我正在使用 Spring 3.0 和 Spring Security 3。我能够使用 Spring Security 对数据库进行用户身份验证。使用:

SecurityContextHolder.getContext().getAuthentication().getPrincipal()

我能够检索当前登录用户的用户名。我希望添加其他详细信息，例如用户 ID 和模块对存储在 Spring Security 上下文中的主体对象的访问，以便我以后可以检索它。如何向主体对象添加其他详细信息，然后如何在 jsp 或 java 类中检索它。如果可能，请提供适当的代码段。

编辑:我正在使用 JDBC 访问我的数据库。

提前致谢。

最佳答案

这是你需要的:

1. 扩展 spring User (org.springframework.security.core.userdetails.User) 类以及您需要的任何属性。
2. 扩展spring UserDetailsS​​ervice (org.springframework.security.core.userdetails.UserDetailsS​​ervice)，填充上面的对象。覆盖 loadUserByUsername 并返回您的扩展用户类
3. 在 AuthenticationManagerBuilder
中设置您的自定义 UserDetailsS​​ervice

例如

public class CurrentUser extends User{

   //This constructor is a must
    public CurrentUser(String username, String password, boolean enabled, boolean accountNonExpired,
            boolean credentialsNonExpired, boolean accountNonLocked,
            Collection<? extends GrantedAuthority> authorities) {
        super(username, password, enabled, accountNonExpired, credentialsNonExpired, accountNonLocked, authorities);
    }
    //Setter and getters are required
    private String firstName;
    private String lastName;

}

自定义用户详细信息可以是:

@Service("userDetailsService")
public class CustomUserDetailsService implements UserDetailsService {

@Override
public UserDetails loadUserByUsername(final String username) throws UsernameNotFoundException {

    //Try to find user and its roles, for example here we try to get it from database via a DAO object
   //Do not confuse this foo.bar.User with CurrentUser or spring User, this is a temporary object which holds user info stored in database
    foo.bar.User user = userDao.findByUserName(username);

    //Build user Authority. some how a convert from your custom roles which are in database to spring GrantedAuthority
    List<GrantedAuthority> authorities = buildUserAuthority(user.getUserRole());

    //The magic is happen in this private method !
    return buildUserForAuthentication(user, authorities);

}


//Fill your extended User object (CurrentUser) here and return it
private User buildUserForAuthentication(foo.bar.User user, 
List<GrantedAuthority> authorities) {
    String username = user.getUsername();
    String password = user.getPassword();
    boolean enabled = true;
    boolean accountNonExpired = true;
    boolean credentialsNonExpired = true;
    boolean accountNonLocked = true;

    return new CurrentUser(username, password, enabled, accountNonExpired, credentialsNonExpired,
            accountNonLocked, authorities);
   //If your database has more information of user for example firstname,... You can fill it here 
  //CurrentUser currentUser = new CurrentUser(....)
  //currentUser.setFirstName( user.getfirstName() );
  //.....
  //return currentUser ;
}

private List<GrantedAuthority> buildUserAuthority(Set<UserRole> userRoles) {

    Set<GrantedAuthority> setAuths = new HashSet<GrantedAuthority>();

    // Build user's authorities
    for (UserRole userRole : userRoles) {
        setAuths.add(new SimpleGrantedAuthority(userRole.getRole()));
    }

    return new ArrayList<GrantedAuthority>(setAuths);
}

}

配置spring安全上下文

@Configuration
@EnableWebSecurity
@PropertySource("classpath://configs.properties")
public class SecurityContextConfig extends WebSecurityConfigurerAdapter {

    @Autowired
    @Qualifier("userDetailsService")
    private UserDetailsService userDetailsService;

    @Autowired
    public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
        auth.userDetailsService(userDetailsService);
    }

一切都搞定了!

你可以调用(CurrentUser)getAuthentication().getPrincipal()来获取你新的CurrentUser或者设置一些属性。

关于java - 向存储在 spring 安全上下文中的主体对象添加其他详细信息，我们在Stack Overflow上找到一个类似的问题： https://stackoverflow.com/questions/20349594/