java - Customize Spring Security Authentication -
I am trying to integrate spring protection for my entry form, and I have trouble understanding how spring Security validates a database:
So I have configured spring protection like this:
& lt; Http auto-config = "true" use-expressions = "true" & gt; & Lt; Intercept-url pattern = "/ login" access = "permitAll" /> & Lt; Intercept-url pattern = "/ logout" access = "permitAll" /> & Lt; Intercept-url pattern = "/ denied" access = "harol ('' ROLE_USER '')" /> & Lt; Intercept-url pattern = "/" access = "hirol ('ROLE_USER')" /> & Lt; Intercept-url pattern = "/ user" access = "harol ('' ROLE_USER '')" /> & Lt; Intercept-url pattern = "/ admin" access = "harol ('ROLE_ADMIN')" /> & Lt; Form-login login-page = "/ login" authentication-failure-url = "/ login / failure" default-target-url = "/" /> & Lt; Access denied-handler error-page = "/ denied" /> & Lt; Logout invalid-session = "true" logout-success-url = "/ logout / success" logout-url = "/ logout" /> & Lt; / Http & gt; & Lt; Authentication Manager & gt; & Lt; Authentication Provider User-Service-Rif = "Login Manager" & gt; & Lt; Password-encoder hash = "bipet" /> & Lt; / Authentication Provider & gt; & Lt; / Authentication-manager & gt;
And this is my form;
& lt; C: url var = "loginUrl" value = "/ login" / & gt; & Lt; Form method = "post" action = "$ {loginUrl}" & gt; & Lt; Input type = "hidden" name = "$ {_ csrf.parameterName}" value = "$ {_ csrf.token}" /> & Lt; Div class = "form_field" & gt; & Lt; Label = "login_name" & gt; Username / email & lt; / Label & gt; & Lt; Br / & gt; & Lt; Input class = "field" id = "login_name" type = "text" name = "username" autocomplete = "off" /> & Lt; / Div & gt; & Lt; Div class = "form_field" & gt; & Lt; Label = "password" & gt; Password & lt; / Label & gt; & Lt; Br / & gt; & Lt; Input class = "field" id = "password" type = "password" name = "password" /> & Lt; / Div & gt; & Lt; / Form & gt;
And this is my controller:
@RequestMapping ("/ login") public string login (model model, @RequestParam (required = false) string Message) {model.addAttribute ("message", message); LOGGER.info ("Login"); Return "/ login"; } @RequestMapping (value = "/ denied") denied public strings () {LOGGER.info ("DENIE"); Return "/ login"; } @RequestMapping (value = "/ login / failure") public string login files () {string message = "login failure!"; Return "Redirect: / login? Message =" + Message; } @RequestMapping (value = "/ logout / success") public string logoutout () {string message = "logout success!"; Return "Redirect: / login? Message =" + Message; }
- I do not understand that we need to call Russheperm to get a string of usernames and passwords, or the spring will use it for use because when I told Spring that my login page is in the configuration?
This is my service applicable UserDetailsService:
@override @ Transactional (read only = true) Public usability noticeUserByUsername (name of string) UsernameNotFoundException { LOGGER.info ("Confirm Client's Account") throws; Login login = loginDao.getLoginByName (name.toLowerCase ()); Return a new user (login.getName (), login.getPassword (), true, true, true, true, 'ROLE_USER'))); }
- Since my service implements the UserDetailsService service, I have to override the method loadUserByUserName (name). I wonder how can I verify the account with a password, or spring also takes care of it for me (how will it work internally?)?
Thank you for your response. Login Page and Login Processing URL
>. Login page is your login form. The login processing URL receives input from the user and authenticates the user. Spring security will do it for you later, the default URL should be to post your form / j_spring_security_check
and your field should be named j_username
and j_password
Your User Deviceswire should not be certified (i.e. check that the password is correct), Spring Security will do it for you.
Comments
Post a Comment