java - Spring Security认证简单登录

Question

我在 app-config.xml 中配置了以下内容:

<security:http auto-config="true" />
    <security:global-method-security secured-annotations="enabled" />

    <security:authentication-manager>
        <security:authentication-provider>
            <security:jdbc-user-service data-source-ref="dataSource"

                users-by-username-query="
                  select login, password 
                  from accounts where login=? and password=?" 

                authorities-by-username-query="
                  select a.login, ar.authority from accounts a, account_roles ar 
                  where a.account_id = ar.account_id and a.login =?  " 

            />
        </security:authentication-provider>
    </security:authentication-manager>

但是，当我启动应用程序时，它显示登录信息，并收到以下错误消息:

Reason: PreparedStatementCallback; uncategorized SQLException for SQL [select login, > password from accounts where login=? and password=?]; SQL state [90012]; error code [90012]; Parameter "#2" is not set; SQL statement: select login, password from accounts where login=? and password=? [90012-170]; nested exception is org.h2.jdbc.JdbcSQLException: Parameter "#2" is not set; SQL statement: select login, password from accounts where login=? and password=? [90012-170]

有什么问题吗？

我不完全确定 security:jdbc-user-service 是如何工作的？它如何填写我的选择查询中的=？

我的数据库定义为:

CREATE TABLE accounts (
  account_id VARCHAR NOT NULL,
  login VARCHAR NOT NULL,
  password VARCHAR NOT NULL,
  PRIMARY KEY (account_id)
);
CREATE TABLE account_roles (
  account_id VARCHAR NOT NULL,
  authority VARCHAR NOT NULL,
  PRIMARY KEY (account_id),
  CONSTRAINT FK_account_roles FOREIGN KEY (account_id) REFERENCES accounts (account_id)
);

谢谢

Answer 1

参数名称users-by-username-query表示查询将仅按用户名进行搜索，因此我建议将您的SQL查询修改为如下所示:

users-by-username-query="select login, password, 'true' as enabled from accounts where login=? limit 1"