的web.xml

Question

我正在使用struts2和spring security创建一个应用程序，并且几乎没有问题/问题。

如何将密码传递给DAO以便将密码和用户名与DB的结果进行比较？我知道可以通过实现UserDetailsService并覆盖方法
来传递用户名
public UserDetails loadUserByUsername(String username)
第二个问题是我在重写SecurityContextHolder.getContext().getAuthentication()中调用方法loadUserByUsername()时得到了null对象。这是为什么？再次 - 如何获取用户将填写j_password字段的密码。

以下是我的代码：

的web.xml

<?xml version="1.0" encoding="UTF-8"?>
<web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://java.sun.com/xml/ns/javaee" xmlns:web="http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd" xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd" version="2.5">
    <display-name>Frontend</display-name>

<!-- context param to load at startup -->
    <context-param>
        <param-name>contextConfigLocation</param-name>
        <param-value>classpath:applicationContext.xml</param-value>
    </context-param>
    <context-param>
        <param-name>org.apache.tiles.impl.BasicTilesContainer.DEFINITIONS_CONFIG</param-name>
        <param-value>/WEB-INF/configs/tiles-resources.xml</param-value>
  </context-param>

  <!-- filters -->

    <!-- ============ Spring Security Filter ============= -->
    <filter>
        <filter-name>springSecurityFilterChain</filter-name>
        <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
    </filter>
    <filter-mapping>
      <filter-name>springSecurityFilterChain</filter-name>
      <url-pattern>/*</url-pattern>
    </filter-mapping>

    <!-- struts2 filter -->      
  <filter>
    <filter-name>struts2</filter-name>
    <filter-class>org.apache.struts2.dispatcher.ng.filter.StrutsPrepareAndExecuteFilter</filter-class>
    <init-param>
            <param-name>actionPackages</param-name>
            <param-value>fe.web.actions</param-value>
    </init-param>
  </filter>
   <filter-mapping>
        <filter-name>struts2</filter-name>
        <url-pattern>/*</url-pattern>
  </filter-mapping>

  <!-- listeners -->
  <listener>
    <listener-class>org.springframework.web.context.request.RequestContextListener</listener-class>
  </listener>
  <listener>
    <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
  </listener>
 <listener>
    <listener-class>org.apache.tiles.web.startup.TilesListener</listener-class>
  </listener>
  <listener>
    <listener-class> org.springframework.security.web.session.HttpSessionEventPublisher</listener-class>
  </listener>
</web-app>

弹簧security.xml文件

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
       xmlns:lang="http://www.springframework.org/schema/lang"
       xmlns:context="http://www.springframework.org/schema/context"
       xmlns:tx="http://www.springframework.org/schema/tx"
       xmlns:sec="http://www.springframework.org/schema/security" 
       xsi:schemaLocation="http://www.springframework.org/schema/beans 
        http://www.springframework.org/schema/beans/spring-beans-3.2.xsd
        http://www.springframework.org/schema/context 
        http://www.springframework.org/schema/context/spring-context-3.2.xsd
        http://www.springframework.org/schema/tx 
        http://www.springframework.org/schema/tx/spring-tx-3.2.xsd
        http://www.springframework.org/schema/security 
        http://www.springframework.org/schema/security/spring-security-3.2.xsd">

       <sec:global-method-security secured-annotations="enabled" />

       <sec:http auto-config="true">
            <sec:intercept-url pattern="/**" access="ROLE_USER" />          
       </sec:http>

       <sec:authentication-manager>
            <sec:authentication-provider user-service-ref="UserAuthenticator">
                <sec:password-encoder hash="bcrypt" />
            </sec:authentication-provider>                  
        </sec:authentication-manager>       

        <bean id="UserAuthenticator" class="fe.security.UserAuthenticator"> 
        </bean>

</beans>

UserAuthenticator

package fe.security;

import java.util.Collection;

import org.springframework.security.core.Authentication;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.context.SecurityContext;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.core.userdetails.UsernameNotFoundException;

public class UserAuthenticator implements UserDetailsService{

    @Override
    public UserDetails loadUserByUsername(String username)
            throws UsernameNotFoundException {

        System.out.println(username);
        SecurityContext con = SecurityContextHolder.getContext();
        Authentication auth = con.getAuthentication(); //--the authentication object here is NULL

        String credentials = (String) auth.getCredentials();
        System.out.println("Username=" + username);
        System.out.println("pass=" + credentials);
        return null;
    }


}

提前致谢！

=============================================== =================================

由于我没有足够的声誉，以下是解决方案：

好的，仔细阅读了解后的Spring Security reference documentation。

问题是Spring Security将UserDetails从函数UserDetailsService.loadUserByUsername返回的用户名和密码与j_username和j_password字段进行比较。这意味着DAO对象应该使用set fields username和password返回UserDetails。

关于可空SecurityContextHolder.getContext().getAuthentication()的问题的答案是，在成功进行身份验证后，SecurityContextHolder.getContext().getAuthentication()应该返回not-nullable个对象。

此致

Answer 1

好的，仔细阅读了解我知道的Spring Security参考文档。

问题是Spring Security将从函数UserDetails返回的UserDetailsService.loadUserByUsername的用户名和密码与j_username和j_password字段进行比较。这意味着DAO对象应该使用set fields username和password返回UserDetails。

关于可空SecurityContextHolder.getContext().getAuthentication()的问题的答案是，在成功验证后，SecurityContextHolder.getContext().getAuthentication()应该返回不可为空的对象。

此致

通过spring security将密码传递给dao对象

的web.xml

弹簧security.xml文件

UserAuthenticator

1 个答案: