Question

我使用spring-security-3.1.0和spring-framework-3.0.6。对于登录安全检查我正在使用salt.But在盐中使用盐有问题资源。如果我使用bean：property name =“userPropertyToUse”value =“username”则一切都好但在<beans:property name="userPropertyToUse" value="lalt">中遇到问题我甚至很难为"salt"配置所有必要的配置。播下这条消息 无法在用户对象上找到salt方法。该类是'org.springframework.security.core.userdetails.User'吗？有一个名为'盐'的方法或吸气剂？

我的spring-security.xml看起来像这样

<beans:bean id="saltSource" class="org.springframework.security.authentication.dao.ReflectionSaltSource">
    <beans:property name="userPropertyToUse" value="salt" />
</beans:bean> 
<beans:bean id="passwordEncoder" class="org.springframework.security.authentication.encoding.ShaPasswordEncoder"/>

<beans:bean id="loggerListener" class="org.springframework.security.authentication.event.LoggerListener" /> 

<authentication-manager>
    <authentication-provider user-service-ref="jdbcUserService">
        <password-encoder ref="passwordEncoder">
            <salt-source ref="saltSource"/>
        </password-encoder> 
    </authentication-provider>
</authentication-manager> 

<beans:bean id="jdbcUserService" class="controllers.CustomJdbcDaoImpl">
    <beans:property name="dataSource" ref="dataSource"/>
    <beans:property name="usersByUsernameQuery">
        <beans:value>SELECT U.userid AS username, 
            U.userpassword as password, 
            'true' AS enabled,
            U.userpasswordsalt AS salt 
            FROM users U WHERE U.userid=?
        </beans:value>
    </beans:property>
    <beans:property name="authoritiesByUsernameQuery">
        <beans:value>SELECT U.userid AS username,
            U.userrole as authority 
            FROM users U 
            WHERE U.userid=?
        </beans:value>
    </beans:property>
</beans:bean>

我对盐的jdbcUserService.java是

public class CustomJdbcDaoImpl extends JdbcDaoImpl {
    @Override
    protected List<UserDetails> loadUsersByUsername(String username) {
        return getJdbcTemplate().query(getUsersByUsernameQuery(),new String[] {username},
            new RowMapper<UserDetails>() {
                public UserDetails mapRow(ResultSet rs, int rowNum)throws SQLException {
                    String username = rs.getString(1);
                    String password = rs.getString(2);
                    boolean enabled = rs.getBoolean(3);
                    String salt = rs.getString(4);
                    System.out.println("CustomJdbcDaoImpl Salt : "+salt);
                    return new SaltedUser(username, password,enabled, true, true, true,AuthorityUtils.NO_AUTHORITIES, salt);
                }
            });
    } 
}

我的SaltedUser.java是

public class SaltedUser extends User{
    private String salt;
    public SaltedUser(String username, String password,boolean enabled,
            boolean accountNonExpired, boolean credentialsNonExpired,
            boolean accountNonLocked, List<GrantedAuthority>authorities, String salt) {
        super(username, password, enabled,accountNonExpired, credentialsNonExpired,accountNonLocked, authorities);
        this.salt = salt;
        System.out.println("SaltedUser Salt : "+salt);
    }

    public String getSalt() {
        return salt;
    }

    public void setSalt(String salt) {
        this.salt = salt;
    }
}

任何人都可以帮助我......？

Answer 1

您需要覆盖createUserDetails方法，该方法会创建类返回的最终UserDetails实现。请查看JdbcDaoImpl的来源。

请注意，如果您没有为已经安装了密码哈希系统的旧系统构建此系统，那么使用BCrypt之类的代码对密码进行编码将是一个更好，更简单的选项。 / p>

如何在Spring Security中使用数据库字段中的salt

1 个答案: