Spring安全性和JPA配置

Question

I have problem with configuration Spring Security and JPA (Spring DATA). I have some application where "/admin" is secured by "ADMIN" role. When i use inMemoryAuthentication it works as i want:

auth.inMemoryAuthentication().withUser("admin1").password("admin1").roles("ADMIN");
auth.inMemoryAuthentication().withUser("user1").password("user1").roles("USER");

but when I use JPA and UserDetailsService implementation i have 404 Access denied error on the "/admin" page.

SpringSecurity configuration:

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {
@Autowired
private CustomUserDetailsService customUserDetailsService;

@Autowired
public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
    auth.userDetailsService(customUserDetailsService).passwordEncoder(passwordEncoder());
}

@Override
protected void configure(HttpSecurity http) throws Exception {
    http.authorizeRequests()
            .antMatchers("/admin/**")
            .access("hasRole('ADMIN')")
        .and()
            .formLogin()
                .loginPage("/login")
                .loginProcessingUrl("/j_spring_security_check")
                .failureUrl("/login?error")
                .usernameParameter("email")
                .passwordParameter("password")
        .and()
            .logout()
                .logoutUrl("/j_spring_security_logout")
                .logoutSuccessUrl("/login?logout")
        .and()
            .exceptionHandling()
            .accessDeniedPage("/403")
        .and()
            .csrf();

}

@Bean
public PasswordEncoder passwordEncoder() {
    PasswordEncoder encoder = new BCryptPasswordEncoder();
    return encoder;
}

}

CustomUserDetailsService.class:

@Service
public class CustomUserDetailsService implements UserDetailsService {

private UserService userService;

@Autowired
public CustomUserDetailsService(UserService userService) {
    super();
    this.userService = userService;
}

public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
    User user = userService.findUserByUsername(username);
    if (user == null) {
        throw new UsernameNotFoundException("UserName " + username + " not found");
    }
    SecurityUser sUser= new SecurityUser(user);
    return sUser;
}

}

SecurityUser.class:

public class SecurityUser extends User implements UserDetails {

private static final long serialVersionUID = 1L;

public SecurityUser(User user) {
    this.setId(user.getId());
    this.setEmail(user.getEmail());
    this.setUsername(user.getUsername());
    this.setPassword(user.getPassword());
    this.setRoles(user.getRoles());
}

public Collection<? extends GrantedAuthority> getAuthorities() {
    Collection<GrantedAuthority> authorities = new ArrayList<GrantedAuthority>(0);
    Set<Role> userRoles = this.getRoles();
    if (userRoles != null) {
        for (Role role : userRoles) {
            SimpleGrantedAuthority authority = new SimpleGrantedAuthority(role.getName());
            authorities.add(authority);
        }
    }
    System.out.println("Roles: "+authorities.size());
    authorities.stream().forEach(System.out::println);
    System.out.println("==========");
    return authorities;
}

public String getPassword() {
    return super.getPassword();
}

public String getUsername() {
    return super.getUsername();
}

public boolean isAccountNonExpired() {
    return true;
}

public boolean isAccountNonLocked() {
    return true;
}

public boolean isCredentialsNonExpired() {
    return true;
}

public boolean isEnabled() {
    return true;
}

} Database:

INSERT INTO `user` (`ID_USER`, `EMAIL`, `PASSWORD`, `USERNAME`) VALUES (1, 'admin@admin.pl', '$2a$10$bRqlytB7SOVw5Y2P8QFjgucN2hjCfdChUw4o.GAAzkaUbQHPklpE2','admin'), (2, 'user@user.pl', '$2a$10$Ydf6v7TX.SjH7FAoDQUQau2yqlLb1.xSsS/IUClUfgizAhqOVEw2C', 'user');
INSERT INTO `role` (`ID_ROLE`, `ROLE_NAME`) VALUES (1, 'ADMIN');
INSERT INTO `user_role` (`ID_USER`, `ID_ROLE`) VALUES (1, 1);

Github: https://github.com/cinek1992/blog/ Thanks for any help

Answer 1

Your not using the userService in spring security configuration. Add this:

private UserService detailsService;
@Autowired
 public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
  auth.userService(detailsService).passwordEncoder(passwordEncoder()); 
 }