Question

我是这项技术的新手。我试图为我的Springboot应用程序实现摘要身份验证。尝试调用我的应用程序时出现以下错误：没有为id \“ null \”“，” path“：” / countryId /“} *映射的PasswordEncoder映射关闭连接0

我用来调用的卷曲命令：curl -iv --digest -u test：5f4dcc3b5aa765d61d8327deb882cf99 -d {“ CountryCode”：“ INDIA”} http://localhost:9090/countryId/

课程详细信息：

package com.sg.config;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.builders.WebSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserCache;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.provisioning.InMemoryUserDetailsManager;
import org.springframework.security.web.authentication.www.DigestAuthenticationFilter;
import org.springframework.stereotype.Component;

@Component
@Configuration
@EnableWebSecurity
public class SpringSecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired
    CustomDigestAuthenticationEntryPoint customDigestAuthenticationEntryPoint;

    /*@Bean
    public BCryptPasswordEncoder encoder() {
        return new BCryptPasswordEncoder();
    }*/

@Bean
public UserDetailsService userDetailsServiceBean()
{
    InMemoryUserDetailsManager manager = new InMemoryUserDetailsManager();
    manager.createUser(User.withUsername("test").password("{noop}password").roles("USER").build());
    return manager;

}

    @Override
    protected void configure(HttpSecurity http) throws Exception {

        http.csrf().disable().authorizeRequests().antMatchers("/hello/**").permitAll().anyRequest().authenticated()
                .and().exceptionHandling().authenticationEntryPoint(customDigestAuthenticationEntryPoint).and()
                .addFilter(digestAuthenticationFilter());
    }

    //@Bean
    DigestAuthenticationFilter digestAuthenticationFilter() throws Exception {
        DigestAuthenticationFilter digestAuthenticationFilter = new DigestAuthenticationFilter();
        digestAuthenticationFilter.setUserDetailsService(userDetailsServiceBean());
        digestAuthenticationFilter.setAuthenticationEntryPoint(customDigestAuthenticationEntryPoint);
        return digestAuthenticationFilter;
    }



    }

package com.sg.config;

import org.springframework.security.web.authentication.www.DigestAuthenticationEntryPoint;
import org.springframework.stereotype.Component;

@Component
public class CustomDigestAuthenticationEntryPoint extends DigestAuthenticationEntryPoint {

    @Override
    public void afterPropertiesSet() throws Exception {
        setRealmName("Digest-Realm");
        setKey("MySecureKey");
        setNonceValiditySeconds(300);
        super.afterPropertiesSet();
    }



}

Answer 1

我已经解决了问题。让我解释一下首先出了什么问题，在当前的Spring安全性中，您不能使用纯文本密码，因此必须保留一些加密逻辑。但不幸的是，摘要式不适用于加密密码。我找到了解决方法，而不是使用Bean（Bycrypt），我直接实现了PasswordEncoder接口，从某种意义上说，它应该能够保存纯文本密码。

@Bean
public PasswordEncoder passwordEncoder() {
    return new PasswordEncoder() {
        @Override
        public String encode(CharSequence rawPassword) {
            return rawPassword.toString();
        }
        @Override
        public boolean matches(CharSequence rawPassword, String encodedPassword) {
            return rawPassword.toString().equals(encodedPassword);
        }
    };
}

使用摘要过滤器的春季启动摘要身份验证失败

1 个答案: