使用Spring Boot在oauth2中进行用户身份验证

Question

I have implemented OAuth 2.0 with spring boot. I am storing the hashed password (including a salt) into my database.

I'm new to Spring and can't figure out how could I authenticate a username/password.

This is my UserDAO class:

@Service
public class UserDAO implements UserDetailsService{

@Autowired
private LoginDetailsManager loginDetailsManager;

@Override
public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {

    System.out.println("Get user");
    LoginDetails user = loginDetailsManager.getByUsername(username);
    System.out.println(user.toString());
    if (user == null) {
        // Not found...
        throw new UsernameNotFoundException(
                "User " + username + " not found.");
    }

    GrantedAuthority grantedAuthority = new SimpleGrantedAuthority("ROLE_USER");
    List<GrantedAuthority> grantedAuthorities = new ArrayList<>();
    grantedAuthorities.add(grantedAuthority);

    String password = user.getPasswordHash();
    String salt = user.getSalt();
    return new UserDetailsImpl(
            user.getUsername(),
            user.getPasswordHash(),
            salt,
            grantedAuthorities);
}
}

And this is the security configurer from the Application class:

@Override
public void configure(AuthorizationServerSecurityConfigurer security) throws Exception {
    security.allowFormAuthenticationForClients();
}

Questions:

1. How to retrieve the password entered by the user? The implementation of UserDetailsService gives me the username entered by the user.
2. Is there an in-built method to handle this "hashed password+salt" authentication? Am I getting it all wrong?

Answer 1

Retrieving the principal, providing a salt and encoding respectively matching the password are all decoupled from each other in Spring Security. Your UserDetails service is basically a correct way of fetching the principal.

You have to provide a PasswordEncoder, the default in Spring Boot is BCrypt, which doesn't match your hash. The old password encoder (ShaPasswordEncoder and such) as well as the salt sources are no longer picked up by Spring Boot and Spring Security. You have to define them manually.

This configuration should basically do what you want, given you have a UserDetails that contains a salt column. If you don't know how to do that, here's the complete implementation ShaPasswordEncoderConfig.java from my upcoming book.

@Configuration
public class ShaPasswordEncoderConfig 
    extends WebSecurityConfigurerAdapter {

    final UserDetailsService userDetailsService;

    public ShaPasswordEncoderConfig(final UserDetailsService userDetailsService) {
        this.userDetailsService = userDetailsService;
    }

    @Override
    public void configure(
        AuthenticationManagerBuilder auth
    ) {
        DaoAuthenticationProvider authProvider
            = new DaoAuthenticationProvider();
        authProvider.setUserDetailsService(
            userDetailsService);
        authProvider.setPasswordEncoder(
            new ShaPasswordEncoder(256));
        authProvider.setSaltSource(
            user -> ((UserWithSalt)user).getSalt());

        auth.authenticationProvider(authProvider);
    }
}

To make this work, you have to role your own UserDetails implementation and not use that one from Spring Security itself, since it has no attribute to store the salt.

The SaltSource I used in the example is a lambda that that casts a UserDetails to my implementation and grabs the salt. You can also use ReflectionSaltSource which is one implementation that gets the salt via reflection.

Edit

UserDetails is easy to implement, see:

You could use an implementation like this:

class UserDetailsImpl implements UserDetails {

    private final String username;
    private final String hashedPassword;
    private final String salt;
    private final List<GrantedAuthority> grantedAuthorities;

    public UserDetailsImpl(String username, String hashedPassword, String salt, List<GrantedAuthority> grantedAuthorities) {
        this.username = username;
        this.hashedPassword = hashedPassword;
        this.salt = salt;
        this.grantedAuthorities = grantedAuthorities;
    }

    @Override
    public Collection<? extends GrantedAuthority> getAuthorities() {
        return grantedAuthorities;
    }

    @Override
    public String getPassword() {
        return hashedPassword;
    }

    @Override
    public String getUsername() {
        return username;
    }

    public String getSalt() {
        return salt;
    }

    @Override
    public boolean isAccountNonExpired() {
        return true;
    }

    @Override
    public boolean isAccountNonLocked() {
        return true;
    }

    @Override
    public boolean isCredentialsNonExpired() {
        return true;
    }

    @Override
    public boolean isEnabled() {
        return true;
    }   
}

Answer 2

I ended up implementing my own PasswordEncoder interface and using a local static variable to pass it the salt through db.

The implementation is experimental, based on my observation of flow of control:

1. client-secret validation in the PasswordEncoder
2. If step-1 cleared, loadUserByUsername in userDAO.
3. Password validation in PasswordEncoder

---

public class PasswordEncoderImpl implements PasswordEncoder {

    public static Constants constants = new Constants();

    @Override
    public String encode(CharSequence rawPassword) {
        return DigestUtils.sha256Hex(rawPassword.toString());
    }

    @Override
    public boolean matches(CharSequence rawPassword, String encodedPassword) {
        String salt = constants.getSalt();

    /**
     * If salt is null, it means the value in constants object is empty now.
     * => client-secret validation is going on
     * => we just need the comparision of plain-text string.
     */
        if(salt != null) {
//    case of password authentication
            return DigestUtils.sha256Hex(salt + rawPassword).equalsIgnoreCase(encodedPassword);
        } else {
        //case of client-secret authentication
            return rawPassword.equals(encodedPassword);
        }
    }
}

In my UserDAO, where I get the user-details from the persistence, I would store salt into the object constants before return the user:

@Override
public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {

    System.out.println("Get user");
    user = loginDetailsManager.getByUsername(username);
    System.out.println(user.toString());
    if (user == null) {
        // Not found...
        throw new UsernameNotFoundException(
                "User " + username + " not found.");
    }

    GrantedAuthority grantedAuthority = new SimpleGrantedAuthority("ROLE_USER");
    List<GrantedAuthority> grantedAuthorities = new ArrayList<>();
    grantedAuthorities.add(grantedAuthority);

    constants.set(user.getSalt());

    return new User(
            user.getUsername(),
            user.getPasswordHash(),
            true, true, true, true,
            grantedAuthorities);
}