Spring Security自定义用户服务集成指南

import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.userdetails.UserDetails;

import java.util.Collection;

// 假设有一个User实体类，包含getUsername()和getPassword()方法
// public class User {
//    private String username;
//    private String password;
//    // ... getters and setters
// }

public class CustomUserDetails implements UserDetails {
    private final User user; // 这里的User是你自己的用户实体类

    public CustomUserDetails(User user) {
        this.user = user;
    }

    @Override
    public Collection<? extends GrantedAuthority> getAuthorities() {
        // 返回用户权限列表。如果你的User实体包含权限信息，
        // 在这里将其转换为GrantedAuthority列表。
        // 例如：return user.getRoles().stream().map(SimpleGrantedAuthority::new).collect(Collectors.toList());
        return null; // 暂时返回null，实际应用中应根据用户角色返回权限
    }

    @Override
    public String getPassword() {
        return user.getPassword();
    }

    @Override
    public String getUsername() {
        return user.getUsername();
    }

    @Override
    public boolean isAccountNonExpired() {
        return true; // 账户是否过期，实际应用中应根据业务逻辑判断
    }

    @Override
    public boolean isAccountNonLocked() {
        return true; // 账户是否锁定，实际应用中应根据业务逻辑判断
    }

    @Override
    public boolean isCredentialsNonExpired() {
        return true; // 凭证是否过期，实际应用中应根据业务逻辑判断
    }

    @Override
    public boolean isEnabled() {
        return true; // 账户是否启用，实际应用中应根据业务逻辑判断
    }
}

import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.core.userdetails.UsernameNotFoundException;
import org.springframework.stereotype.Service; // 或 @Component

// 假设有一个UserRepository接口用于数据库操作
// public interface UserRepository extends JpaRepository<User, Long> {
//    User findByUsername(String username);
// }

@Service // 将此服务注册为Spring Bean
public class CustomUserDetailService implements UserDetailsService {
    private final UserRepository userRepository; // 注入你的用户数据仓库

    // 通过构造函数注入UserRepository
    public CustomUserDetailService(UserRepository userRepository) {
        this.userRepository = userRepository;
    }

    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        User user = userRepository.findByUsername(username);
        if (user == null) {
            throw new UsernameNotFoundException("用户未找到: " + username);
        }
        return new CustomUserDetails(user);
    }
}

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;

@Configuration
@EnableWebSecurity
@EnableMethodSecurity // 启用方法级别的安全注解
public class SecurityConfig { // 建议类名使用SecurityConfig或WebSecurityConfig
    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
                .csrf().disable() // 禁用CSRF保护（生产环境应谨慎考虑）
                .authorizeHttpRequests(auth ->
                        auth
                                .anyRequest().authenticated() // 所有请求都需要认证
                )
                .httpBasic(); // 启用HTTP Basic认证

        return http.build();
    }

    // 推荐：配置一个密码编码器
    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder(); // 使用BCrypt算法进行密码编码
    }
}