Spring Security 3.x：在没有UserDetailsS​​ervice的情况下创建自定义身份验证提供程序

Question

I created a custom authentication provider by extending AbstractUserDetailsAuthenticationProvider that authenticates the user against the database and performs additional authorization checks.

The annoyance I'm facing is the authentication provider requires me to wire a UserDetailsService . At least for this project, I have no needs for UserDetailsService because if I have the authentication provider to pull the user information to perform authentication/authorization, I don't see a need to have the UserDetailsService to pull the same user information to construct the UserDetails object.

So, right now, I have to wire a dummy UserDetailsService into my authentication provider and it does absolutely nothing.

Is it possible to create an authentication provider without a UserDetailsService ?

Answer 1

Looking at the code for AbstractUserDetailsAuthenticationProvider (at least for version 3.0.5) it is not requiring UserDetailsService to be wired. Double check your XML configuration to make sure the DAOAuthenticationProvider is not being used.

You should have a block like this

<authentication-manager>
    <authentication-provider ref="yourAuthenticationProvider" />
</authentication-manager>

Also, log the exception you are getting to see exactly where it's getting thrown from.

Answer 2

The default authentication provider used by Spring will be DaoAuthenticationProvider (which extend AbstractUserDetailsAuthenticationProvider and does add some checks of it's own in doAfterPropertiesSet() ).

So that implementation does require a UserDetailsService but you can always just provide your own implementation of the provider, by extending AbstractUserDetailsAuthenticationProvider .