如何将brcypt编码器引用到定制身份验证提供程序？

Question

在我的Spring项目中，我定义了自己的自定义身份验证提供程序。在引入Spring Security之前，我在Java代码中使用了BCrypt，现在在数据库中进行BCrypting后保存密码。

弹簧security.xml文件

<security:authentication-manager> 
      <security:authentication-provider ref="myAuthenticationProvider"> 
      </security:authentication-provider> 
     </security:authentication-manager> 

    <b:bean id="bcryptEncoder" class="org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder" /> 

    <b:bean id="myAuthenticationProvider" class="com.cT.www.provider.CustomAuthenticationProvider"> 
    </b:bean> 

而且我自定义的身份验证提供如下所示。

@Component 
public class CustomAuthenticationProvider implements AuthenticationProvider { 

    public CustomAuthenticationProvider() { 
     super(); 
    } 


    @Autowired 
    private PersonService personService;  

    @Override 
    public Authentication authenticate(Authentication authentication) 
      throws AuthenticationException { 

     System.out.println(authentication.getName() + "principal" +(String) authentication.getCredentials()); 

     String username = authentication.getName(); 
     String password = (String) authentication.getCredentials(); 

     UserSignUp user = (UserSignUp) personService.loadUserByUsername(username); 

     if (user == null || !user.getUsername().equalsIgnoreCase(username)) { 
      throw new BadCredentialsException("Username not found."); 
     } 

     if (!password.equals(user.getPassword())) { 
      throw new BadCredentialsException("Wrong password."); 
     } 

     List<Role> authorities = user.getAuthorities(); 

     return new UsernamePasswordAuthenticationToken(user, password, authorities); 
    } 

    @Override 
    public boolean supports(Class<?> arg0) { 
     // TODO Auto-generated method stub 
     return true; 
    } 

} 

我不想使用user-service-ref在弹簧security.xml文件wihtin认证经理。

Answer 1

您可以参考BCryptPasswordEncoder这样：

<authentication-manager> 
    <authentication-provider> 
     <password-encoder ref="encoder" /> 
    </authentication-provider> 
    </authentication-manager> 

    <beans:bean id="encoder" 
    class="org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder"> 
    <beans:constructor-arg name="strength" value="11" /> 
    </beans:bean> 

详见http://www.mkyong.com/spring-security/spring-security-password-hashing-example/

Answer 2

如果您的用户密码数据库已经储存为BCrypt你并不需要太多的做事情。在您的身份验证方法，就像下面

if (BCrypt.checkpw(password, user.getPassword())) { 
     throw new BadCredentialsException("Wrong password."); 
    } 

参考BCrypt源的详细信息，取代密码检查条件。