在Spring Security中，如何使用jdbc从Oracle数据库认证用户？

Question

I'm a newbie with spring Mvc. I've created a login.jsp page and I want to authenticate users dynamically from database using spring security.

This is my spring security configuration:

<http auto-config="true">
    <form-login login-page="/login" username-parameter="j_username"
        password-parameter="j_password" default-target-url="/accueil"
        authentication-failure-url="/403" />
        <logout logout-success-url="/login"/>
</http>

<authentication-manager>
    <authentication-provider ref="userService">
        </authentication-provider>
</authentication-manager>

And this is my userService:

@Component(value = "userService")
public class UserService implements AuthenticationProvider {
    @Inject
    @Named(value = "dataSource")
    private DataSource dataSource1;

    final String select_auth = "select username,password from users";

    public Authentication authenticate(Authentication auth) throws AuthenticationException {
        ResultSet resultSet = null;
        PreparedStatement preparedStatement = null;
        Connection connection = null;
        try {
            connection = dataSource1.getConnection();
            preparedStatement = connection.prepareStatement(select_auth);
            resultSet = preparedStatement.executeQuery();
            while (resultSet.next()) {
                String name=resultSet.getString("username");
                String pwd =resultSet.getString("password");
                if (name.equals("what?")){
                }
            }

        } catch (SQLException e) {
            e.printStackTrace();
        } finally {
            if (resultSet != null) {
                try {
                    resultSet.close();
                } catch (SQLException e) {

                }
            }
            if (preparedStatement != null) {
                try {
                    preparedStatement.close();
                } catch (SQLException e) {

                }
            }
            if (connection != null) {
                try {
                    connection.close();
                } catch (SQLException e) {

                }
            }
        }

        return new UsernamePasswordAuthenticationToken("", "");
    }

    public boolean supports(Class<?> arg0) {
        return true;
    }
}

The connection to the database works, but my problem is how to get the inputs from login.jsp and test if the username and the password are the same in the database?

And what to return if the user exists in the database ?

Answer 1

Username and password are stored within the Authentication object

    String username = auth.getName();
    String password = auth.getCredentials().toString();

so you can check them against your DB data (as I suggested in the comment).

    final String select_auth = "select username,password from users WHERE username=?"; // Use your prepared statement to bind the username

Once you get the record back (if exists) you can check the password using your PasswordEncoder (hopefully your password is encoded, eg encrypted / hashed). And then, eg

    return new UsernamePasswordAuthenticationToken(new MyUserDetails(username, password, ...), password); // There is also a constructor that accepts granted authorities