spring 引导的安全配置

Question

我是初学者，想在添加用户时对密码进行编码，但是出现错误(@Bean)。

Error:

The injection point has the following annotations:
    - @org.springframework.beans.factory.annotation.Autowired(required=true)
    

Description:

Field passwordEncoder in com.example.demo.service.UsersService required a bean of type 'org.springframework.security.crypto.password.PasswordEncoder' that could not be found.

The injection point has the following annotations:
    - @org.springframework.beans.factory.annotation.Autowired(required=true)

Action:

Consider defining a bean of type 'org.springframework.security.crypto.password.PasswordEncoder' in your configuration.

我的代码：

@Configuration
@EnableConfigurationProperties
@EnableGlobalMethodSecurity(prePostEnabled = true, securedEnabled = true, jsr250Enabled = true)
public class SecurityConfiguration extends WebSecurityConfigurerAdapter {

    @Autowired
    UsersService userService;
    
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        // TODO Auto-generated method stub
        http.csrf().disable() //TODO implement csrf
        .cors().and().authorizeRequests().antMatchers(HttpMethod.OPTIONS,"/").permitAll()
        .antMatchers("/login").permitAll()
        .antMatchers("/add-users").permitAll()
        .and().authorizeRequests().anyRequest().authenticated();
    }
    
    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        // TODO Auto-generated method stub
        auth.userDetailsService(userService)
        .passwordEncoder(passwordEncoder());
    }
    
    @Bean
    @Override
    public AuthenticationManager authenticationManagerBean() throws Exception {
        // TODO Auto-generated method stub
        return super.authenticationManagerBean();
    }
    
    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }
}

public class UsersService implements UserDetailsService {

    @Autowired
    UsersRepository repo;
    
    @Autowired
    private PasswordEncoder passwordEncoder;
        
    public Users save(Users u) {
        String encodpass=passwordEncoder.encode(u.getPassword());
        String confpass=passwordEncoder.encode(u.getConfirmepass());
        u.setConfirmpass(confpass);
        u.setPassword(encodpass);
        u.setLock(false);
        u.setEnable(true);
        return repo.save(u);
    }
}

    @RestController  
    public class UsersController {
        @Autowired 
        private UsersService service;
        @PostMapping("/add-users")
        public Users add(@RequestBody Users u) {
            return service.save(u);}

Answer 1

向 UserService 添加 @Service 注释 class。还将 @EnableWebSecurity 添加到配置 class.

Answer 2

问题是，在您的 SecurityConfiguration 中，您正在注入 UsersService，并且 UserService bean 依赖于尚未创建的 PasswordEncoder 类型的 bean .

我将使用更优雅的配置方式来简化您的配置 Spring 安全性：

@Configuration
//your other annotations
public class SecurityConfiguration {

    @Bean
    public SecurityFilterChain app(HttpSecurity http) throws Exception {
        http.csrf().disable().cors().and().authorizeRequests().antMatchers(HttpMethod.OPTIONS,"/").permitAll()
        .antMatchers("/login").permitAll()
        .antMatchers("/add-users").permitAll()
        .and().authorizeRequests().anyRequest().authenticated();
    }

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }

}

仅此而已，您并不真正需要 AuthenticationManager bean，除非您实际使用它。如果你需要它，你可以这样创建它：

@Bean
public AuthenticationManager authenticationManager(UsersService usersService) {
    DaoAuthenticationProvider daoAuthenticationProvider = new DaoAuthenticationProvider();
    daoAuthenticationProvider.setUserDetailsService(usersService);
    ProviderManager manager = new ProviderManager(daoAuthenticationProvider);
    return manager;
}

我事先对任何编译错误表示歉意，因为我是从 phone.

写的

spring 引导的安全配置

Security configuration with spring boot

spring-security

spring-boot