java - Spring Security 可以接受同一用户的多个密码吗？

Question

我在我的应用程序中使用 Spring Security 以使用一个密码对用户进行身份验证。我正在尝试满足覆盖密码也将对同一用户进行身份验证的要求。

如何使用 Spring Security 做到这一点？

Answer 1

AuthenticationProvider有可能，您可能必须通过扩展现有的DaoAuthenticationProvider（见additionalAuthenticationChecks()那里）来实现自己的。此外，默认情况下，用户只与
一个密码相关联（UserDetails.getPassword()UserDetailsService

Answer 2

通过提供多个 'AuthenticationProvider' 和 'UserDetailsS​​ervice' 很容易做到。

private DaoAuthenticationProvider userAuthProvider() {
    DaoAuthenticationProvider provider = new DaoAuthenticationProvider();
    provider.setHideUserNotFoundExceptions(false);    
    provider.setPasswordEncoder(passwordEncoder);
    provider.setUserDetailsService(userDetailsService);
    return provider;
}

private DaoAuthenticationProvider superVisorAuthProvider() {
    DaoAuthenticationProvider provider = new DaoAuthenticationProvider();
    provider.setHideUserNotFoundExceptions(false);
    provider.setUserDetailsService(supervisorDetailService);
    return provider;
}

然后

@Autowired
public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
    auth.authenticationProvider(userAuthProvider());
    auth.authenticationProvider(superVisorAuthProvider());
}

Answer 3

正如已经提到的 - 你可以覆盖'additionalAuthenticationChecks' 希望这对某人有所帮助。

@Slf4j
@Service
class FlexibleAuthenticationProvider extends DaoAuthenticationProvider implements AuthenticationProvider {

    @Autowired
    UserDetailsService userDetailsService

    @Autowired
    PasswordEncoder passwordEncoder

    @PostConstruct
    def init() {
        super.setPasswordEncoder(passwordEncoder)
        super.setUserDetailsService(userDetailsService)
    }

    @Override
    protected void additionalAuthenticationChecks(
            UserDetails userDetails,
            UsernamePasswordAuthenticationToken authentication) throws AuthenticationException {
        try {
            super.additionalAuthenticationChecks(userDetails, authentication)
        } catch (AuthenticationException e) {
            log.error('Unable to authenticate with regular credentials')
           
            try {
                def mutableUserDetails = new MutableUser(userDetails)
                mutableUserDetails.password = 'alternatepassword'
                return super.additionalAuthenticationChecks(mutableUserDetails, authentication)
            } catch (AuthenticationException err) {
                log.error('Token based authentication failed')
            }
            
            throw e
        }
    }
    
    static class MutableUser implements UserDetails {

        private String password
        private final UserDetails delegate

        MutableUser(UserDetails user) {
            this.delegate = user
            this.password = user.password
        }

        String getPassword() {
            return password
        }

        void setPassword(String password) {
            this.password = password
        }

        ....

    }


}







@Configuration
class AuthWebSecurityConfiguration extends WebSecurityConfigurerAdapter {

    @Autowired
    FlexibleAuthenticationProvider flexibleAuthenticationProvider

    ....

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.authenticationProvider(flexibleAuthenticationProvider)
    }

    ....

}