Spring Security에서 Java 코드로 사용자를 로그인하는 방법은 무엇입니까?

Question

내 자바 코드에 스크립트를 작성하려고하는데, 사용자 로그인이 필요하고 실제 사용자가 웹 클라이언트와 로그 아웃에서 할 수있는 일을 할 수 있습니다.

스프링 보안에서는 어떻게 작동합니까? 어떻게해야합니까? 실제, 세션, 역할 및 권한과 같은 사용자 인증을 모방하는 방법을 의미합니까?

고맙습니다.

Answer 1

몇 시간 후에 내가 발견

public class SecurityWebApplicationInitializer extends AbstractSecurityWebApplicationInitializer { 

} 

솔루션 :

@Component 
public class AuthorityUtils { 

//org.springframework.security.authentication.AuthenticationManager 
@Autowired 
private AuthenticationManager authenticationManager; 

public void loginDirectly(String email, String password) { 
    UsernamePasswordAuthenticationToken loginToken = new UsernamePasswordAuthenticationToken(email, password); 
    Authentication authenticatedUser = authenticationManager.authenticate(loginToken); 
    SecurityContextHolder.getContext().setAuthentication(authenticatedUser); 
    } 
} 

Answer 2

예 :

스프링 보안 Java 구성을 생성하십시오. JdbcTokenRepositoryImpl 및 InMemoryTokenRepositoryImpl :

@Configuration 
@EnableWebSecurity 
public class SecurityConfiguration extends WebSecurityConfigurerAdapter { 

    @Autowired 
    @Qualifier("customUserDetailsService") 
    UserDetailsService userDetailsService; 

    @Autowired 
    PersistentTokenRepository tokenRepository; 

    @Autowired 
    public void configureGlobalSecurity(AuthenticationManagerBuilder auth) throws Exception { 
     auth.userDetailsService(userDetailsService); 
     auth.authenticationProvider(authenticationProvider()); 
    } 

    @Override 
    protected void configure(HttpSecurity http) throws Exception { 
     http.authorizeRequests().antMatchers("/", "/list") 
       .access("hasRole('USER') or hasRole('ADMIN') or hasRole('DBA')") 
       .antMatchers("/newuser/**", "/delete-user-*").access("hasRole('ADMIN')").antMatchers("/edit-user-*") 
       .access("hasRole('ADMIN') or hasRole('DBA')").and().formLogin().loginPage("/login") 
       .loginProcessingUrl("/login").usernameParameter("ssoId").passwordParameter("password").and() 
       .rememberMe().rememberMeParameter("remember-me").tokenRepository(tokenRepository) 
       .tokenValiditySeconds(86400).and().csrf().and().exceptionHandling().accessDeniedPage("/Access_Denied"); 
    } 

    @Bean 
    public PasswordEncoder passwordEncoder() { 
     return new BCryptPasswordEncoder(); 
    } 

    @Bean 
    public DaoAuthenticationProvider authenticationProvider() { 
     DaoAuthenticationProvider authenticationProvider = new DaoAuthenticationProvider(); 
     authenticationProvider.setUserDetailsService(userDetailsService); 
     authenticationProvider.setPasswordEncoder(passwordEncoder()); 
     return authenticationProvider; 
    } 

    @Bean 
    public PersistentTokenBasedRememberMeServices getPersistentTokenBasedRememberMeServices() { 
     PersistentTokenBasedRememberMeServices tokenBasedservice = new PersistentTokenBasedRememberMeServices(
       "remember-me", userDetailsService, tokenRepository); 
     return tokenBasedservice; 
    } 

    @Bean 
    public AuthenticationTrustResolver getAuthenticationTrustResolver() { 
     return new AuthenticationTrustResolverImpl(); 
    } 

} 

봄 보안 PersistentTokenRepository의이 구현되어 있습니다. 위의 구현

@Repository("tokenRepositoryDao") 
@Transactional 
public class HibernateTokenRepositoryImpl extends AbstractDao<String, PersistentLogin> 
     implements PersistentTokenRepository { 

    static final Logger logger = LoggerFactory.getLogger(HibernateTokenRepositoryImpl.class); 

