春季安全/休眠：即使它們是正確的，憑據也不正確？

Question

嘿，我有一點與我的基於springsecurity登錄亂

我不斷收到錯誤「壞憑據」

這裏是我的用戶表：

[用戶表] [1 ]

下面是從ApplicationContext中我數據源：

<!-- database driver/location --> 
<bean id="dataSource" class="org.springframework.jdbc.datasource.DriverManagerDataSource"> 
    <property name="driverClassName" value="com.mysql.jdbc.Driver" /> 
    <property name="url" value="jdbc:mysql://localhost:3306/ams" /> 
    <property name="username" value="root" /> 
    <property name="password" value="root" /> 
</bean> 

和我的SecurityContext：

<?xml version="1.0" encoding="UTF-8"?> 
<beans xmlns="http://www.springframework.org/schema/beans" 
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
    xmlns:context="http://www.springframework.org/schema/context" 
    xmlns:security="http://www.springframework.org/schema/security" 
    xmlns:tx="http://www.springframework.org/schema/tx" 
    xsi:schemaLocation="http://www.springframework.org/schema/beans 
       http://www.springframework.org/schema/beans/spring-beans-3.1.xsd 
       http://www.springframework.org/schema/security 
       http://www.springframework.org/schema/security/spring-security-3.0.xsd"> 

    <!-- <security:http auto-config="true" access-decision-manager-ref="accessDecisionManager"> --> 
    <security:http auto-config="true"> 
     <security:intercept-url pattern="/login/login.do" access="IS_AUTHENTICATED_ANONYMOUSLY" /> 
     <security:intercept-url pattern="/login/doLogin.do" access="IS_AUTHENTICATED_ANONYMOUSLY" /> 
     <security:intercept-url pattern="/lib/**" access="IS_AUTHENTICATED_ANONYMOUSLY" /> 
     <security:intercept-url pattern="/css/**" access="IS_AUTHENTICATED_ANONYMOUSLY" /> 
     <security:intercept-url pattern="/images/**" access="IS_AUTHENTICATED_ANONYMOUSLY" /> 
     <security:intercept-url pattern="/resources/**" access="IS_AUTHENTICATED_ANONYMOUSLY" /> 
     <security:intercept-url pattern="/**" access="IS_AUTHENTICATED_REMEMBERED" /> 
     <security:form-login login-page="/login/login.do" authentication-failure-url="/login/login.do?login_error=true" default-target-url="/test/showTest.do"/> 
     <security:logout logout-success-url="/login/login.do" invalidate-session="true" /> 
     <security:remember-me key="rememberMe"/> 
    </security:http>  


    <security:authentication-manager> 
     <security:authentication-provider> 
      <security:jdbc-user-service data-source-ref="dataSource" 
      users-by-username-query="select USERNAME as username, PASSWORD as password, DELETED as deleted from ams.user where USERNAME=?" 
      authorities-by-username-query=" 
       select distinct user.USERNAME as username, permission.NAME as authority 
      from scu.user, scu.user_role, scu.role, scu.role_permission, scu.permission 
      where user.ID=user_role.USER_ID AND user_role.ROLE_ID=role_permission.ROLE_ID AND role_permission.PERMISSION_ID=permission.ID AND user.USERNAME=?"/> 
      <!-- security:password-encoder ref="passwordEncoder" /> --> 
     </security:authentication-provider> 
    </security:authentication-manager> 

    <bean id="passwordEncoder" 
     class="org.springframework.security.authentication.encoding.ShaPasswordEncoder"> 
     <constructor-arg value="256" /> 
    </bean> 
</beans> 

當我嘗試登錄：admin和init01

它給我的錯誤壞證書... =（

任何建議都感激！

Answer 1

authentication-provider中的password-encoder參考已被註釋掉。如果您使用散列密碼（如您應該那樣），則需要密碼編碼器。還請檢查this answer，特別是關於編寫測試的第2點，以確保您使用的密碼編碼器與您存儲在數據庫中的密碼編碼器相匹配。

您可能還想檢查this answer on using bcrypt作爲普通SHA哈希的更安全的替代方法。

Answer 2

您的密碼正在散列。如果您添加密碼「init01」，實際上意味着原始密碼的哈希爲'init01'，因爲Spring將提供的密碼哈希並與您輸入的密碼相匹配。因此，SHA（'init01'）是'init01'以外的內容