spring security 使用 ROLE_USER 定义用户注册

Question

我正在使用Hibernate和Spring Security在Spring MVC 4 中创建一个项目。在这个项目中，我有 3 个角色：,和.ROLE_USERROLE_COMPANYROLE_ADMIN

用户将像常规注册站点一样注册，但我对如何通过注册过程在数据库中保存新用户、如何保存Spring Security定义的新用户和数据库以及如何使用 hibernate 获取该信息感到困惑。

谢谢你。

Answer 1

您将拥有User实现UserDetails具有一个或多个权限的类。例如：

用户

@Entity
@Table(name = "User")
public class User implements UserDetails {

    @Id
    @GeneratedValue(strategy = GenerationType.AUTO)
    private Long id;

    @NotNull
    private String username;

    @NotNull
    private String password;

    @OneToMany(cascade = CascadeType.ALL, mappedBy = "user", fetch = FetchType.EAGER, orphanRemoval = true)
    private Set<UserAuthority> authorities;


    //helper method to set roles for this user
    public void grantRole(UserRole role) {
        if (authorities == null) {
            authorities = new HashSet<UserAuthority>();
        }
        authorities.add(role.asAuthorityFor(this));
    }

    //overrides, getters, setters
}

用户权限

@Entity
@IdClass(UserAuthority.class)
public class UserAuthority implements GrantedAuthority {

    @NotNull
    @ManyToOne(fetch = FetchType.LAZY)
    @JsonIgnore
    @Id
    private User user;

    @NotNull
    @Id
    private String authority;

    //overrides, getters, setters
}

用户角色

public enum UserRole {
    USER, COMPANY, ADMIN;
}

在创建用户时：

User user = new User();
user.grantRole(UserRole.USER);
repository.save(user);

至于身份验证，您需要实现UserDetailsService从存储库加载用户

UserDetailsS​​ervice 实现

@Service
public class UserDetailsService implements org.springframework.security.core.userdetails.UserDetailsService {

    @Autowired
    private UserRepository repository;

    private final AccountStatusUserDetailsChecker detailsChecker = new AccountStatusUserDetailsChecker();

    @Override
    public final User loadUserByUsername(String username) throws UsernameNotFoundException {
        final User user = repository.findByUsername(username);
        if (user == null) {
            throw new UsernameNotFoundException("User not found");
        }
        detailsChecker.check(user);
        return user;
    }
}

现在在您的安全配置中，您只需使用它 UserDetailsService

@Autowired
private UserDetailsService userDetailsService;

@Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.userDetailsService(userDetailsService).passwordEncoder(new BCryptPasswordEncoder());
    }

@Override
protected UserDetailsService userDetailsService() {
    return userDetailsService;
}

您如何获取数据取决于您，为此我将使用 Spring Data JPA。