Spring安全JDBC未经授权的认证

Question

我不需要管理员角色，所以我只需要执行身份验证。

@Configuration
@EnableWebSecurity
protected static class WebSecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired
    private DataSource dataSource;

    @Autowired
    private MyAuthenticationSuccessHandler authenticationSuccessHandler;


    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests().anyRequest().authenticated().and().formLogin().loginPage("/login")
                .successHandler(authenticationSuccessHandler).failureUrl("/login?error").permitAll().and().logout()
                .permitAll();
        http.csrf().disable();

    }

    @Override
    public void configure(AuthenticationManagerBuilder auth) throws Exception {

        auth.jdbcAuthentication().dataSource(dataSource)
                .usersByUsernameQuery("select login, password, enabled from users where login=?");

    }

}

我的问题是，当我尝试运行它时，我得到

org.springframework.security.authentication.InternalAuthenticationServiceException: PreparedStatementCallback; bad SQL grammar [select username,authority from authorities where username = ?]; nested exception is com.mysql.jdbc.exceptions.jdbc4.MySQLSyntaxErrorException: Table 'phonebook.authorities' doesn't exist

，这是合乎逻辑的，因为我没有应用 .authoritiesByUsernameQuery() 方法。问题是我怎样才能克服它？如何在不需要查询数据库的情况下为所有用户分配默认角色？如何仅使用登录名和密码而不使用角色从数据库登录？

Answer 1

选项1是设置一个"dummy"具有静态角色的查询：

public void configure(AuthenticationManagerBuilder auth) throws Exception {
    auth.jdbcAuthentication().dataSource(dataSource)
            .usersByUsernameQuery("select login, password, enabled from users where login=?")
            .authoritiesByUsernameQuery("select login, 'ROLE_USER' from users where login=?");
}

选项 2 如果您想优化第二个查询：

public void configure(AuthenticationManagerBuilder auth) throws Exception {
    auth.userDetailsService(userDetailsService);
}

您必须在其中实现 UserDetailsService 接口。

Spring安全JDBC未经授权的认证

Spring Security JDBC authentication without authorization

authentication

jdbc

spring-security

authorization

spring-java-config