一、

1.定义接口

Suppose that you need to authenticate against users in a non-relational database such
as Mongo or Neo4j. In that case, you’ll need to implement a custom implementation
of the UserDetailsService interface.

 public interface UserDetailsService {
UserDetails loadUserByUsername(String username) throws UsernameNotFoundException;
}

2.实现接口

All you need to do is implement the loadUserByUsername() method to find a user
given the user’s username. loadUserByUsername() then returns a UserDetails object
representing the given user. The following listing shows an implementation of
UserDetailsService that looks up a user from a given implementation of Spitter-
Repository

 package spittr.security;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.authority.
SimpleGrantedAuthority;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.
UserDetailsService;
import org.springframework.security.core.userdetails.
UsernameNotFoundException;
import spittr.Spitter;
import spittr.data.SpitterRepository; public class SpitterUserService implements UserDetailsService { private final SpitterRepository spitterRepository; public SpitterUserService(SpitterRepository spitterRepository) {
this.spitterRepository = spitterRepository;
} @Override
public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
Spitter spitter = spitterRepository.findByUsername(username);
if (spitter != null) {
List < GrantedAuthority > authorities = new ArrayList < GrantedAuthority > ();
authorities.add(new SimpleGrantedAuthority("ROLE_SPITTER"));
return new User(
spitter.getUsername(),
spitter.getPassword(),
authorities);
}
throw new UsernameNotFoundException("User '" + username + "' not found.");
}
}

What’s interesting about SpitterUserService is that it has no idea how the user data
is persisted. The SpitterRepository it’s given could look up the Spitter from a rela-
tional database, from a document database, from a graph database, or it could just
make it up. SpitterUserService doesn’t know or care what underlying data storage is
used. It just fetches the Spitter object and uses it to create a User object. ( User is a
concrete implementation of UserDetails .)

3.配置service

To use SpitterUserService to authenticate users, you can configure it in your
security configuration with the userDetailsService() method:

@Autowired
SpitterRepository spitterRepository;
@Override
protected void configure(AuthenticationManagerBuilder auth)
throws Exception {
auth
.userDetailsService(new SpitterUserService(spitterRepository));
}

The userDetailsService() method (like jdbcAuthentication() , ldapAuthentication ,
and inMemoryAuthentication() ) configures a configuration store. But instead of using
one of Spring’s provided user stores, it takes any implementation of UserDetailsService .
Another option worth considering is that you could change Spitter so that it
implements UserDetailsService . By doing that, you could return the Spitter
directly from the loadUserByUsername() method without copying its values into a
User object.

SPRING IN ACTION 第4版笔记-第九章Securing web applications-008-使用非关系型数据库时如何验证用户(自定义UserService)的更多相关文章

  1. SPRING IN ACTION 第4版笔记-第九章Securing web applications-001-SpringSecurity简介(DelegatingFilterProxy、AbstractSecurityWebApplicationInitializer、WebSecurityConfigurerAdapter、@EnableWebSecurity、@EnableWebMvcS)

    一.SpringSecurity的模块 At the least, you’ll want to include the Core and Configuration modules in your ...

  2. SPRING IN ACTION 第4版笔记-第九章Securing web applications-011-把敏感信息请求转为https(requiresChannel())

    1.把包含敏感信息的请求转为https请求,则较为安全,但如何只把有需要安全的请求转为https,而不是不加分辩就把所有请求都转为https呢?可以用requiresChannel() @Overri ...

  3. SPRING IN ACTION 第4版笔记-第九章Securing web applications-010-拦截请求

    一. What if you wanted to restrict access to certain roles only on Tuesday? Using the access() method ...

  4. SPRING IN ACTION 第4版笔记-第九章Securing web applications-007-设置LDAP server比较密码(contextSource、root()、ldif()、)

    一.LDAP server在哪 By default, Spring Security’s LDAP authentication assumes that the LDAP server is li ...

  5. SPRING IN ACTION 第4版笔记-第九章Securing web applications-004-对密码加密passwordEncoder

    一. 1.Focusing on the authentication query, you can see that user passwords are expected to be stored ...

