如何使用 DaoAuthenticationProvider 向 Spring 应用程序添加一个 REST Angular 自定义登录页面

Posted 2023-02-27

【中文标题】如何使用 DaoAuthenticationProvider 向 Spring 应用程序添加一个 REST Angular 自定义登录页面

【英文标题】：how can i add a rest angular custom login page to spring app using DaoAuthenticationProvider

【发布时间】：2019-10-17 02:16:32

【问题描述】：

我正在使用 angular、spring boot 和数据库制作一个全栈 Web 应用程序，我有一个用于管理员和用户的登录表单，我为两者定义了角色。根据我发现的教程，我创建了 Spring Boot 登录配置，现在它可以工作了，我需要将它链接到我的 Angular 应用程序，但我是堆栈，我不知道如何设置 Angular 形式而不是 Angular 提供的形式因为它们不在同一个应用程序中，而且我一直在它们之间使用 REST 控制器。所以如果可以，我可以这样做吗？ 这是登录配置的代码

@Configuration
@EnableWebSecurity
public class SecurityConfiguration extends WebSecurityConfigurerAdapter 

private UserprincipalDetailSerice userprincipalDetailSerice;
 public SecurityConfiguration(UserprincipalDetailSerice userprincipalDetailSerice)
     this.userprincipalDetailSerice=userprincipalDetailSerice;
 

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception 
        auth.authenticationProvider(authenticationProvider());

    

@Bean
    DaoAuthenticationProvider authenticationProvider()
        DaoAuthenticationProvider daoAuthenticationProvider =new DaoAuthenticationProvider();
         daoAuthenticationProvider.setPasswordEncoder(passwordEncoder());
         daoAuthenticationProvider.setUserDetailsService(this.userprincipalDetailSerice);
return daoAuthenticationProvider;
 
    @Override
    protected void configure(HttpSecurity http) throws Exception 
        http
                .cors()
                .and()
                .authorizeRequests().antMatchers("/allproduits/**").permitAll()
                .antMatchers("/getallusers/personnels").hasAnyRole("ADMIN","ANY")
                .antMatchers("/getallusers/personnelsbyid/id").hasAnyRole("ADMIN","ANY")
                .antMatchers("/getallusers/updatepersonnel").hasAnyRole("ADMIN","ANY")
                .antMatchers("/getallusers/deletepersonnel/id").hasAnyRole("ADMIN")
                .antMatchers("/getallusers/encode").permitAll()
                .antMatchers("/getallusers/addcpersonnel").hasRole("ADMIN")
                .antMatchers("/getallcadres/**").hasAnyRole("ADMIN","ANY")
                .and()
                .httpBasic()
                .and()

                .csrf().disable();
      //  http.csrf().csrfTokenRepository(this.csrfRepo());

    

    @Override
    public void configure(WebSecurity web ) throws Exception
    
        web.ignoring().antMatchers( HttpMethod.OPTIONS, "/**" );
    




    @Bean
    CorsConfigurationSource corsConfigurationSource() 
        CorsConfiguration configuration = new CorsConfiguration();
        configuration.setAllowedOrigins(Arrays.asList("*"));
        configuration.setAllowedMethods(Arrays.asList("GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS"));
        configuration.setAllowedHeaders(Arrays.asList("authorization", "content-type", "x-auth-token"));
        configuration.setExposedHeaders(Arrays.asList("x-auth-token"));
        UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
        source.registerCorsConfiguration("/**", configuration);
        return source;
    

    @Bean
   public PasswordEncoder passwordEncoder() 
        return new BCryptPasswordEncoder();
    

UserDetailsS​​ervice 类：

@Service
public class UserprincipalDetailSerice implements UserDetailsService 

   private personnelReposotry personnelReposotry;
   public UserprincipalDetailSerice(personnelReposotry pR)
this.personnelReposotry=pR;
   
    @Override
    public UserDetails loadUserByUsername(String s) throws UsernameNotFoundException 
        personnel personnel=this.personnelReposotry.findByMatricule(s);
        UserPrincipal userPrincipal=new UserPrincipal(personnel);
        System.out.println(personnel.getMatricule()+personnel.getPsw()+"role:"+personnel.getRole());
        return userPrincipal;
    

UserDetails 类：

public class UserPrincipal implements UserDetails 
    private personnel personnel;
    public UserPrincipal(personnel personnel)
        this.personnel=personnel;
    
    @Override
    public Collection<? extends GrantedAuthority> getAuthorities() 
        List<GrantedAuthority> authorities= new ArrayList<>();
        this.personnel.getRoleList().forEach(p->
            GrantedAuthority authority = new SimpleGrantedAuthority("ROLE_" +p)  ;
            authorities.add(authority);

        );


        return authorities;
    

    @Override
    public String getPassword() 
        return this.personnel.getPsw();
    

    @Override
    public String getUsername() 
        return this.personnel.getMatricule();
    

    @Override
    public boolean isAccountNonExpired() 
        return true;
    

    @Override
    public boolean isAccountNonLocked() 
        return true;
    

    @Override
    public boolean isCredentialsNonExpired() 
        return true;
    

    @Override
    public boolean isEnabled() 
        return true;
    

【参考方案1】：

您当前的代码可能适用于独立应用程序，但不适用于这种情况。您可以改为使用该代码在身份验证成功时返回一个秘密 JWT（JSON Web 令牌），用户稍后可以随每个请求发送该代码，互联网上有很多教程。