如何在不知道密码的情况下使用Spring Security自动登录用户？

Question

我的应用程序使用Spring Security,我的客户端需要:

• 用户能够在注册后自动登录.
• 管理员以任何用户身份登录而不知道他们的密码.

所以我需要弄清楚如何在不知道密码的情况下自动登录任何用户.

如何使用Spring Security实现这一目标.

Answer 1

为了让这个工作,我不得不:

配置对UserDetailsS​​ervice的引用(jdbcUserService)

<authentication-manager>
<authentication-provider>
<jdbc-user-service id="jdbcUserService" data-source-ref="dataSource"
  users-by-username-query="select username,password, enabled from users where username=?" 
  authorities-by-username-query="select u.username, ur.authority from users u, user_roles ur where u.user_id = ur.user_id and u.username =?  " 
/>
</authentication-provider>
</authentication-manager>

在我的控制器中自动装载我的userDetailsManager:

@Autowired
@Qualifier("jdbcUserService")  // <-- this references the bean id
public UserDetailsManager userDetailsManager;

在同一个控制器中,像这样验证我的用户:

@RequestMapping("/automatic/login/test")
public @ResponseBody String automaticLoginTest(HttpServletRequest request) 
{
    String username = "anyUserName@YourSite.com";

    Boolean result = authenticateUserAndInitializeSessionByUsername(username, userDetailsManager, request);

    return result.toString();
}

public boolean authenticateUserAndInitializeSessionByUsername(String username, UserDetailsManager userDetailsManager, HttpServletRequest request)
{
    boolean result = true;

    try
    {
        // generate session if one doesn't exist
        request.getSession();

        // Authenticate the user
        UserDetails user = userDetailsManager.loadUserByUsername(username);
        Authentication auth = new UsernamePasswordAuthenticationToken(user, null, user.getAuthorities());
        SecurityContextHolder.getContext().setAuthentication(auth);
    }
    catch (Exception e)
    {
      System.out.println(e.getMessage());

      result = false;
    }

    return result;
}

请注意,可以在此处找到为应用程序使用spring security的良好前提.