  6. SPRING IN ACTION 第4版笔记-第九章Securing web applications-003-把用户数据存在数据库

    一. 1.It’s quite common for user data to be stored in a relational database, accessed via JDBC . To c ...

  7. SPRING IN ACTION 第4版笔记-第九章Securing web applications-002-把用户数据存在memory里(AuthenticationManagerBuilder、 UserDetailsManagerConfigurer.UserDetailsBuilder)

    Spring Security is extremely flexible and is capable of authenticating users against virtually any d ...

  8. SPRING IN ACTION 第4版笔记-第九章Securing web applications-009-拦截请求()

    一. 对特定的请求拦截 For example, consider the requests served by the Spittr application. Certainly, thehome ...

  9. SPRING IN ACTION 第4版笔记-第九章Securing web applications-006-用LDAP比较密码(passwordCompare()、passwordAttribute("passcode")、passwordEncoder(new Md5PasswordEncoder()))

    一. The default strategy for authenticating against LDAP is to perform a bind operation,authenticatin ...

随机推荐

  1. 1.6建造者模式(生成器模式) Builder

    1.概念:将一个复杂对象的构建和他的表示分离,使得同样的构件可以创建不同的表示. 2.实例:肯德基和中餐,肯德基抽象了整个做菜的复杂过程(相同的构建),然后在不同的店铺进行实现(不同的表示).中餐往往 ...

  2. [easyui] datebox源码阅读. 批注

    jquery.datebox.js 文件. (function($){ /** * create date box */ function createBox(target){ var state = ...

  3. Contest1065 - 第四届“图灵杯”NEUQ-ACM程序设计竞赛(个人赛)A蔡老板的会议

    题目描述 图灵杯个人赛就要开始了,蔡老板召集俱乐部各部门的部长开会.综合楼有N (1<=N<=1000)间办公室,编号1~N每个办公室有一个部长在工(mo)作(yu),其中X号是蔡老板的办 ...

  4. struts2使用struts2-bootstrap-plugin插件

    1.下载插件 http://code.google.com/p/struts2-bootstrap/ 2.添加maven依赖 <dependency> <groupId>com ...

  5. 在ThinkPHP3.x框架中实现将原创文章第一时间推送到百度收录

    前两天自己写的一篇文章“针对BootStrap中tabs控件的美化和完善”被别的网站给转载了,这也许是值得高兴的一件事情,但是有些网站并没有注明来源和作者.而去百度搜索这篇文章,排名第一的居然是那些转 ...

  6. linux find 反转 查找没有被找到的结果

    在linux下,有时候需要找一些文件,还有时候这些文件格式不够统一和规范,但是需要排除的那些文件却格式统一,就可以使用find命令的反转功能 一般用find查找文件的命令是: find . -name ...

  7. Media Queries——媒体类型

    媒体类型(Media Type)在CSS2中是一个常见的属性,也是一个非常有用的属性,可以通过媒体类型对不同的设备指定不同的样式. 在CSS2中常碰到的就是all(全部).screen(屏幕).pri ...

  8. 【转】分享10VPN

    以下介绍的vpn,都是有免费流量赠送的免费vpn,完全不免费的不在之列. 免费vpn因为用的人比较多,所以高峰时段可能会有点慢,但是人少时,还是比较顺畅的.对于偶尔浏览外网,看看新闻的同学来说,免费v ...

  9. Delphi Idhttp Post提交 Aspx/Asp.net 时 500错误的解决办法。

    一直使用Delphi写程序,因为习惯了,用起来方便. 但是有一个问题困扰了我半年了.就是使用Idhttp Post提交时候总会有莫名其妙的错误,大部分网站没问题,但是一遇到Asp.net就报错500. ...

  10. try、catch、finally的使用分析---与 return 相关

    看了一篇文章,讲解的是关于java中关于try.catch.finally中一些问题 下面看一个例子(例1),来讲解java里面中try.catch.finally的处理流程   1 2 3 4 5 ...