如何在 Spring Boot Security 中启用或禁用用户

Question

我正在为我的 Spring Boot 应用程序使用 Spring Security，这是我的用户实体

@Document(collection = "users")
public class User {
    @Id
    private String id;

    private String username;


    private String isactive;
    private String type;
    private String date;

    private String registrarid;
    private String registrartype;

    public String getRegistrarid() {
        return registrarid;
    }
    public void setRegistrarid(String registrarid) {
        this.registrarid = registrarid;
    }
    public String getRegistrartype() {
        return registrartype;
    }
    public void setRegistrartype(String registrartype) {
        this.registrartype = registrartype;
    }
    public String getIsactive() {
        return isactive;
    }
    public void setIsactive(String isactive) {
        this.isactive = isactive;
    }
    @Override
    public int hashCode() {
        final int prime = 31;
        int result = 1;
        long temp;
        temp = Double.doubleToLongBits(balance);
        result = prime * result + (int) (temp ^ (temp >>> 32));
        result = prime * result + ((date == null) ? 0 : date.hashCode());
        result = prime * result + (enabled ? 1231 : 1237);
        result = prime * result + ((id == null) ? 0 : id.hashCode());
        result = prime * result + ((isactive == null) ? 0 : isactive.hashCode());
        result = prime * result + ((password == null) ? 0 : password.hashCode());
        result = prime * result + ((registrarid == null) ? 0 : registrarid.hashCode());
        result = prime * result + ((registrartype == null) ? 0 : registrartype.hashCode());
        result = prime * result + ((roles == null) ? 0 : roles.hashCode());
        result = prime * result + ((type == null) ? 0 : type.hashCode());
        result = prime * result + ((username == null) ? 0 : username.hashCode());
        return result;
    }
    @Override
    public boolean equals(Object obj) {
        if (this == obj)
            return true;
        if (obj == null)
            return false;
        if (getClass() != obj.getClass())
            return false;
        User other = (User) obj;
        if (Double.doubleToLongBits(balance) != Double.doubleToLongBits(other.balance))
            return false;
        if (date == null) {
            if (other.date != null)
                return false;
        } else if (!date.equals(other.date))
            return false;
        if (enabled != other.enabled)
            return false;
        if (id == null) {
            if (other.id != null)
                return false;
        } else if (!id.equals(other.id))
            return false;
        if (isactive == null) {
            if (other.isactive != null)
                return false;
        } else if (!isactive.equals(other.isactive))
            return false;
        if (password == null) {
            if (other.password != null)
                return false;
        } else if (!password.equals(other.password))
            return false;
        if (registrarid == null) {
            if (other.registrarid != null)
                return false;
        } else if (!registrarid.equals(other.registrarid))
            return false;
        if (registrartype == null) {
            if (other.registrartype != null)
                return false;
        } else if (!registrartype.equals(other.registrartype))
            return false;
        if (roles == null) {
            if (other.roles != null)
                return false;
        } else if (!roles.equals(other.roles))
            return false;
        if (type == null) {
            if (other.type != null)
                return false;
        } else if (!type.equals(other.type))
            return false;
        if (username == null) {
            if (other.username != null)
                return false;
        } else if (!username.equals(other.username))
            return false;
        return true;
    }
    public String getType() {
        return type;
    }
    public void setType(String type) {
        this.type = type;
    }
    public String getDate() {
        return date;
    }
    public void setDate(String date) {
        this.date = date;
    }

    private double balance;
    public double getBalance() {
        return balance;
    }
    public void setBalance(double balance) {
        this.balance = balance;
    }



    private boolean enabled=true;

    @DBRef
    private Set<Role> roles;


    private String password;
    public String getId() {
        return id;
    }
    public void setId(String id) {
        this.id = id;
    }
    public String getUsername() {
        return username;
    }
    public void setUsername(String username) {
        this.username = username;
    }
    public String getPassword() {
        return password;
    }
    public void setPassword(String password) {
        this.password = password;
    }

    public boolean isEnabled() {
        return enabled;
    }
    public void setEnabled(boolean enabled) {
        this.enabled = enabled;
    }
    public Set<Role> getRoles() {
        return roles;
    }
    public void setRoles(Set<Role> roles) {
        this.roles = roles;
    }
    @Override
    public String toString() {
        return "User [id=" + id + ", username=" + username + ", isactive=" + isactive + ", type=" + type + ", date="
                + date + ", registrarid=" + registrarid + ", registrartype=" + registrartype + ", balance=" + balance
                + ", enabled=" + enabled + ", roles=" + roles + ", password=" + password + "]";
    }




}

这是我的自定义用户详细信息服务

@Service
public class CustomUserDetailsService implements UserDetailsService{
    @Autowired
    private UserServiceImpl userservice;

    @Autowired
    private RoleServiceImpl roleservice;



    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        // TODO Auto-generated method stub
        User user=userservice.getUserByusername(username);

            if(user != null) {
                List<GrantedAuthority> authorities = getUserAuthority(user.getRoles());
                return buildUserForAuthentication(user, authorities);
            } 

            else {
                throw new UsernameNotFoundException("username not found");
            }

    }

    private List<GrantedAuthority> getUserAuthority(Set<Role> userRoles) {
        Set<GrantedAuthority> roles = new HashSet<>();
        userRoles.forEach((role) -> {
            roles.add(new SimpleGrantedAuthority(role.getRole()));
        });

        List<GrantedAuthority> grantedAuthorities = new ArrayList<>(roles);
        return grantedAuthorities;
    }

    private UserDetails buildUserForAuthentication(User user, List<GrantedAuthority> authorities) {
        return new org.springframework.security.core.userdetails.User(user.getUsername(), user.getPassword(), authorities);
    }

}

当前自定义 UserDetails 服务检查用户名是否存在，如果未找到则抛​​出异常，我想检查用户是否已启用，以便我也可以设置 isenabled false 以停用用户。

Answer 1

只需在 loadByUsername 方法中启用检查，您还可以相应地激活和停用。希望对您有所帮助

@Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        // TODO Auto-generated method stub
        User user=userservice.getUserByusername(username);

            if(user != null && user.isEnabled()) {//here you can check that
                List<GrantedAuthority> authorities = getUserAuthority(user.getRoles());
                return buildUserForAuthentication(user, authorities);
            } 

            else {
                throw new UsernameNotFoundException("username not found");
            }

    }

Answer 2

更好的方法是User使用org.springframework.security.core.userdetails.UserDetails 并覆盖各种方法来实现您的实体，例如

@Override
public boolean isAccountNonExpired() {
    return true;
}

@Override
public boolean isAccountNonLocked() {
    return true;
}

@Override
public boolean isCredentialsNonExpired() {
    return true;
}

@Override
public boolean isEnabled() {
    if(this.isactive == null) return false;

    if(!this.isactive.equals("ACTIVE")) return false;

    return true;
}

还可以根据需要覆盖其他方法。Spring Security 会org.springframework.security.authentication.DisabledException: User is disabled根据isEnabled()结果自动给出异常。