Spring Security - 注册

Question

我使用此模板https://github.com/hellokoding/registration-login-spring-xml-maven-jsp-mysql进行注册。

控制器

@RequestMapping(value = "/register", method = POST) 
public String registration(@ModelAttribute("userForm") User userForm) { 
    userService.add(userForm); 
    securityService.autologin(userForm.getUsername(), userForm.getPassword()); 
    return "redirect:/notes/"; 
} 

方法自动登录：

@Override 
public void autologin(final String username, final String password) { 
    UserDetails userDetails = userDetailsService.loadUserByUsername(username); 
    UsernamePasswordAuthenticationToken usernamePasswordAuthenticationToken = new UsernamePasswordAuthenticationToken(userDetails, password, userDetails.getAuthorities()); 

    authenticationManager.authenticate(usernamePasswordAuthenticationToken); 

    if (usernamePasswordAuthenticationToken.isAuthenticated()) { 
     SecurityContextHolder.getContext().setAuthentication(usernamePasswordAuthenticationToken); 
    } 
} 

方法loadUserByUsername：

@Override 
@Transactional(readOnly = true) 
public UserDetails loadUserByUsername(final String username) throws UsernameNotFoundException { 
    User user = userRepository.findByName(username); 

    Set<GrantedAuthority> grantedAuthorities = user.getRoles().stream().map(role -> new SimpleGrantedAuthority(role.getName())).collect(Collectors.toSet()); 

    return new org.springframework.security.core.userdetails.User(user.getUsername(), user.getPassword(), grantedAuthorities); 
} 

HTTP配置：

<http auto-config="true" > 
    <intercept-url pattern="/notes**" access="authenticated" /> 
    <intercept-url pattern="/" access="permitAll" /> 
    <intercept-url pattern="/auth**" access="permitAll" /> 
    <intercept-url pattern="/accessDenied" access="permitAll" /> 

    <access-denied-handler error-page="/accessDenied" /> 

    <logout logout-success-url="/auth/login?logout" /> 
    <form-login 
      default-target-url="/notes/" 
      login-page="/auth/login" 
      login-processing-url="/j_spring_security_check" 
      username-parameter="username" 
      password-parameter="password" 
    /> 
    <remember-me data-source-ref="dataSource" /> 

    <session-management session-fixation-protection="newSession" > 
     <concurrency-control max-sessions="1" error-if-maximum-exceeded="true" /> 
    </session-management> 
</http> 

但是，当我创建一个帐户，之后“注册”页面，我去上的“符号”。并且这个用户被添加到数据库。但是，我必须重定向：/ notes /。

Answer 1

AuthenticationManager的authenticate(Authentication auth)方法返回一个新创建的认证对象，而不是您作为参数修改传递的认证对象。

autologin()方法实际上是做更多的事情，它应该。我会尝试这样的：

public void autologin(final String username, final String password) { 
     UsernamePasswordAuthenticationToken usernamePasswordAuthenticationToken = 
       new UsernamePasswordAuthenticationToken(
         username, password); 

     Authentication authResult = authenticationManager.authenticate(usernamePasswordAuthenticationToken); 

     if (authResult.isAuthenticated()) { 
      SecurityContextHolder.getContext().setAuthentication(usernamePasswordAuthenticationToken); 
     } 

    } 

当你调用AuthenticationManager.authenticate(Authentication auth)的AuthenticationManager会本身就是试图对每类认证AuthenticationProvider的匹配，它本身必须调用UserDetailsService.loadUserByUsername(String username)在认证的过程。

因此，首先绕过AuthenticationManager/AuthenticationProvider结构调用UserDetailsService，然后重试认证使用UserDetails从服务对Manager/Provider/UserDetailsS​​ervice创建的Authentication对象，这对我来说有点令人讨厌。

请试试我的“自动登录”段，而不是你的，看它是否工作