Spring roo安全：Bad credentials

Question

我使用security setup命令將登錄頁面添加到我的roo應用程序。但是，應用程序不從數據庫中讀取任何用戶，它只使用applicationContext-security.xml中提供的後門程序。即使表中有其他用戶，我也可以僅使用（admin，admin）登錄應用程序。

log.roo

project --topLevelPackage edu.gju.edusyria --projectName FinalVersion --java 6 --packaging JAR 
hint 
jpa setup --database MYSQL --provider HIBERNATE 
hint 
osgi start --url file:///C:/Users/Motassem/Desktop/roo-i18n-arabic-master/target/org.dls.roo.i18n.arabic-0.1.0.BUILD-SNAPSHOT.jar 
hint 
entity jpa --class ~.model.security.Principal --table security_principals 
field string --fieldName username --notNull --sizeMax 50 --sizeMin 3 
field string --fieldName password --notNull --sizeMax 50 --sizeMin 3 
field boolean --fieldName enabled 
entity jpa --class ~.model.security.Authority --table security_authorities 
field string --fieldName roleId --notNull --sizeMax 10 --sizeMin 8 
field string --fieldName authority --notNull --sizeMax 50 

entity jpa --class ~.model.security.Authority --table security_authorities 
field string --fieldName roleId --notNull --sizeMax 10 --sizeMin 8 
field string --fieldName authority --notNull --sizeMax 50 --sizeMin 8 --regexp ^ROLE_[A-Z]* 
entity jpa --class ~.model.security.AuthorityPrincipalAssignment --table security_role_assignments 
field reference --fieldName username --type ~.model.security.Principal 
field reference --fieldName roleId --type ~.model.security.Authority 

help 
web mvc setup 

web mvc scaffold --class ~.web.security.UserController --backingType ~.model.security.Principal --path /security/users 
web mvc scaffold --class ~.web.security.RoleController --backingType ~.model.security.Authority --path /security/roles 
web mvc scaffold --class ~.web.security.RoleMappingController --backingType ~.model.security.AuthorityPrincipalAssignment --path /security/assignments 
security setup 

的applicationContext-security.xml文件

<?xml version="1.0" encoding="UTF-8"?> 
<beans:beans xmlns="http://www.springframework.org/schema/security" 
    xmlns:beans="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
    xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.1.xsd 
     http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.1.xsd"> 
    <!-- HTTP security configurations --> 
    <http auto-config="true" use-expressions="true"> 
     <form-login login-processing-url="/resources/j_spring_security_check" 
      login-page="/login" authentication-failure-url="/login?login_error=t" /> 
     <logout logout-url="/resources/j_spring_security_logout" /> 
     <!-- Configure these elements to secure URIs in your application --> 
     <intercept-url pattern="/choices/**" access="hasRole('ROLE_ADMIN')" /> 
     <intercept-url pattern="/security/**" access="hasRole('ROLE_ADMIN')" /> 
     <intercept-url pattern="/principals/**" access="hasRole('ROLE_ADMIN')" /> 
     <intercept-url pattern="/member/**" access="isAuthenticated()" /> 
     <intercept-url pattern="/resources/**" access="permitAll" /> 
     <intercept-url pattern="/login/**" access="permitAll" /> 
     <intercept-url pattern="/**" access="isAuthenticated()" /> 
    </http> 
    <!-- Configure Authentication mechanism --> 
    <authentication-manager alias="authenticationManager"> 
     <!-- SHA-256 values can be produced using 'echo -n your_desired_password 
      | sha256sum' (using normal *nix environments) --> 
     <authentication-provider> 
      <password-encoder hash="sha-256"> 

      </password-encoder> 
      <jdbc-user-service data-source-ref="dataSource" 
       users-by-username-query="SELECT username, password, enabled FROM security_principals WHERE username = ?" 
       authorities-by-username-query=" 
SELECT p.username, a.authority 
FROM security_principals p, security_authorities a, 
security_role_assignments ra 
WHERE p.id = ra.username 
AND a.role_Id = ra.role_Id AND p.username = ?" /> 
      <user-service> 
       <user name="admin" 
        password="8c6976e5b5410415bde908bd4dee15dfb167a9c873fc4bb8a81f6f2ab448a918" 
        authorities="ROLE_ADMIN" /> 
       <user name="user" 
        password="04f8996da763b7a969b1028ee3007569eaf3a635486ddab211d512c85b9df8fb" 
        authorities="ROLE_USER" /> 
      </user-service> 
     </authentication-provider> 
    </authentication-manager> 
</beans:beans> 

Answer 1

是很容易使用Spring Security的位於DB用戶保護應用程序。您可以手動更新authentication-provider，但是我建議您使用gvNIX distribution提供的Spring Roo插件來自動配置所有必需的文件。

使用typicalsecurity setup命令，您可以輕鬆地將該功能包含在項目中。

您不需要手動生成用戶和角色實體。這個插件會照顧它。

如果您想了解此功能的完整的例子試試這個命令在一個空文件夾：

// First run the petclinc roo example 
script clinic.roo 
// install typical security assets 
typicalsecurity setup 

祝你好運！