Question

我正在尝试通过使用Spring Security验证请求，我关注了很少的博客和视频，但无法解决问题。安全配置已加载，但我的请求未通过身份验证。我收到403错误

WebSecurityConfigureAdapter中的Bean类

    public DaoAuthenticationProvider authenticationProvider() {
        DaoAuthenticationProvider authProvider = new DaoAuthenticationProvider();
        authProvider.setUserDetailsService(userService);
        System.out.println(userDetailsService());
        return authProvider; 
    }

通过骑行配置方法

@Override
    protected void configure(HttpSecurity http) throws Exception {
        http
        .authorizeRequests().antMatchers("/products","/orders").hasAnyRole("admin");//.authenticated(); 

    }

user details services overridding loadUserByUsername  
@Override
public UserDetails loadUserByUsername(String loginName) {

        String authenticated = "false";

        UserDetails userDetails = null;
        List<Users> usersList = usersRepository.findByLoginName(loginName);
        if(usersList.size()==0) {
            return null;
        }else {

            for (Users users : usersList) {
                List<Roles> rolesList = users.getRoles();
                for (Roles roles : rolesList) {

                    if(roles.getUserRole().equalsIgnoreCase("admin")) {
                        authenticated = "admin"; 
                        GrantedAuthority authority = new SimpleGrantedAuthority(authenticated);
                        User user = new User(users.getLoginName(),users.getPassword(),Arrays.asList(authority));
                        userDetails = (UserDetails)user; 
                    }       
                }
            }
            return userDetails;
        }

使用邮递员将凭据设置为basicAuth，抛出403错误

Answer 1

问题是... 我们需要在userdetails类中为不同的getter设置值，或显式设置为true 我在下面的getter中将其显式设置为true，它对我有用

    @Override
    public boolean isAccountNonExpired() {
        return true;
    }

    @Override
    public boolean isAccountNonLocked() {
        return true;
    }

    @Override
    public boolean isCredentialsNonExpired() {
        return true;
    }

    @Override
    public boolean isEnabled() {
        return true;
    }

DaoAuthenticationProvider没有被调用

1 个答案: