Spring安全自定义哈希算法

Question

我有一个使用Spring Security进行身份验证的Spring项目.

Spring Security代码段:

    <authentication-manager>
        <authentication-provider>
        <password-encoder hash="md5"/>
                <jdbc-user-service data-source-ref="dataSource"

                users-by-username-query="
SELECT users.LOGIN_NAME AS username,
   users.PASSWD_HASH     AS password , users.status as enabled
   FROM RV_USER users
  WHERE users.LOGIN_NAME=?"
                authorities-by-username-query="
                      select users.LOGIN_NAME as username, authorities.ROLE_DESC as authority
from RV_ROLE authorities, RV_USER users
where authorities.ROLE_ID=users.ROLE_ID
and users.LOGIN_NAME=?"

            />
        </authentication-provider>
    </authentication-manager>

我想使用自定义哈希算法而不是md5或其他东西.

Answer 1

您可以创建自己的PasswordEncoder实现.例如:

import org.springframework.security.crypto.password.PasswordEncoder;

public class CustomPasswordEncoder implements PasswordEncoder {

    public String encode(CharSequence rawPassword) {
        return null; // TODO implement
    }

    public boolean matches(CharSequence rawPassword, String encodedPassword) {
        return null; // TODO implement
    }
}

然后,您可以将CustomPasswordEncoder与password-encoder @ ref一起使用例如:

<authentication-manager>
  <authentication-provider>
    <password-encoder ref="customPasswordEncoder/>
    ...
  </authentication-provider>
</authentication-manager>