Question

我使用security setup命令将登录页面添加到我的roo应用程序。但是，应用程序不是从数据库中读取任何用户，而是仅使用applicationContext-security.xml中提供的后门程序。我只能使用（admin，admin）登录应用程序，即使该表有其他用户。

log.roo

project --topLevelPackage edu.gju.edusyria --projectName FinalVersion --java 6 --packaging JAR
hint
jpa setup --database MYSQL --provider HIBERNATE 
hint
osgi start --url file:///C:/Users/Motassem/Desktop/roo-i18n-arabic-master/target/org.dls.roo.i18n.arabic-0.1.0.BUILD-SNAPSHOT.jar  
hint
entity jpa --class ~.model.security.Principal --table security_principals
field string --fieldName username --notNull --sizeMax 50 --sizeMin 3
field string --fieldName password --notNull --sizeMax 50 --sizeMin 3
field boolean --fieldName enabled
entity jpa --class ~.model.security.Authority --table security_authorities
field string --fieldName roleId --notNull --sizeMax 10 --sizeMin 8
field string --fieldName authority --notNull --sizeMax 50

entity jpa --class ~.model.security.Authority --table security_authorities
field string --fieldName roleId --notNull --sizeMax 10 --sizeMin 8
field string --fieldName authority --notNull --sizeMax 50 --sizeMin 8 --regexp ^ROLE_[A-Z]*
entity jpa --class ~.model.security.AuthorityPrincipalAssignment --table security_role_assignments
field reference --fieldName username --type ~.model.security.Principal
field reference --fieldName roleId --type ~.model.security.Authority

help
web mvc setup

web mvc scaffold --class ~.web.security.UserController --backingType ~.model.security.Principal --path /security/users
web mvc scaffold --class ~.web.security.RoleController --backingType ~.model.security.Authority --path /security/roles
web mvc scaffold --class ~.web.security.RoleMappingController --backingType ~.model.security.AuthorityPrincipalAssignment --path /security/assignments
security setup

的applicationContext-security.xml文件

<?xml version="1.0" encoding="UTF-8"?>
<beans:beans xmlns="http://www.springframework.org/schema/security"
    xmlns:beans="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.1.xsd
        http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.1.xsd">
    <!-- HTTP security configurations -->
    <http auto-config="true" use-expressions="true">
        <form-login login-processing-url="/resources/j_spring_security_check"
            login-page="/login" authentication-failure-url="/login?login_error=t" />
        <logout logout-url="/resources/j_spring_security_logout" />
        <!-- Configure these elements to secure URIs in your application -->
        <intercept-url pattern="/choices/**" access="hasRole('ROLE_ADMIN')" />
        <intercept-url pattern="/security/**" access="hasRole('ROLE_ADMIN')" />
        <intercept-url pattern="/principals/**" access="hasRole('ROLE_ADMIN')" />
        <intercept-url pattern="/member/**" access="isAuthenticated()" />
        <intercept-url pattern="/resources/**" access="permitAll" />
        <intercept-url pattern="/login/**" access="permitAll" />
        <intercept-url pattern="/**" access="isAuthenticated()" />
    </http>
    <!-- Configure Authentication mechanism -->
    <authentication-manager alias="authenticationManager">
        <!-- SHA-256 values can be produced using 'echo -n your_desired_password 
            | sha256sum' (using normal *nix environments) -->
        <authentication-provider>
            <password-encoder hash="sha-256">

            </password-encoder>
            <jdbc-user-service data-source-ref="dataSource"
                users-by-username-query="SELECT username, password, enabled FROM security_principals WHERE username = ?"
                authorities-by-username-query="
SELECT p.username, a.authority
FROM security_principals p, security_authorities a,
security_role_assignments ra
WHERE p.id = ra.username
AND a.role_Id = ra.role_Id AND p.username = ?" />
            <user-service>
                <user name="admin"
                    password="8c6976e5b5410415bde908bd4dee15dfb167a9c873fc4bb8a81f6f2ab448a918"
                    authorities="ROLE_ADMIN" />
                <user name="user"
                    password="04f8996da763b7a969b1028ee3007569eaf3a635486ddab211d512c85b9df8fb"
                    authorities="ROLE_USER" />
            </user-service>
        </authentication-provider>
    </authentication-manager>
</beans:beans>

Answer 1

使用Spring Security与位于数据库上的用户保护您的应用程序非常容易。你可以手动更新authentication-provider，就像你做的那样，但我建议你使用gvNIX distribution提供的Spring Roo附加组件来自动配置所有必要的文件。

使用typicalsecurity setup命令，您可以轻松地在项目中包含该功能。

您无需手动生成用户和角色实体。这个插件会照顾它。

如果您想要有关此功能的完整示例，请在空文件夹上尝试此命令：

// First run the petclinc roo example
script clinic.roo
// install typical security assets
typicalsecurity setup

祝你好运!!

Spring roo安全：凭据不好

1 个答案: