如何使用身份验证提供程序从数据库对用户进行身份验证？

Question

I'm a newbie with spring security and I want to authenticate users with database. I've created a login page and an authentication Provider with jdbc that cheks if the user exists in the database. But the problem that my code doesn't do that, it allows all users to log in! what's wrong with my code? Thanks for your help.

@Component(value = "userService")
public class UserService implements AuthenticationProvider {

@Inject
@Named(value = "dataSource")
private DataSource dataSource;

ResultSet resultSet = null;
PreparedStatement preparedStatement = null;
Connection connection = null;

name=auth.getName();    
    pwd=auth.getCredentials().toString();


public Authentication authenticate(Authentication auth)
        throws AuthenticationException {
    final String select_auth = "select username,password from users where username='"+name+"' and password='"+pwd+"'";
    try {
        connection = dataSource.getConnection();
        preparedStatement = connection.prepareStatement(select_auth);
        resultSet = preparedStatement.executeQuery();
        while (resultSet.next()) {

                 //what to return here ?
            }

here is my security-confg.xml:

<http auto-config="true">
    <form-login login-page="/login" username-parameter="j_username"
        password-parameter="j_password" default-target-url="/accueil"

        authentication-failure-url="/403" />
    <logout logout-success-url="/login" />
</http>

<authentication-manager>
    <authentication-provider ref="userService">
    </authentication-provider>
</authentication-manager>

Answer 1

In the code, I don't see the place to set username and password to the query. you try to get the name and password and check that your query returns any result

  @Override
public Authentication authenticate(Authentication authentication) throws AuthenticationException {
    String select_auth = "select username,password from users where username=? and password=?";
    String username = authentication.getName();
    String password = (String) authentication.getCredentials();

    preparedStatement = connection.prepareStatement(select_auth);
    p.setString(1, username);
    p.setString(2, password);
    resultSet = preparedStatement.executeQuery();

    while (resultSet.next()) {

        List<SampleAuthority> authorities = new ArrayList<SampleAuthority>();

        SampleAuthority a = new SampleAuthority();
        authorities.add(a);
        Collection<? extends GrantedAuthority> authorities1 = authorities;
        return new UsernamePasswordAuthenticationToken(username, password, authorities1);

   }
}

@Override
public boolean supports(Class<?> arg0) {
    return true;
}

class SampleAuthority implements GrantedAuthority {

    @Override
    public String getAuthority() {
        return "ROLE_USER";
    }

}

in the configuration, you can add

<intercept-url pattern="/**" access="hasRole('ROLE_USER')" />
<logout logout-url="/logout" />