    @Override 
    public void createNewToken(PersistentRememberMeToken token) { 
     logger.info("Creating Token for user : {}", token.getUsername()); 
     PersistentLogin persistentLogin = new PersistentLogin(); 
     persistentLogin.setUsername(token.getUsername()); 
     persistentLogin.setSeries(token.getSeries()); 
     persistentLogin.setToken(token.getTokenValue()); 
     persistentLogin.setLast_used(token.getDate()); 
     persist(persistentLogin); 

    } 

    @Override 
    public PersistentRememberMeToken getTokenForSeries(String seriesId) { 
     logger.info("Fetch Token if any for seriesId : {}", seriesId); 
     try { 
      Criteria crit = createEntityCriteria(); 
      crit.add(Restrictions.eq("series", seriesId)); 
      PersistentLogin persistentLogin = (PersistentLogin) crit.uniqueResult(); 

      return new PersistentRememberMeToken(persistentLogin.getUsername(), persistentLogin.getSeries(), 
        persistentLogin.getToken(), persistentLogin.getLast_used()); 
     } catch (Exception e) { 
      logger.info("Token not found..."); 
      return null; 
     } 
    } 

    @Override 
    public void removeUserTokens(String username) { 
     logger.info("Removing Token if any for user : {}", username); 
     Criteria crit = createEntityCriteria(); 
     crit.add(Restrictions.eq("username", username)); 
     PersistentLogin persistentLogin = (PersistentLogin) crit.uniqueResult(); 
     if (persistentLogin != null) { 
      logger.info("rememberMe was selected"); 
      delete(persistentLogin); 
     } 

    } 

    @Override 
    public void updateToken(String seriesId, String tokenValue, Date lastUsed) { 
     logger.info("Updating Token for seriesId : {}", seriesId); 
     PersistentLogin persistentLogin = getByKey(seriesId); 
     persistentLogin.setToken(tokenValue); 
     persistentLogin.setLast_used(lastUsed); 
     update(persistentLogin); 
    } 

} 

엔티티 [PersistentLogin] 아래 persistent_logins 테이블이다 매핑 엔티티 자체를 이용한다. 보안 구성에 사용

@Entity 
@Table(name="PERSISTENT_LOGINS") 
public class PersistentLogin implements Serializable{ 

    @Id 
    private String series; 

    @Column(name="USERNAME", unique=true, nullable=false) 
    private String username; 

    @Column(name="TOKEN", unique=true, nullable=false) 
    private String token; 

    @Temporal(TemporalType.TIMESTAMP) 
    private Date last_used; 

    public String getSeries() { 
     return series; 
    } 

    public void setSeries(String series) { 
     this.series = series; 
    } 

    public String getUsername() { 
     return username; 
    } 

    public void setUsername(String username) { 
     this.username = username; 
    } 

    public String getToken() { 
     return token; 
    } 

    public void setToken(String token) { 
     this.token = token; 
    } 

    public Date getLast_used() { 
     return last_used; 
    } 

    public void setLast_used(Date last_used) { 
     this.last_used = last_used; 
    } 


} 

UserDetailsService의 구현은 다음과 같습니다

@Service("customUserDetailsService") 
public class CustomUserDetailsService implements UserDetailsService{ 

    static final Logger logger = LoggerFactory.getLogger(CustomUserDetailsService.class); 

    @Autowired 
    private UserService userService; 

    @Transactional(readOnly=true) 
    public UserDetails loadUserByUsername(String ssoId) 
      throws UsernameNotFoundException { 
     User user = userService.findBySSO(ssoId); 
     logger.info("User : {}", user); 
     if(user==null){ 
      logger.info("User not found"); 
      throw new UsernameNotFoundException("Username not found"); 
     } 
      return new org.springframework.security.core.userdetails.User(user.getSsoId(), user.getPassword(), 
       true, true, true, true, getGrantedAuthorities(user)); 
    } 


    private List<GrantedAuthority> getGrantedAuthorities(User user){ 
     List<GrantedAuthority> authorities = new ArrayList<GrantedAuthority>(); 

     for(UserProfile userProfile : user.getUserProfiles()){ 
      logger.info("UserProfile : {}", userProfile); 
      authorities.add(new SimpleGrantedAuthority("ROLE_"+userProfile.getType())); 
     } 
     logger.info("authorities : {}", authorities); 
     return authorities; 
    } 

} 

마지막으로, 아래에 언급 된 이니셜 클래스를 사용하여 응용 프로그램 전쟁과 springSecurityFilter를 등록합니다.