8.SpringSecurity-UserDetailsService、PasswordEncoder

UserDetailsService接口讲解

  当什么也没有配置的时候，账号和密码是由 Spring Security 定义生成的。而在实际项目中账号和密码都是从数据库中查询出来的。 所以我们要通过自定义逻辑控制认证逻辑。

  如何做呢？

  在过滤器链中有一个UsernamePasswordAuthenticationFilter过滤器是专门校验表单中用户名，密码的，但是这个是默认的。

  所以我们需要创建一个类继承然后重写它的attemptAuthentication方法，来获取传递进来的用户名和密码然后自定义校验，自定义的校验的结果肯定是成功和失败两种，UsernamePasswordAuthenticationFilter的基类AbstractAuthenticationProcessingFilter中便有成功和失败的这两种调用；

//成功
protected void successfulAuthentication(HttpServletRequest request,
      HttpServletResponse response, FilterChain chain, Authentication authResult)
      throws IOException, ServletException {

   if (logger.isDebugEnabled()) {
      logger.debug("Authentication success. Updating SecurityContextHolder to contain: "
            + authResult);
   }

   SecurityContextHolder.getContext().setAuthentication(authResult);

   rememberMeServices.loginSuccess(request, response, authResult);

   // Fire event
   if (this.eventPublisher != null) {
      eventPublisher.publishEvent(new InteractiveAuthenticationSuccessEvent(
            authResult, this.getClass()));
   }

   successHandler.onAuthenticationSuccess(request, response, authResult);
}

//失败
protected void unsuccessfulAuthentication(HttpServletRequest request,
      HttpServletResponse response, AuthenticationException failed)
      throws IOException, ServletException {
   SecurityContextHolder.clearContext();

   if (logger.isDebugEnabled()) {
      logger.debug("Authentication request failed: " + failed.toString(), failed);
      logger.debug("Updated SecurityContextHolder to contain null Authentication");
      logger.debug("Delegating to authentication failure handler " + failureHandler);
   }

   rememberMeServices.loginFail(request, response);

   failureHandler.onAuthenticationFailure(request, response, failed);
}

  也就是说，我们总共需要重写过滤器中的3个方法来完成这个逻辑；

  在通过attemptAuthentication获取到传递进来用户、密码后，经过UserDetailsService接口的loadUserByUsername方法来查询数据库，返回的值是UserDetails，这个接口是系统默认的用户“主体”；

public interface UserDetails extends Serializable {
   // ~ Methods
   // ========================================================================================================

   /**
    * Returns the authorities granted to the user. Cannot return <code>null</code>.
    *
    * @return the authorities, sorted by natural key (never <code>null</code>)
    */
   Collection<? extends GrantedAuthority> getAuthorities();

   /**
    * Returns the password used to authenticate the user.
    *
    * @return the password
    */
   String getPassword();

   /**
    * Returns the username used to authenticate the user. Cannot return <code>null</code>.
    *
    * @return the username (never <code>null</code>)
    */
   String getUsername();

   /**
    * Indicates whether the user's account has expired. An expired account cannot be
    * authenticated.
    *
    * @return <code>true</code> if the user's account is valid (ie non-expired),
    * <code>false</code> if no longer valid (ie expired)
    */
   boolean isAccountNonExpired();

   /**
    * Indicates whether the user is locked or unlocked. A locked user cannot be
    * authenticated.
    *
    * @return <code>true</code> if the user is not locked, <code>false</code> otherwise
    */
   boolean isAccountNonLocked();

   /**
    * Indicates whether the user's credentials (password) has expired. Expired
    * credentials prevent authentication.
    *
    * @return <code>true</code> if the user's credentials are valid (ie non-expired),
    * <code>false</code> if no longer valid (ie expired)
    */
   boolean isCredentialsNonExpired();

   /**
    * Indicates whether the user is enabled or disabled. A disabled user cannot be
    * authenticated.
    *
    * @return <code>true</code> if the user is enabled, <code>false</code> otherwise
    */
   boolean isEnabled();
}

  UserDetails的实现是User这个类；

public class User implements UserDetails, CredentialsContainer {

   private static final long serialVersionUID = SpringSecurityCoreVersion.SERIAL_VERSION_UID;

   private static final Log logger = LogFactory.getLog(User.class);

   // ~ Instance fields
   // ================================================================================================
   private String password;
   private final String username;
   private final Set<GrantedAuthority> authorities;
   private final boolean accountNonExpired;
   private final boolean accountNonLocked;
   private final boolean credentialsNonExpired;
   private final boolean enabled;

   // ~ Constructors
   // ===================================================================================================

   /**
    * 方法参数username，表示用户名。此值是客户端表单传递过来的数据。默认情况下必须叫 username，否则无
    * 法接收
    */
   public User(String username, String password,
         Collection<? extends GrantedAuthority> authorities) {
      this(username, password, true, true, true, true, authorities);
   }
   
   ******
   
   } 

PasswordEncoder接口讲解

  数据加密接口，用用于返回User对象里面密码加密

public interface PasswordEncoder {

   /**
    * Encode the raw password. Generally, a good encoding algorithm applies a SHA-1 or
    * greater hash combined with an 8-byte or greater randomly generated salt.
    */
    // 表示把参数按照特定的解析规则进行解析
   String encode(CharSequence rawPassword);

   /**
    * Verify the encoded password obtained from storage matches the submitted raw
    * password after it too is encoded. Returns true if the passwords match, false if
    * they do not. The stored password itself is never decoded.
    *
    * @param rawPassword the raw password to encode and match
    * @param encodedPassword the encoded password from storage to compare with
    * @return true if the raw password, after encoding, matches the encoded password from
    * storage
    */
    // 表示验证从存储中获取的编码密码与编码后提交的原始密码是否匹配。如果密码匹
    //配，则返回 true；如果不匹配，则返回 false。第一个参数表示需要被解析的密码。第二个
    //参数表示存储的密码。
   boolean matches(CharSequence rawPassword, String encodedPassword);

