Spring Security 6 集成外部数据库实现用户认证

// User.java
package com.example.model;

import java.util.List;

public class User {
    private String username;
    private String password; // 存储加密后的密码
    private List<String> roles;

    public User(String username, String password, List<String> roles) {
        this.username = username;
        this.password = password;
        this.roles = roles;
    }

    // Getters and Setters
    public String getUsername() { return username; }
    public void setUsername(String username) { this.username = username; }
    public String getPassword() { return password; }
    public void setPassword(String password) { this.password = password; }
    public List<String> getRoles() { return roles; }
    public void setRoles(List<String> roles) { this.roles = roles; }
}

// MyUserDetailsService.java
package com.example.security;

import com.example.model.User;
import com.example.repository.UserRepository;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.core.userdetails.UsernameNotFoundException;
import org.springframework.security.core.authority.SimpleGrantedAuthority;
import org.springframework.stereotype.Service;

import java.util.List;
import java.util.stream.Collectors;

@Service
public class MyUserDetailsService implements UserDetailsService {

    private final UserRepository userRepository;

    public MyUserDetailsService(UserRepository userRepository) {
        this.userRepository = userRepository;
    }

    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        // 从外部数据库获取用户数据
        User user = userRepository.findByUsername(username)
                .orElseThrow(() -> new UsernameNotFoundException("User not found with username: " + username));

        // 将自定义的用户对象转换为 Spring Security 要求的 UserDetails 对象
        List<SimpleGrantedAuthority> authorities = user.getRoles().stream()
                .map(role -> new SimpleGrantedAuthority("ROLE_" + role)) // Spring Security 角色前缀通常为 "ROLE_"
                .collect(Collectors.toList());

        return new org.springframework.security.core.userdetails.User(
                user.getUsername(),
                user.getPassword(),
                authorities
        );
    }
}

// UserRepository.java
package com.example.repository;

import com.example.model.User;
import java.util.Optional;
import org.springframework.stereotype.Repository;

// 这是一个示例接口，实际实现会与数据库交互
@Repository
public interface UserRepository {
    Optional<User> findByUsername(String username);
}

// InMemoryUserRepositoryImpl.java (用于演示，实际项目中应连接数据库)
package com.example.repository;

import com.example.model.User;
import org.springframework.stereotype.Component;

import java.util.Arrays;
import java.util.HashMap;
import java.util.Map;
import java.util.Optional;

@Component
public class InMemoryUserRepositoryImpl implements UserRepository {

    private final Map<String, User> users = new HashMap<>();

    public InMemoryUserRepositoryImpl() {
        // 模拟数据库中的用户数据，密码应为加密后的形式
        // 这里使用 {noop} 前缀表示不进行密码编码，仅用于演示。
        // 生产环境中请务必使用强密码编码器，例如 BCryptPasswordEncoder。
        users.put("schueler", new User("schueler", "{noop}password", Arrays.asList("SCHUELER")));
        users.put("lehrer", new User("lehrer", "{noop}password", Arrays.asList("LEHRER")));
        users.put("verwaltung", new User("verwaltung", "{noop}password", Arrays.asList("VERWALTUNG")));
    }

    @Override
    public Optional<User> findByUsername(String username) {
        return Optional.ofNullable(users.get(username));
    }
}

// SecurityConfiguration.java
package com.example.security;

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.web.SecurityFilterChain;

@Configuration
@EnableWebSecurity
public class SecurityConfiguration {

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
                .authorizeHttpRequests((requests) -> requests
                        .requestMatchers("/vertretungsplan").hasAnyRole("SCHUELER", "LEHRER", "VERWALTUNG")
                        .requestMatchers("/account").hasAnyRole("LEHRER", "VERWALTUNG")
                        .requestMatchers("/administration").hasRole("VERWALTUNG")
                        .requestMatchers("/", "/login", "/error").permitAll() // 允许访问根路径、登录页和错误页
                        .anyRequest().authenticated() // 其他所有请求都需要认证
                )
                .formLogin(form -> form
                        .loginPage("/login") // 指定自定义登录页面的URL
                        .defaultSuccessUrl("/home", true) // 登录成功后的跳转页面
                        .permitAll() // 允许所有用户访问登录页面
                )
                .logout(logout -> logout
                        .logoutSuccessUrl("/login?logout") // 登出成功后的跳转页面
                        .permitAll()
                );
        return http.build();
    }

    /**
     * 配置密码编码器。
     * Spring Security 会自动发现这个 PasswordEncoder Bean 并用于密码验证。
     * 强烈推荐使用 BCryptPasswordEncoder 或其他安全的密码编码器。
     */
    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }
}