堆棧內存溢出
  簡體   English   中英

即使憑據正確，Spring-security 也不會登錄用戶

[英]Spring-security not logging-in user even when credentials are correct

 原文  2015-04-24 16:08:24  1   1    java/ hibernate/ jsp/ spring-mvc/ spring-security

問題描述

誰能指出我的錯誤。 起初我無法使用注冊用戶登錄我以為是因為我正在加密密碼但即使現在我已經刪除了編碼用戶仍然無法使用明文密碼登錄？

這是我的 web.xml：

<?xml version="1.0" encoding="UTF-8"?>
<web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns="http://java.sun.com/xml/ns/javaee" xmlns:web="http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd"
xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd"
id="WebApp_ID" version="2.5">
<display-name>SgaWebApp</display-name>
<welcome-file-list>
    <welcome-file>login.jsp</welcome-file>
</welcome-file-list>
<servlet>
    <display-name>dispatcher</display-name>
    <servlet-name>dispatcher</servlet-name>
    <servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
    <init-param>
        <param-name>contextConfigLocation</param-name>
        <param-value>classpath:com/sga/app/xml/dispatcher-servlet.xml</param-value>
    </init-param>
    <load-on-startup>1</load-on-startup>
</servlet>
<servlet-mapping>
    <servlet-name>dispatcher</servlet-name>
    <url-pattern>/</url-pattern>
    <url-pattern>*.css</url-pattern>
</servlet-mapping>
<resource-ref>
    <res-ref-name>jdbc/springSgaDb</res-ref-name>
    <res-type>javax.sql.DataSource</res-type>
    <res-auth>Container</res-auth>
</resource-ref>
<listener>
    <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
</listener>
<context-param>
    <param-name>contextConfigLocation</param-name>
    <param-value>
            classpath:com/sga/app/xml/security-context.xml
            classpath:com/sga/app/xml/dao-context.xml
            classpath:com/sga/app/xml/service-context.xml
        </param-value>
</context-param>

<filter>
    <display-name>springSecurityFilterChain</display-name>
    <filter-name>springSecurityFilterChain</filter-name>
    <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>
<filter-mapping>
    <filter-name>springSecurityFilterChain</filter-name>
    <url-pattern>/*</url-pattern>
</filter-mapping>
<session-config>
    <session-timeout>60</session-timeout>
</session-config>

我的登錄.jsp：

<%@ page language="java" contentType="text/html; charset=ISO-8859-1"
pageEncoding="ISO-8859-1"%>
<%@ taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core"%>
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"  "http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<link href="${pageContext.request.contextPath}/static/css/main.css"
rel="stylesheet" type="text/css">
<title>SGA-login page</title>
</head>
<body onload='document.f.j_username.focus();'>
<div class="wrapper">
    <!-- Form -->
    <div class="login">
        <h2 class="customLoginFormHeader">Login with Username and
            Password</h2>

        <c:if test="${param.error != null}">
            <p class="errorCustomLogin">Login failed. Please try your
                username/password again.</p>
        </c:if>

        <form name='f'
            action='${pageContext.request.contextPath}/j_spring_security_check'
            method='POST' class="loginForm">
            <table>
                <tr class="loginFormTableRow">
                    <td class="tdCustomLogin">Username:</td>
                    <td><input type='text' name='j_username'
                        class="usernameInputCustomLogin"></td>
                </tr>
                <tr class="loginFormTableRow">
                    <td class="tdCustomLogin">Password:</td>
                    <td><input type='password' name='j_password'
                        class="passwordInputCustomLogin" /></td>
                </tr>
                <tr class="loginFormTableRow">
                    <td class="tdRememberMeHeader">Remember me:</td>
                    <td><input type="checkbox"
                        name='_spring_security_remember_me' checked="checked"
                        class="rememberMeCustomLogin" /></td>
                </tr>
                <tr class="loginFormTableRow">
                    <td colspan='2'><input type="submit" value="Login"
                        class="customLoginSubmitButton" /></td>
                </tr>
            </table>
        </form>
    </div>
</div>
</body>
</html>

我的 security-context.xml：

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:security="http://www.springframework.org/schema/security"
xsi:schemaLocation="http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security.xsd
    http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd">

