Question

我正在使用DaoAuthenticationProvider进行身份验证，但是当我提交表单时，super.authenticate（身份验证）会两次调用loadUserByUsername，它会抛出BadCredentialsException然后下次成功登录

如果我不使用passwordencoder这个过程工作正常但是当我使用它时，loadUserByUsername方法被调用两次。

以下是我的代码：

SecurityConfig

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

@Autowired
@Qualifier("authenticationProvider")
AuthenticationProvider authenticationProvider;

@Autowired
@Qualifier("userDetailsService")
UserDetailsService userDetailsService;

@Bean
public PasswordEncoder passwordEncoder() {
    PasswordEncoder encoder = new BCryptPasswordEncoder();
    return encoder;
}

@Autowired
public void configureGlobal(AuthenticationManagerBuilder auth)
        throws Exception {
    auth.authenticationProvider(authenticationProvider)
    .userDetailsService(userDetailsService).passwordEncoder(passwordEncoder());
}

@Override
protected void configure(HttpSecurity http) throws Exception {

    http.authorizeRequests().antMatchers("/admin/**")
            .access("hasRole('ROLE_ADMIN')").and().formLogin()
            .loginPage("/login").failureUrl("/login?error")
            .usernameParameter("username").passwordParameter("password")
            .and().logout().logoutSuccessUrl("/login?logout").and().csrf()
            .and().exceptionHandling().accessDeniedPage("/403");
}

}

身份验证类

@Component("authenticationProvider")
public class LimitLoginAuthenticationProvider extends DaoAuthenticationProvider {

@Autowired
@Qualifier("userDetailsService")
@Override
public void setUserDetailsService(UserDetailsService userDetailsService) {
    super.setUserDetailsService(userDetailsService);
}

@Override
public Authentication authenticate(Authentication authentication)
        throws AuthenticationException {

    try {
        System.out.println("inside authenticate");
        Authentication auth = super.authenticate(authentication);
        return auth;
    } catch (BadCredentialsException be) {
        System.out.println("First call comes here ");
        throw be;
    } catch (LockedException e) {
        throw e;
    }
}
}

MyUserdetailsService类implments UserDetailsService

@Service("userDetailsService")
public class MyUserDetailsService implements UserDetailsService {

@Autowired
private UserDao userDao;

/* below method is called twice if I am using passwordencoder,
initially authentication fails and then again immediately 
on second call authentication succeed */

@Transactional(readOnly=true)
@Override
public UserDetails loadUserByUsername(final String username) throws UsernameNotFoundException {

    com.mkyong.users.model.User user = userDao.findByUserName(username);
    List<GrantedAuthority> authorities = buildUserAuthority(user.getUserRole());

    return buildUserForAuthentication(user, authorities);

}

private User buildUserForAuthentication(com.mkyong.users.model.User user, List<GrantedAuthority> authorities) {
     MyUserDetails myUserDetails = new MyUserDetails (user.getUsername(), user.getPassword(), user.isEnabled(), user.isAccountNonExpired(), user.isAccountNonLocked(), user.isCredentialsNonExpired(), user.getEmailId(),authorities);
     return myUserDetails;
}

private List<GrantedAuthority> buildUserAuthority(Set<UserRole> userRoles) {

    Set<GrantedAuthority> setAuths = new HashSet<GrantedAuthority>();

    // Build user's authorities
    for (UserRole userRole : userRoles) {
        setAuths.add(new SimpleGrantedAuthority(userRole.getRole()));
    }

    List<GrantedAuthority> Result = new ArrayList<GrantedAuthority>(setAuths);

    return Result;
}

}

有些人可以帮助我。我相信SecurityConfig类需要进行一些更改，但确切地说我无法弄明白。

Answer 1

最后，在java_dude和SergeBallesta的帮助下，我得到了我的查询的解决方案。

经过大量调试后，我看到当在AaoAuthenticationProvider类中调用isPasswordValid方法而不是调用方法1 时，它从org.springframework.security调用方法2 .authentication.encoding.PlaintextPasswordEncoder哪一个被折旧，在第二次调用时它正在调用isPasswordValid 方法1。

方法1

 public boolean isPasswordValid(String encPass, String rawPass, Object salt) {
                checkSalt(salt);
                return delegate.matches(rawPass, encPass);
            }

方法2

 public boolean isPasswordValid(String encPass, String rawPass, Object salt) {
    String pass1 = encPass + "";

    // Strict delimiters is false because pass2 never persisted anywhere
    // and we want to avoid unnecessary exceptions as a result (the
    // authentication will fail as the encodePassword never allows them)
    String pass2 = mergePasswordAndSalt(rawPass, salt, false);

    if (ignorePasswordCase) {
        // Note: per String javadoc to get correct results for Locale insensitive, use English
        pass1 = pass1.toLowerCase(Locale.ENGLISH);
        pass2 = pass2.toLowerCase(Locale.ENGLISH);
    }
    return PasswordEncoderUtils.equals(pass1,pass2);
}

要正确地进行身份验证，只需在SecurityConfig类中添加以下代码，并添加到我当前的相关代码中。

@Bean
public DaoAuthenticationProvider authProvider() {
 // LimitLoginAuthenticationProvider is my own class which extends DaoAuthenticationProvider 
    final DaoAuthenticationProvider authProvider = new LimitLoginAuthenticationProvider(); 
    authProvider.setUserDetailsService(userDetailsService);
    authProvider.setPasswordEncoder(passwordEncoder());
    return authProvider;
}

**并更改此方法代码**

@Autowired
public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
    auth.authenticationProvider(authProvider())
 .userDetailsService(userDetailsService).passwordEncoder(passwordEncoder());
}

loadUserByUsername使用DaoAuthenticationProvider执行两次

1 个答案: