Spring 从 application.properties 启动用户内存中的安全性

Question

我有一个基本的Spring Boot应用程序，它使用inMemoryAuthentication和代码中声明的授权用户列表：

@Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
auth.inMemoryAuthentication().withUser("guest").password("{noop}guest1234").roles("USER");
auth.inMemoryAuthentication().withUser("admin").password("{noop}password").roles("ADMIN");
}

我想将用户/角色列表移动到 application.properties 文件中，例如对于管理员用户：

spring.security.user.name=admin
spring.security.user.password=password
spring.security.user.roles=ADMIN

但是，这似乎不起作用，因为我收到 403 错误。我错过了什么？ 谢谢

Answer 1

Spring security只有一个默认用户， 您可以使用自定义属性提供其他人

...
@Autowired
private ApplicationProperties properties;
...
@Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
InMemoryUserDetailsManagerConfigurer<AuthenticationManagerBuilder> builder = auth.inMemoryAuthentication();
properties.getUsers().forEach(user -> {
builder.withUser(user.getUsername()).password(user.getPassword()).roles((String[]) user.getRoles().toArray());
});
}

使用您的应用程序属性

@ConfigurationProperties(prefix = "application", ignoreUnknownFields = false)
public class ApplicationProperties {
private final List<Users> users = new ArrayList<>();
public static class Users {
private String username;
private String password;
private List<String> roles;
public String getUsername() {
return username;
}
public void setRoles(List<String> roles) {
this.roles = roles;
}
public String getPassword() {
return password;
}
public void setUsername(String username) {
this.username = username;
}
public void setPassword(String password) {
this.password = password;
}
public List<String> getRoles() {
return roles;
}
}
public List<Users> getUsers() {
return users;
}
}

和您的 .yaml 文件(yaml 不如 .properties 文件详细(

spring:
application:
name: MyApp
...
application:
users:
-
username: guest
password: guest1234
roles: USER
-
username: admin
password: password
roles: USER,ADMIN

我希望这能帮助你

Answer 2

对于新的 Spring Boot 3.1.x(Spring Security 6.1.x(，它看起来像：

@Bean
public UserDetailsManager userDetailsService() {
User.UserBuilder builder = User.builder();
List<UserDetails> users = appProps.getRestClients().stream()
.map(client -> builder.username(client.getName())
.password(client.getPassword())
.roles(client.getRole().name()).build())
.toList();
return new InMemoryUserDetailsManager(users);
}

密码在我用pxf保存application.yaml，可以用{bcrypt}

...
password: "{noop}admin"
...