   /**
    * Returns true if the encoded password should be encoded again for better security,
    * else false. The default implementation always returns false.
    * @param encodedPassword the encoded password to check
    * @return true if the encoded password should be encoded again for better security,
    * else false.
    */
    // 表示如果解析的密码能够再次进行解析且达到更安全的结果则返回 true，否则返回
    // false。默认返回 false。
   default boolean upgradeEncoding(String encodedPassword) {
      return false;
   }

  PasswordEncoder接口的实现是BCryptPasswordEncoder类

public class BCryptPasswordEncoder implements PasswordEncoder {
   private Pattern BCRYPT_PATTERN = Pattern
         .compile("\\A\\$2(a|y|b)?\\$(\\d\\d)\\$[./0-9A-Za-z]{53}");
   private final Log logger = LogFactory.getLog(getClass());

   private final int strength;
   private final BCryptVersion version;

   private final SecureRandom random;


   public BCryptPasswordEncoder() {
      this(-1);
   }

   /**
    * @param strength the log rounds to use, between 4 and 31
    */
   public BCryptPasswordEncoder(int strength) {
      this(strength, null);
   }

   /**
    * @param version the version of bcrypt, can be 2a,2b,2y
    */
   public BCryptPasswordEncoder(BCryptVersion version) {
      this(version, null);
   }

   /**
    * @param version the version of bcrypt, can be 2a,2b,2y
    * @param random  the secure random instance to use
    */
   public BCryptPasswordEncoder(BCryptVersion version, SecureRandom random) {
      this(version, -1, random);
   }

   /**
    * @param strength the log rounds to use, between 4 and 31
    * @param random   the secure random instance to use
    */
   public BCryptPasswordEncoder(int strength, SecureRandom random) {
      this(BCryptVersion.$2A, strength, random);
   }

   /**
    * @param version  the version of bcrypt, can be 2a,2b,2y
    * @param strength the log rounds to use, between 4 and 31
    */
   public BCryptPasswordEncoder(BCryptVersion version, int strength) {
      this(version, strength, null);
   }

   /**
    * @param version  the version of bcrypt, can be 2a,2b,2y
    * @param strength the log rounds to use, between 4 and 31
    * @param random   the secure random instance to use
    */
   public BCryptPasswordEncoder(BCryptVersion version, int strength, SecureRandom random) {
      if (strength != -1 && (strength < BCrypt.MIN_LOG_ROUNDS || strength > BCrypt.MAX_LOG_ROUNDS)) {
         throw new IllegalArgumentException("Bad strength");
      }
      this.version = version;
      this.strength = strength == -1 ? 10 : strength;
      this.random = random;
   }

   public String encode(CharSequence rawPassword) {
      if (rawPassword == null) {
         throw new IllegalArgumentException("rawPassword cannot be null");
      }

      String salt;
      if (random != null) {
         salt = BCrypt.gensalt(version.getVersion(), strength, random);
      } else {
         salt = BCrypt.gensalt(version.getVersion(), strength);
      }
      return BCrypt.hashpw(rawPassword.toString(), salt);
   }

   public boolean matches(CharSequence rawPassword, String encodedPassword) {
      if (rawPassword == null) {
         throw new IllegalArgumentException("rawPassword cannot be null");
      }

      if (encodedPassword == null || encodedPassword.length() == 0) {
         logger.warn("Empty encoded password");
         return false;
      }

      if (!BCRYPT_PATTERN.matcher(encodedPassword).matches()) {
         logger.warn("Encoded password does not look like BCrypt");
         return false;
      }

      return BCrypt.checkpw(rawPassword.toString(), encodedPassword);
   }

   @Override
   public boolean upgradeEncoding(String encodedPassword) {
      if (encodedPassword == null || encodedPassword.length() == 0) {
         logger.warn("Empty encoded password");
         return false;
      }

      Matcher matcher = BCRYPT_PATTERN.matcher(encodedPassword);
      if (!matcher.matches()) {
         throw new IllegalArgumentException("Encoded password does not look like BCrypt: " + encodedPassword);
      }
      else {
         int strength = Integer.parseInt(matcher.group(2));
         return strength < this.strength;
      }
   }

   /**
    * Stores the default bcrypt version for use in configuration.
    *
    * @author Lin Feng
    */
   public enum BCryptVersion {
      $2A("$2a"),
      $2Y("$2y"),
      $2B("$2b");

      private final String version;

      BCryptVersion(String version) {
         this.version = version;
      }

      public String getVersion() {
         return this.version;
      }
   }
}

  BCryptPasswordEncoder 是 Spring Security 官方推荐的密码解析器，平时多使用这个解析器。

  BCryptPasswordEncoder 是对 bcrypt 强散列方法的具体实现。是基于 Hash 算法实现的单向加密。可以通过 strength 控制加密强度，默认 10.

public static void main(String[] args) {
    // 创建密码解析器
    BCryptPasswordEncoder bCryptPasswordEncoder = new BCryptPasswordEncoder();
    // 对密码进行加密
    String newPassword = bCryptPasswordEncoder.encode("996");
    // 打印加密之后的数据
    System.out.println("加密之后数据：\t"+newPassword);
    //判断原字符加密后和加密之前是否匹配
    boolean result = bCryptPasswordEncoder.matches("996", newPassword);
    // 打印比较结果
    System.out.println("比较结果：\t"+result);
}

  控制台输出：