spring - 配置中的默认管理员用户和数据库中的其他用户

Question

我正在使用带有 spring security 和 jpa 的 spring boot。我想在配置中有管理员用户，在数据库中有其他用户。问题是当我添加 UserDetailsS​​ervice 时，application.properties 中的管理员用户停止工作。

application.properties:

spring.security.user.name=admin
spring.security.user.password={bcrypt}$2a$10$7F7xGm8iuzafFA7RPS8gzeKJm9qNBwtejT4hSuBKXMNlc/4NxOy1G
spring.security.user.roles=admin

Spring Security 配置类:

@Configuration
@EnableWebSecurity
public class SecurityConfiguration extends WebSecurityConfigurerAdapter {

    @Qualifier("myUserDetailsService")
    @Autowired
    private UserDetailsService userDetailsService;

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.userDetailsService(userDetailsService).passwordEncoder(encodePWD());
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
                .csrf().disable()
                .authorizeRequests()
                .requestMatchers(PathRequest.toStaticResources().atCommonLocations()).permitAll()
                .antMatchers("/").permitAll()
                .antMatchers("/uzytkownik/pacjent/rejestracja").anonymous()
                .anyRequest().hasRole("admin")
                .and().formLogin().permitAll()
                ;


    }

    @Bean
    public BCryptPasswordEncoder encodePWD() {
        return new BCryptPasswordEncoder();
    }

}

Answer 1

在没有任何配置的情况下，Spring Security 默认从属性文件中读取用户。但是，如果您添加 UserDetailsS​​ervice ，则意味着您想要使用接口(interface)的方法 loadUserByUsername 读取用户。例如，可以实现此方法以从数据库读取用户

如果您希望将 application.properties 中的管理员用户视为用户，您可以在 UserDetailsS​​ervice 的实现中创建它:

import org.springframework.beans.factory.annotation.Value;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.core.userdetails.UsernameNotFoundException;
import org.springframework.stereotype.Service;

@Service
public class MyUserDetailsService implements UserDetailsService {

    @Value("${spring.security.user.name}")
    private String adminUserName;

    @Value("${spring.security.user.password}")
    private String adminPassword;

    @Value("${spring.security.user.roles}")
    private String adminRole;

    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        if(username.equals(adminPassword)) {
            return User.builder().username(adminUserName).password(adminPassword).roles(adminRole).build();
        }

        //return your other users from database here
        return null;
    }
}