Spring Security - 註冊

Question

我使用此模板https://github.com/hellokoding/registration-login-spring-xml-maven-jsp-mysql進行註冊。

控制器

@RequestMapping(value = "/register", method = POST) 
public String registration(@ModelAttribute("userForm") User userForm) { 
    userService.add(userForm); 
    securityService.autologin(userForm.getUsername(), userForm.getPassword()); 
    return "redirect:/notes/"; 
} 

方法自動登錄：

@Override 
public void autologin(final String username, final String password) { 
    UserDetails userDetails = userDetailsService.loadUserByUsername(username); 
    UsernamePasswordAuthenticationToken usernamePasswordAuthenticationToken = new UsernamePasswordAuthenticationToken(userDetails, password, userDetails.getAuthorities()); 

    authenticationManager.authenticate(usernamePasswordAuthenticationToken); 

    if (usernamePasswordAuthenticationToken.isAuthenticated()) { 
     SecurityContextHolder.getContext().setAuthentication(usernamePasswordAuthenticationToken); 
    } 
} 

方法loadUserByUsername：

@Override 
@Transactional(readOnly = true) 
public UserDetails loadUserByUsername(final String username) throws UsernameNotFoundException { 
    User user = userRepository.findByName(username); 

    Set<GrantedAuthority> grantedAuthorities = user.getRoles().stream().map(role -> new SimpleGrantedAuthority(role.getName())).collect(Collectors.toSet()); 

    return new org.springframework.security.core.userdetails.User(user.getUsername(), user.getPassword(), grantedAuthorities); 
} 

HTTP配置：

<http auto-config="true" > 
    <intercept-url pattern="/notes**" access="authenticated" /> 
    <intercept-url pattern="/" access="permitAll" /> 
    <intercept-url pattern="/auth**" access="permitAll" /> 
    <intercept-url pattern="/accessDenied" access="permitAll" /> 

    <access-denied-handler error-page="/accessDenied" /> 

    <logout logout-success-url="/auth/login?logout" /> 
    <form-login 
      default-target-url="/notes/" 
      login-page="/auth/login" 
      login-processing-url="/j_spring_security_check" 
      username-parameter="username" 
      password-parameter="password" 
    /> 
    <remember-me data-source-ref="dataSource" /> 

    <session-management session-fixation-protection="newSession" > 
     <concurrency-control max-sessions="1" error-if-maximum-exceeded="true" /> 
    </session-management> 
</http> 

但是，當我創建一個帳戶，之後「註冊」頁面，我去上的「符號」。並且這個用戶被添加到數據庫。但是，我必須重定向：/ notes /。

Answer 1

AuthenticationManager的authenticate(Authentication auth)方法返回一個新創建的認證對象，而不是您作爲參數修改傳遞的認證對象。

autologin()方法實際上是做更多的事情，它應該。我會嘗試這樣的：

public void autologin(final String username, final String password) { 
     UsernamePasswordAuthenticationToken usernamePasswordAuthenticationToken = 
       new UsernamePasswordAuthenticationToken(
         username, password); 

     Authentication authResult = authenticationManager.authenticate(usernamePasswordAuthenticationToken); 

     if (authResult.isAuthenticated()) { 
      SecurityContextHolder.getContext().setAuthentication(usernamePasswordAuthenticationToken); 
     } 

    } 

當你調用AuthenticationManager.authenticate(Authentication auth)的AuthenticationManager會本身就是試圖對每類認證AuthenticationProvider的匹配，它本身必須調用UserDetailsService.loadUserByUsername(String username)在認證的過程。

因此，首先繞過AuthenticationManager/AuthenticationProvider結構調用UserDetailsService，然後重試認證使用UserDetails從服務對Manager/Provider/UserDetailsS​​ervice創建的Authentication對象，這對我來說有點令人討厭。

請試試我的「自動登錄」段，而不是你的，看它是否工作