实现自定义Spring Security身份验证方法

Question

I am building a spring MVC web application, with a user login mechanism. I have used spring-boot to set up my application. To authenticate a user with the database, I followed the following tutorial:

http://justinrodenbostel.com/2014/05/30/part-5-integrating-spring-security-with-spring-boot-web/

Here, spring's inbuilt authentication procedure is used. By specifying

auth.jdbcAuthentication().dataSource(datasource);

Spring security checks for the user and authorities table and authenticates the user.

I want to override this default behaviour, as I do not have(do not need) an authentication table. Plus, my user table has a lot more columns than the standard three columns, namely username, password and enabled.

How do I override the default implementation?

Also, after the user has logged in, how do I get the information about the user?

Thanks!

Answer 1

You can either create a custom AuthenticationProvider or use DaoAuthenticationProvider with your custom UserDetailsService implementation.

Here is an example of Spring Java configuration class for the second solution:

@Configuration
@EnableWebMvcSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired
    private UserService userService;

    // ...

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.authenticationProvider(authenticationProvider());
    }

    @Bean
    public AuthenticationProvider authenticationProvider() {
        DaoAuthenticationProvider authenticationProvider = new DaoAuthenticationProvider();
        authenticationProvider.setPasswordEncoder(new ShaPasswordEncoder());
        authenticationProvider.setUserDetailsService(userService);
        return authenticationProvider;
    }

}

Your implementation of UserDetailsService interface will contain the logic specific to the domain of your project for retrieving users by their username.

If you need more detailed examples, leave a comment below and I'll update the answer, but this should give you the general idea.

Also i recommend reading through JavaDocs of the aforementioned Spring classes and interfaces.