如何使用 Spring 安全性添加新用户而无需重新启动 spring 引导

Question

spring启动完成后，Spring Security的配置无法更新。 如何在不重启 spring 引导的情况下添加新用户或更新用户密码或用户角色？ 因为页面被重定向到 /login?error 页面，当我使用新密码登录时。

@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired
    MemberMapper memberMapper;

    Logger logger = Logger.getLogger(this.getClass());

    @Override
    protected void configure(HttpSecurity http) throws Exception {

        http.csrf().disable();
        http.addFilterBefore(new loginFilter(), AnonymousAuthenticationFilter.class).
                authorizeRequests().antMatchers("/","/register/**","/log/**").permitAll();



        http.formLogin().loginPage("/log/toLogin") 
                        .loginProcessingUrl("/log/login") 
                        .usernameParameter("memacc")
                        .passwordParameter("mempwd")
                        .failureHandler(new AppsAuthenticationFailureHandler());;





        http.logout().logoutSuccessUrl("/");


    }

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {

        List<Members> allMembers = memberMapper.getAllMembers();

        for (Members members : allMembers){
            String[] roleList = members.getRoleList().split(",");
            auth.inMemoryAuthentication().passwordEncoder(new BCryptPasswordEncoder())
                .withUser(members.getMemacc()).password(new BCryptPasswordEncoder().encode(members.getMempwd())).roles(roleList);
        }

    }
}

Answer 1

当您执行登录过程时，spring 引导将用户配置文件保存在 memory 中。 例如，如果您为已登录的用户添加新角色并将其保存在数据库中，则 memory 中的用户配置文件不会更改，这就是您必须更新此数据的原因。

你可以用：

User user = userService.findById(idUser);
    SecurityContextHolder.getContext().setAuthentication(new UsernamePasswordAuthenticationToken(user, user.getPassword(), user.getRoles()));

使用此命令，您可以更新 spring-security memory 中的用户配置文件。

Answer 2

谢谢大家，我找到了解决方案。

...

@EnableWebSecurity

公共 class SecurityConfig 扩展 WebSecurityConfigurerAdapter {

@Autowired
MyUserDetailsService myUserDetailsService;

Logger logger = Logger.getLogger(this.getClass());

@Override
protected void configure(HttpSecurity http) throws Exception {
 
    http.csrf().disable();
    
    http.addFilterBefore(new loginFilter(), AnonymousAuthenticationFilter.class).
            authorizeRequests().antMatchers("/","/register/**","/log/**").permitAll();

    
    http.formLogin().loginPage("/log/toLogin")
                    .loginProcessingUrl("/log/login") 
                    .usernameParameter("memacc")
                    .passwordParameter("mempwd");
    http.logout().logoutSuccessUrl("/");
}
@Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
    auth.userDetailsService(myUserDetailsService);
}

}...

使用 class 实现 UserDetailsService 接口。 当用户登录时，然后验证该用户。

... @Service public class MyUserDetailsService 实现 UserDetailsService {

@Autowired
MemberMapper memberMapper;

@Override
public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {

    Members member = memberMapper.getOneMemberByMemacc(username);
    if(member == null)
        throw new UsernameNotFoundException(username + " not found");
    UserDetails userDetails = User.builder()
            .username(member.getMemacc())
            .password("{noop}" + member.getMempwd())
            .roles(member.getRoleList()).build();
    return userDetails;
}

}...