带有弹簧安全性的配置文件不起作用

Question

我正在使用spring安全性在其配置文件的功能中对用户进行验证，但我的应用程序做得不好，当我看到文件日志时，它会向我显示：

调试DaoAuthenticationProvider:308-用户帐户已锁定

在我的表单登录中，我把数据放得很好，但我从不传递到其他页面，我总是在同一页面（表单页面），我介绍好的或坏的数据

我的代码是：

文件配置spring-security.xml

<beans:beans xmlns:security="http://www.springframework.org/schema/security"
    xmlns:beans="http://www.springframework.org/schema/beans" 
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.1.xsd
                        http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.1.xsd">
    <security:http auto-config="true" access-decision-manager-ref="accessDecisionManager">
        <security:intercept-url pattern="/" access="IS_AUTHENTICATED_ANONYMOUSLY" />
        <security:intercept-url pattern="/init" access="PROFILE_ADMINISTRATOR" />
        <security:form-login 
            login-page="/" 
            default-target-url="/init" 
            always-use-default-target='true'
            authentication-failure-url="/"/>
        <security:http-basic />
    </security:http>  
    <security:authentication-manager alias="autenticationManagerUserService">
        <security:authentication-provider user-service-ref="userService">
            <security:password-encoder hash="md5"/>
        </security:authentication-provider>
     </security:authentication-manager> 
     <beans:bean id="accessDecisionManager" class="org.springframework.security.access.vote.AffirmativeBased">
        <beans:property name="decisionVoters">
            <beans:list>
                <beans:ref bean="decisorDeRoles"/>
                <beans:ref bean="decisorDeAutenticacion"/>
            </beans:list>
        </beans:property>
    </beans:bean>
    <beans:bean id="decisorDeRoles" class="org.springframework.security.access.vote.RoleVoter">
        <beans:property name="rolePrefix" value="PROFILE_"/>
    </beans:bean>
    <beans:bean id="decisorDeAutenticacion" class="org.springframework.security.access.vote.AuthenticatedVoter"/>
    <beans:bean id="loggerListener" class="org.springframework.security.authentication.event.LoggerListener"/>
</beans:beans>

UserDatailsService 的类别

@Service("userService")
public class SecurityAuthenticationProvider implements UserDetailsService
{
UserDao userDao = new UserDao ();
    @Override
    public UserDetails loadUserByUsername (String username) throws  UsernameNotFoundException, DataAccessException
    {
        User user = null;
        List<User> users = userDao.getUser (username);
        if (users.size () == 0)
        {
            throw new UsernameNotFoundException ("");
        }
        else
        {
            user = users.get (0);
            user.setAuthorities (userDao.getProfileUser (username));
            return user;
        }
    }
}

类UserDatails

public class User implements UserDetails
{    
    private List<GrantedAuthority> profiles;
    private String username;
    private String password;
    private boolean accountNonExpired;
    private boolean accountNonLocked;
    private boolean credentialsNonExpired;
    private boolean enabled;
    @Override
    public Collection<? extends GrantedAuthority> getAuthorities ()
    {
        return profiles;
    }
    @SuppressWarnings("unchecked")
    public void setAuthorities (List<? extends GrantedAuthority> profiles)
    {
        this.profiles = (List<GrantedAuthority>) profiles;
    }
    @Override
    public String getPassword ()
    {
        return password;
    }
    @Override
    public String getUsername ()
    {
        return username;
    }
    @Override
    public boolean isAccountNonExpired ()
    {
        return accountNonExpired;
    }
    @Override
    public boolean isAccountNonLocked ()
    {
        return accountNonLocked;
    }
    @Override
    public boolean isCredentialsNonExpired ()
    {
        return credentialsNonExpired;
    }
    @Override
    public boolean isEnabled ()
    {
        return enabled;
    }
    public void setUsername (String username)
    {
        this.username = username;
    }
    public void setPassword (String password)
    {
        this.password = password;
    }
    public void setAccountNonExpired (boolean accountNonExpired)
    {
        this.accountNonExpired = accountNonExpired;
    }
    public void setAccountNonLocked (boolean accountNonLocked)
    {
        this.accountNonLocked = accountNonLocked;
    }
    public void setCredentialsNonExpired (boolean credentialsNonExpired)
    {
        this.credentialsNonExpired = credentialsNonExpired;
    }
    public void setEnabled (boolean enabled)
    {
        this.enabled = enabled;
    }
}

类授权

public class Profile implements GrantedAuthority
{
    private String profile;
    @Override
    public String getAuthority ()
    {
        return profile;
    }
    public String getProfile ()
    {
        return profile;
    }
    public void setProfile (String profile)
    {
        this.profile = profile;
    }
}

我创建了一个类来模拟对数据库的访问（以获取数据）

public class UserDao
{
    public List<? extends GrantedAuthority> getProfileUser (String name)
    {
        List<GrantedAuthority> listGrantedAuthorities = new ArrayList<GrantedAuthority> ();
        Profile profile = new Profile ();
        profile.setProfile ("PROFILE_ADMINISTRATOR");
        listGrantedAuthorities.add (profile);
        return listGrantedAuthorities;
    }
    public List<User> getUser (String name)
    {
        List<User> listUser = new ArrayList<User> ();
        User user = new User ();
        user.setUsername ("Admin");
        user.setPassword ("1234");
        // user.setAccountNonExpired (true);
        // user.setAccountNonLocked (true);
        // user.setCredentialsNonExpired (true);
        // user.setEnabled (true);
        listUser.add (user);
        return listUser;
    }
}

谢谢。

Answer 1

我在使用rest oauth2 spring安全性时遇到了同样的问题。

解决方案

您需要对实现UserDetails（org.springframework.security.core.UserDetails）的类进行一些更改，在您的情况下，它是用户类。

对于以下重写方法isAccountNonLocked（）、isAccountNonExpired（）、isEnabled（）和isCredentialsNonExpired（）将retrun类型更改为true（默认情况下为false）。

请注意，根据您的需求，这些所有方法都应该有返回true或false的逻辑，但为了使代码正常工作，我建议您对所有提到的方法都返回true。