如何使用Spring Security验证两种不同类型的用户？

Question

In my spring boot application, I will have two different types of users ie

1. Admin users
2. customers

These users will be stored in two different tables. These two tables will have only email id in common. Everything else will be different.

Also, the no. of customers will be huge like 1 to 5 Millions customers. While on the other hand, admin users will be very few like less than 10. Hence the two different tables.

I want to have two different login pages. One at /customer/login for all the customer and another at /admin/login for all the admins. Login details should be authenticated using their respective tables. On login customers should go to /customer/home and admins should go to /admin/home.

On logout customer should be redirected to /customer/login and admin to /admin/login

I am using java config for Spring security. How can this be done in spring security?

Below is my configuration for single user which works properly.

@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true, securedEnabled = true)
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired
    private UserDetailsService userDetailsService;

    @Autowired
    private AccessDecisionManager accessDecisionManager;

    @Autowired
    private ApplicationProperties applicationProperties;

    @Bean
    public Integer applicationSessionTimeout(){
        return applicationProperties.getSecurity().getSessionTimeout();
    }

    @Bean
    @Autowired
    public AccessDecisionManager accessDecisionManager(AccessDecisionVoterImpl accessDecisionVoter) {
        List<AccessDecisionVoter<?>> accessDecisionVoters = new ArrayList<AccessDecisionVoter<?>>();
        accessDecisionVoters.add(new WebExpressionVoter());
        accessDecisionVoters.add(new AuthenticatedVoter());
        accessDecisionVoters.add(accessDecisionVoter);
        UnanimousBased accessDecisionManager = new UnanimousBased(accessDecisionVoters);
        return accessDecisionManager;
    }

    @Override
    @Autowired
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.userDetailsService(userDetailsService).passwordEncoder(passwordEncoder());
    }

    @Bean
    public PasswordEncoder passwordEncoder(){
        PasswordEncoder passwordEncoder = new PasswordEncoder();
        passwordEncoder.setStringDigester(stringDigester());
        return passwordEncoder;
    }

    @Bean
    public PooledStringDigester stringDigester() {
        PooledStringDigester psd = new PooledStringDigester();

        psd.setPoolSize(2);
        psd.setAlgorithm("SHA-256");
        psd.setIterations(1000);
        psd.setSaltSizeBytes(16);
        psd.setSaltGenerator(randomSaltGenerator());

        return psd;
    }

    @Bean
    public RandomSaltGenerator randomSaltGenerator() {
        RandomSaltGenerator randomSaltGenerator = new RandomSaltGenerator();
        return randomSaltGenerator;
    }

    @Override
    public void configure(WebSecurity web) throws Exception {
        web.ignoring()
                .antMatchers("/static/**")
                .antMatchers("/i18n/**");
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
            .exceptionHandling().
                accessDeniedPage("/accessDenied")
                .and()
            .authorizeRequests()
                .accessDecisionManager(accessDecisionManager)
                .antMatchers("/login**").permitAll()
                .antMatchers("/error**").permitAll()
                .antMatchers("/checkLogin**").permitAll()
                .anyRequest().fullyAuthenticated()
                .and()
            .formLogin()
                .loginPage("/login")
                .loginProcessingUrl("/checkLogin")
                .defaultSuccessUrl("/home?menu=homeMenuOption")
                .failureUrl("/login?login_error=1")
                .usernameParameter("username")
                .passwordParameter("password")
                .permitAll()
                .and()
            .logout()
                .logoutUrl("/logout")
                .logoutSuccessHandler(new LogoutSuccessHandlerImpl())
                .deleteCookies("JSESSIONID")
                .invalidateHttpSession(true)
                .permitAll()
                .and()
            .headers()
                .frameOptions()
                .disable()
            .and()
                .sessionManagement()
                .maximumSessions(1);
    }

}

Below is my UserDetailsService which checks in db for proper authentication.

@Service("userDetailsService")
public class UserDetailsService implements org.springframework.security.core.userdetails.UserDetailsService {

    private static final Logger log = LoggerFactory.getLogger(UserDetailsService.class);

    @Autowired
    private UserService userService;

    @Autowired
    private ModuleService moduleService;

    @Override
    public UserDetails loadUserByUsername(final String userName) throws UsernameNotFoundException, DataAccessException {
        log.debug("Authenticating : {}", userName);

        SecurityUser securityUser = null;

        try {

            User user = userService.findUserByEmail(userName);

            if (user != null) {
                log.debug("User with the username {} FOUND ", userName);
                securityUser = new SecurityUser(user.getEmail(), user.getPassword(), true, true, true, true, getGrantedAuthorities(user.getRole().getId()));
                securityUser.setUser(user);
            } else {
                log.debug("User with the username {}  NOT FOUND", userName);
                throw new UsernameNotFoundException("Username not found.");
            }
        } catch (Exception e) {
            log.error(e.getMessage(), e);
        }

        return securityUser;
    }

    private List<GrantedAuthority> getGrantedAuthorities(Long roleId) {
        log.debug("Populating user authorities");

        List<GrantedAuthority> authorities = new ArrayList<GrantedAuthority>();
        List<Module> allModules = moduleService.findAllModules();
        Map<Long, Module> moduleMap = new HashMap<Long, Module>();

        for(Module module : allModules){
            moduleMap.put(module.getModuleId(), module);
        }

        List<ModuleOperation> moduleOperationList = moduleService.findModuleOperationsByRoleId(roleId);

        for (ModuleOperation moduleOperation : moduleOperationList) {
            moduleOperation.setModuleName(moduleMap.get(moduleOperation.getModuleId()).getModuleName());
            authorities.add(moduleOperation);
        }

        return authorities;
    }
}

Answer 1

It is really a bad idea to have different login pages for Spring security, because it is not the way it is designed for. You are going to fall into trouble to define the authentication entry point to use and will need a lot of boiling plate. According to your other requirements, I would propose you the following way:

• use one single login page with one single AuthenticationManager (the default ProviderManager will be fine)
• configure it with two different AuthenticationProvider s, both being DaoAuthenticationProvider , each pointing on one of you 2 user tables
• configure those provider to automatically set different roles, ROLE_ADMIN for the former that will process admins, ROLE_USER for the latter

That way you fully rely on SpringSecurity infrastructure with as little modifications as possible to meet your requirements.

But you should also wonder whether you really need different databases. At least for the major providers (Oracle, PostgreSQL, MariaDB, ...) there is no harm in having many null columns in a record. IMHO you should do a serious analysis to compare both ways, either one single table (much simpler to setup for Spring Security) or two tables.