request for [/business/project/new]
2018-06-03 00:14:31 DEBUG RequestMappingHandlerMapping:312 - Looking up handler method for path /business/project/new
2018-06-03 00:14:31 DEBUG RequestMappingHandlerMapping:319 - Returning handler method [public java.lang.String business.controller.ProjectController.newProject(org.springframework.ui.Model) throws java.lang.Exception]
2018-06-03 00:14:31 DEBUG DefaultListableBeanFactory:254 - Returning cached instance of singleton bean 'projectController'
2018-06-03 00:14:31 DEBUG DispatcherServlet:979 - Last-Modified value for [/business/project/new] is: -1

Здесь мы можем увидеть два запроса.

• Первый запрос "/" обрабатывается mainDispatcher (см. AppInitializer в самом начале).
• Второй запрос / business / project / new также обрабатывается mainDispatcher , но ожидается обработчик businessDispatcher .

Проблема в неправильном пути.Чтобы решить эту проблему, вы должны изменить старые настройки:

ServletRegistration.Dynamic businessDispatcher =
    container.addServlet("businessDispatcher", BusinessAppConfig.createDispatcherServlet(context));
initDispatcher(businessDispatcher, 2, "/business/*");

Отладка после изменения пути:

2018-06-03 20:33:43 DEBUG DispatcherServlet:891 - DispatcherServlet with name 'businessDispatcher' processing GET request for [/business/]
2018-06-03 20:33:43 DEBUG RequestMappingHandlerMapping:312 - Looking up handler method for path /
2018-06-03 20:33:43 DEBUG RequestMappingHandlerMapping:319 - Returning handler method [public java.lang.String business.controller.HomePageController.getHomePage(java.util.Map<java.lang.String, java.lang.Object>)]
2018-06-03 20:33:43 DEBUG DefaultListableBeanFactory:254 - Returning cached instance of singleton bean 'homePageController'
2018-06-03 20:33:43 DEBUG DispatcherServlet:979 - Last-Modified value for [/business/] is: -1
2018-06-03 20:33:43 DEBUG DispatcherServlet:1319 - Rendering view [org.springframework.web.servlet.view.JstlView: name 'index'; URL [/WEB-INF/views/index.jsp]] in DispatcherServlet with name 'businessDispatcher'
2018-06-03 20:33:43 DEBUG DefaultListableBeanFactory:254 - Returning cached instance of singleton bean 'requestDataValueProcessor'
2018-06-03 20:33:43 DEBUG JstlView:168 - Forwarding to resource [/WEB-INF/views/index.jsp] in InternalResourceView 'index'
2018-06-03 20:33:43 DEBUG DispatcherServlet:1000 - Successfully completed request

Итак, здесь вы можете увидеть, что / business / project / URL обрабатывается правильным диспетчером - businessDispatcher.

Кроме того, контроллер @ReqestMapping следует изменить с

@Controller
@RequestMapping(value = "/business/project")
public class ProjectController {

На

@Controller
@RequestMapping(value = "/project")
public class ProjectController {

Чтобы защитить метод отпри прямом наборе URL в адресной строке браузера требуются следующие изменения:

Проверка для securedEnabled = true, prePostEnabled = true

@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(securedEnabled = true, prePostEnabled = true)
public class BusinessSecurityConfig extends WebSecurityConfigurerAdapter {

Каждый контроллер или определенный метод долженбыть аннотированным @ PreAuthorize

@Controller
@RequestMapping(value = "/project")
@PreAuthorize("isAuthenticated()")
public class ProjectController {

ИЛИ

@PreAuthorize("isAuthenticated()")
@RequestMapping(value = "/new", method = RequestMethod.GET)
public String newProject (Model model) throws Exception {
    model.addAttribute(new Project());
    return "project/new";
}

Примечание если не авторизованный пользователь пытается получить доступ к защищенным методам AuthenticationCredentialsNotFoundExceptionбудет распространяться.

Для обработки такого рода исключений см. здесь