Java Spring安全实现多个SQL表身份验证

在现实世界中，不同的业务用户很可能需要从不同的来源进行身份验证.让我们来看看解决方案:

您可以 for each 入口注册两个不同的SecurityFilterChain.我建议你了解Spring Security Architecture.FilterChainProxy将根据securityMatcher决定使用哪个SecurityFilterChain.

同样，您可以 for each 收件箱创建两个不同的UserDetailsService.

SecurityConfiguration

@Configuration
public class SecurityConfiguration {

private final PassengerUserDetailsService passengerUserDetailsService;
private final EmployeeUserDetailsService employeeUserDetailsService;
private final PasswordEncoder passwordEncoder;

public SecurityConfiguration(PassengerUserDetailsService passengerUserDetailsService,
                             EmployeeUserDetailsService employeeUserDetailsService,
                             PasswordEncoder passwordEncoder) {
    this.passengerUserDetailsService = passengerUserDetailsService;
    this.employeeUserDetailsService = employeeUserDetailsService;
    this.passwordEncoder = passwordEncoder;
}


@Bean
@Order(0)
public SecurityFilterChain filterChain0(HttpSecurity httpSecurity) throws Exception {
    httpSecurity
            .securityMatcher("/passenger/**") // this will decide which securityFilterChain will be used
            .authorizeHttpRequests(
                    auth -> auth.
                            requestMatchers(HttpMethod.GET, "/passenger/**").hasRole("PASSENGER")
            )
            .httpBasic(Customizer.withDefaults())
            .csrf(CsrfConfigurer::disable)
            .userDetailsService(passengerUserDetailsService);
    return httpSecurity.build();
}

@Bean
@Order(1)
public SecurityFilterChain filterChain1(HttpSecurity httpSecurity) throws Exception {
    httpSecurity
            .securityMatcher("/employee/**")
            .authorizeHttpRequests(
                    auth -> auth.
                            requestMatchers(HttpMethod.GET, "/employee/**").hasRole("EMPLOYEE")
            )
            .httpBasic(Customizer.withDefaults())
            .csrf(CsrfConfigurer::disable)
            .userDetailsService(employeeUserDetailsService);
    return httpSecurity.build();
 }
}

PassengerUserDetailsService

@Service
public class PassengerUserDetailsService implements UserDetailsService  {

private final PasswordEncoder passwordEncoder;

PassengerUserDetailsService(PasswordEncoder passwordEncoder) {
    this.passwordEncoder = passwordEncoder;
}

@Override
public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
    User.UserBuilder builder = User.builder();
    builder.username(username);
    builder.password(passwordEncoder.encode(username));

    switch (username) {
        case "passenger":
            builder.roles("PASSENGER");
            break;
        default:
            throw new UsernameNotFoundException("User not found.");
    }
    return builder.build();
 }
}

EmployeeUserDetailsService

@Service
public class EmployeeUserDetailsService implements UserDetailsService {

private final PasswordEncoder passwordEncoder;

EmployeeUserDetailsService(PasswordEncoder passwordEncoder) {
    this.passwordEncoder = passwordEncoder;
}

@Override
public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
    User.UserBuilder builder = User.builder();
    builder.username(username);
    builder.password(passwordEncoder.encode(username));

    switch (username) {
        case "employee":
            builder.roles("EMPLOYEE");
            break;
        default:
            throw new UsernameNotFoundException("User not found.");
    }
    return builder.build();
 }
}

我嘲笑了每UserDetailsService个用户，您可以从各自的收件箱中获取这些用户.您可以参考org.springframework.security.authentication.dao.DaoAuthenticationProvider班以供参考.

您不需要遵循Spring的默认ddl来定义您的模式.您始终可以使用现有的模式并使用UserDetailsService使用自定义查询.提供它们可以快速启动您的项目，无需手动配置.