错误：使用此用户名的用户不存在：使用 spring 安全性时

Question

I'm building backend using Spring Boot + Spring Security and testing it with Postman. For frontend I will use Android app.

Implemented http basic auth .

When I click on the Authentication tab in Postman and choose Basic Auth from the drop down box and then I enter username and password fields there it works just fine. But when I am sending raw JSON request body I am getting following error:

org.springframework.security.authentication.InternalAuthenticationServiceException: User doesn't exist with this username:

I assume it is caused with this class

CustomUserDetailsService.java

@Service
public class CustomUserDetailsService implements UserDetailsService {

    @Autowired
    private UserRepository userRepository;

    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        User user = userRepository.findByUsername(username);
        CustomUserDetails userDetails = null;

        if(user != null){
            userDetails = new CustomUserDetails();
            userDetails.setUser(user);
        }else{
            throw new UserNotFoundException("User doesn't exist with this username: " + username);
        }
        return userDetails;

    }

}

But I am not sure why as it works with Postman auth drop down box.

Here is more code that I use:

SecurityConfiguration.java

@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class SecurityConfiguration extends WebSecurityConfigurerAdapter {

    @Autowired
    private UserDetailsService userDetailsService;

   @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth
                .userDetailsService(userDetailsService)
                .passwordEncoder(encodePWD());
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {

        http.sessionManagement()
                .sessionCreationPolicy(SessionCreationPolicy.STATELESS);
        http.csrf().disable();
        http
                .httpBasic()
                .and()
                .authorizeRequests()
                .antMatchers("/rest/**").permitAll()
                .and()
                .authorizeRequests()
                .antMatchers("/secure/**").hasAnyRole("ADMIN")
                .anyRequest().authenticated()
                .and()
                .formLogin()
                .permitAll();

    }

    @Bean
    public BCryptPasswordEncoder encodePWD() {
        return new BCryptPasswordEncoder();
    }

}

CustomUserDetailsService.java

@Service
public class CustomUserDetailsService implements UserDetailsService {

    @Autowired
    private UserRepository userRepository;

    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        User user = userRepository.findByUsername(username);
        CustomUserDetails userDetails = null;

        if(user != null){
            userDetails = new CustomUserDetails();
            userDetails.setUser(user);
        }else{
            throw new UserNotFoundException("User doesn't exist with this username: " + username);
        }
        return userDetails;

    }

}

CustomUserDetails.java

@Getter
@Setter
public class CustomUserDetails implements UserDetails {
    private User user;
    @Override
    public Collection<? extends GrantedAuthority> getAuthorities() {
        return user.getRoles().stream().map(role -> new SimpleGrantedAuthority("ROLE_" + role.getRole())).collect(Collectors.toSet());
    }
    @Override
    public String getPassword() {
        return user.getPassword();
    }
    @Override
    public String getUsername() {
        return user.getUsername();
    }
    @Override
    public boolean isAccountNonExpired() {
        return true;
    }
    @Override
    public boolean isAccountNonLocked() {
        return true;
    }
    @Override
    public boolean isCredentialsNonExpired() {
        return true;
    }
    @Override
    public boolean isEnabled() {
        return true;
    }
}

Also I am using this to login user and to check if matches one in DB.

@PostMapping("/loginuser")
    ResponseEntity<Object> login(@RequestBody User user) {
        List<User> userList = userRepository.findByUsernameAndPassword(user.getUsername(), user.getPassword());
        if (userList.size() != 1) {
            throw new UserNotFoundException("Entity not found");
        } else {
            return new ResponseEntity<>(userList.get(0), HttpStatus.OK);
        }
    }

Is it even possible to use https basic auth for rest server api?

Or do I have to use some authentications with tokens like OAuth and similar?

UPDATE

Answer 1

If you use the Postman Authorization tab, Postman constructs the corresponding Authorization header Authorization: Basic <credentials> , where credentials is the Base64 encoding of username and password.

You can see this header in your Postman request clicking headers and hidden.

This header is needed for Spring Security HTTP basic authentication. If you just post username and password in the body of the request as JSON, Spring Security HTTP basic authentication cannot extract the username from the header. Therefore, user equals null and the exception is thrown.