<security:authentication-manager>
    <security:authentication-provider>
        <security:jdbc-user-service
            data-source-ref="dataSource" id="jdbcUserService" />
    </security:authentication-provider>
</security:authentication-manager>
<security:http use-expressions="true">
    <security:logout logout-success-url="/login"
        invalidate-session="true" />
    <security:intercept-url pattern="/admin"
        access="hasRole('ROLE_ADMIN')" />
    <security:intercept-url pattern="/admin"
        access="permitAll" />
    <security:intercept-url pattern="/login"
        access="permitAll" />
    <security:intercept-url pattern="/" access="permitAll" />
    <security:intercept-url pattern="/static/**"
        access="permitAll" />
    <security:intercept-url pattern="/customloginform"
        access="permitAll" />
    <security:intercept-url pattern="/error"
        access="permitAll" />
    <security:intercept-url pattern="/register"
        access="permitAll" />
    <security:intercept-url pattern="/createaccount"
        access="permitAll" />
    <security:intercept-url pattern="/accountcreated"
        access="permitAll" />
    <security:intercept-url pattern="/contactus"
        access="permitAll" />
    <security:intercept-url pattern="/denied"
        access="permitAll" />
    <security:intercept-url pattern="/menu"
        access="isAuthenticated()" />
    <security:intercept-url pattern="/roundanalysis"
        access="isAuthenticated()" />
    <security:intercept-url pattern="/roundanalysiserrorpage"
        access="isAuthenticated()" />
    <security:intercept-url pattern="/analysisoutcome"
        access="isAuthenticated()" />
    <security:intercept-url pattern="/viewmystats"
        access="isAuthenticated()" />
    <security:intercept-url pattern="/userstats"
        access="isAuthenticated()" />
    <security:intercept-url pattern="/clubstats"
        access="isAuthenticated()" />
    <security:intercept-url pattern="/allstats"
        access="isAuthenticated()" />
    <security:intercept-url pattern="/**" access="denyAll" />
    <security:form-login login-page="/customloginform"
        default-target-url="/menu" authentication-failure-url="/customloginform?error=true" />
    <security:access-denied-handler
        error-page="/denied" />
    <security:remember-me key="sgaAppKey"
        user-service-ref="jdbcUserService" />
</security:http>
<security:global-method-security
    secured-annotations="enabled"></security:global-method-security>

還有我的 LoginDAO：

@Repository
@Component("usersDAO")
@Transactional
public class UsersDAO {

private NamedParameterJdbcTemplate jdbc;

@Autowired
private SessionFactory sessionFactory;

public Session session() {
    return sessionFactory.getCurrentSession();
}

@Transactional
public boolean createUser(UserBean user) {
    MapSqlParameterSource params = new MapSqlParameterSource();
    params.addValue("username", user.getUsername());
    params.addValue("email", user.getEmail());
    params.addValue("password", user.getPassword());
    params.addValue("forename", user.getForename());
    params.addValue("surname", user.getSurname());
    params.addValue("homeclub", user.getHomeclub());
    params.addValue("authority", user.getAuthority());
    return jdbc
            .update("insert into users (username, email, password, forename, surname, homeclub, authority) values (:username, :email, :password, :forename, :surname, :homeclub, :authority)",
                    params) == 1;
}

@Autowired
public void setDataSource(DataSource jdbc) {
    this.jdbc = new NamedParameterJdbcTemplate(jdbc);
}

public boolean exists(String username) {
    return jdbc.queryForObject(
            "select count(*) from users where username=:username",
            new MapSqlParameterSource("username", username), Integer.class) > 0;
}

public List<UserBean> getAllUsers() {
    return jdbc.query("select * from users",
            BeanPropertyRowMapper.newInstance(UserBean.class));
}

}

這是控制台輸出：

DEBUG - Request is to process authentication
DEBUG - Authentication attempt using org.springframework.security.authentication.dao.DaoAuthenticationProvider
DEBUG - Executing prepared SQL query
DEBUG - Executing prepared SQL statement [select username,password,enabled from users where username = ?]
DEBUG - Fetching JDBC Connection from DataSource
DEBUG - Returning JDBC Connection to DataSource
DEBUG - Executing prepared SQL query
DEBUG - Executing prepared SQL statement [select username,authority from authorities where username = ?]
DEBUG - Fetching JDBC Connection from DataSource
DEBUG - Returning JDBC Connection to DataSource
DEBUG - User 'Harry12345' has no authorities and will be treated as 'not found'
DEBUG - User 'Harry12345' not found
DEBUG - Authentication request failed: org.springframework.security.authentication.BadCredentialsException: Bad credentials
DEBUG - Updated SecurityContextHolder to contain null Authentication
DEBUG - Delegating to authentication failure handler org.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler@65d201b5
DEBUG - Interactive login attempt was unsuccessful.
DEBUG - Cancelling cookie
DEBUG - Redirecting to /customloginform?error=true
DEBUG - Redirecting to '/SgaWebApp/customloginform?error=true'

1 個解決方案

解決方案1
 1 已采納  2015-04-24 16:26:31

日志輸出清楚地顯示了問題：

DEBUG - User 'Harry12345' has no authorities and will be treated as 'not found'

因此，它找到了用戶，但沒有找到與他相關的任何權限。

默認<security:jdbc-user-service />期望與每個用戶關聯的至少一個權限。 這些權限應該按照37.1 User Schema 中的定義來表示。

如果您想要不同的用戶和權限數據表示（例如您的authority字段），則需要實現自定義UserDetailsService 。

暫無
暫無

聲明:本站的技術帖子網頁，遵循CC BY-SA 4.0協議，如果您需要轉載，請注明本站網址或者原文地址。任何問題請咨詢:yoyou2525@163.com.

相關問題 Spring-security甚至在提交表單之前就會顯示“Bad Credentials” 在Spring-Security中注銷用戶時從會話中刪除用戶登錄憑據 Spring Security - 即使憑據正確，身份驗證也不起作用 春季安全錯誤登錄的用戶 Spring，Spring-security：即使登錄失敗，Spring-security也將返回302 Spring-security：即使在 JVM 重啟后也保持活動會話 剖析彈簧安全性 當未經授權的用戶嘗試使用未知的用戶名和密碼登錄時，spring-security 項目崩潰 當他嘗試進入登錄頁面時，使用Java spring-security重定向已經登錄的用戶 BadCredentialsException是spring-security
相關標簽
 
粵ICP備18138465號  © 2020-2024 STACKOOM.COM