Spring Security 默认登录页面既不呈现也不能够创建自定义登录页面

Posted 2023-02-27

【中文标题】Spring Security 默认登录页面既不呈现也不能够创建自定义登录页面

【英文标题】：Neither Spring Security Default Login page not rendering nor able to create custom login page

【发布时间】：2016-07-29 10:34:34

【问题描述】：

我是 Spring Security 的新手，并按照这些 1 2 链接进行配置-

WebSecurityConfigurerAdapterImplementaion-

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter 
    @Autowired
    private DataSource dataSource;

    @Autowired
    private CustomUserDetailsService customUserDetailsService;

    @Override
    protected void configure(AuthenticationManagerBuilder registry) throws Exception 
        registry.userDetailsService(customUserDetailsService);
    

      @Override
      public void configure(WebSecurity web) throws Exception 
        web.ignoring().antMatchers("/resources/**");
      

      @Override
      protected void configure(HttpSecurity http) throws Exception 
        http.csrf().disable()
        .authorizeRequests()
            .antMatchers("/login","/login/form**","/register","/logout").permitAll()
            .antMatchers("/admin","/admin/**").hasRole("ADMIN")
            .anyRequest().authenticated()
            .and()
        .formLogin()
            .loginPage("/login/form")
            .loginProcessingUrl("/login")
            .failureUrl("/login/form?error")
            .permitAll();
      

UserDetailsService 实现

@Component
public class CustomUserDetailsService implements UserDetailsService

    @Autowired
    private UserService userService;

    @Override
    public UserDetails loadUserByUsername(String userName) throws UsernameNotFoundException 
        User user = userService.findUserByEmail(userName);
        if(user == null)
            throw new UsernameNotFoundException("UserName "+userName+" not found");
        
        return new SecurityUser(user);
    

User 实现-

public class SecurityUser extends User implements UserDetails


    private static final long serialVersionUID = 1L;
    public SecurityUser(User user) 
        if(user != null)
        
            this.setId(user.getId());
            this.setName(user.getName());
            this.setEmail(user.getEmail());
            this.setPassword(user.getPassword());
            this.setDob(user.getDob());
            this.setRoles(user.getRoles());
               
    

    @Override
    public Collection<? extends GrantedAuthority> getAuthorities() 

        Collection<GrantedAuthority> authorities = new ArrayList<>();
        List<Role> userRoles = this.getRoles();

        if(userRoles != null)
        
            for (Role role : userRoles) 
                SimpleGrantedAuthority authority = new SimpleGrantedAuthority(role.getRoleName());
                authorities.add(authority);
            
        
        return authorities;
    

    @Override
    public String getPassword() 
        return super.getPassword();
    

    @Override
    public String getUsername() 
        return super.getEmail();
    

    @Override
    public boolean isAccountNonExpired() 
        return true;
    

    @Override
    public boolean isAccountNonLocked() 
        return true;
    

    @Override
    public boolean isCredentialsNonExpired() 
        return true;
    

    @Override
    public boolean isEnabled() 
        return true;
       

我的SpringWebAppInitializer 班级是-

public class SpringWebAppInitializer extends AbstractAnnotationConfigDispatcherServletInitializer

    @Override
    protected Class<?>[] getServletConfigClasses()
    
        return new Class<?>[]   AppConfig.class ;
    

    @Override
    protected String[] getServletMappings()
    
        return new String[]  "/" ;
    

    @Override
    protected Class<?>[] getRootConfigClasses()
    
        return new Class<?>[]  AppConfig.class;
    



    @Override
    protected Filter[] getServletFilters() 
       return new Filter[] 
               new DelegatingFilterProxy("springSecurityFilterChain"),
               new OpenEntityManagerInViewFilter();
     

我的问题是 - 我如何将此用户注册到 Spring Security？是否有任何默认控制器？如果是，它的 url 是什么？

<form:form id="loginForm" method="post" action="$appUrl/controller/login"
                    modelAttribute="user" class="register" role="form">
                    <div class="form-group">
                        <div class="">
                            <input type="text" id="username" name="username"
                                class="form-control register-input" placeholder="UserName" />
                        </div>
                    </div>
                    <div class="form-group">
                        <div class="">
                            <input type="password" id="password" name="password"
                                class="form-control register-input" placeholder="Password" />
                        </div>
                    </div>
                    <input type="hidden" name="$_csrf.parameterName"  value="$_csrf.token" />
                    <div class="form-group">
                        <div class="col-sm-offset-3">
                            <input type="submit" class="btn btn-primary" value="Login">
                        </div>
                    </div>
                </form:form>

【问题讨论】：

不，没有... Spring Security 只是为了保护您的应用程序，而不是关于用户管理。

@M.Deinum 那么我们如何将我们的用户注册到 Spring security

我缺少什么，即我应该在控制器中编写什么代码以使我的用户在春季确认该用户当前已登录。

创建表单，控制器并自己注册。

你想注册一个用户，即创建一个新用户还是你只是想登录？！我现在完全不清楚。

【参考方案1】：

Spring Security 不使用控制器，而是使用 servlet 过滤器来处理登录和注销（这使它可以与不使用 Spring MVC 的应用程序一起工作）。逻辑在UsernamePasswordAuthenticationFilter，默认登录URL是/login（POST）。在/login 有一个显示表单的GET 控制器是很常见的，但不是必须的。