问题
I checked the most of solutions from stackoverflow and also few official articles like: spring.io i have finished small webapi based on SpringBoot and i want change security level from inMemoryAuthentication to jdbcAuthentication and i think my code is correct and i have no idea why still i have 401 response code in Postman.
Here is my code:
1.POM DEPENDENCIES
<dependencies>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-security</artifactId>
</dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-web</artifactId>
</dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-data-jpa</artifactId>
</dependency>
<dependency>
<groupId>com.h2database</groupId>
<artifactId>h2</artifactId>
<scope>runtime</scope>
</dependency>
<dependency>
<groupId>mysql</groupId>
<artifactId>mysql-connector-java</artifactId>
<scope>runtime</scope>
</dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-test</artifactId>
<scope>test</scope>
</dependency>
<dependency>
<groupId>org.springframework.security</groupId>
<artifactId>spring-security-test</artifactId>
<scope>test</scope>
</dependency>
</dependencies>
- DOMAIN CLASS API CLIENT
@Entity
@Table(name = "apiclient")
public class ApiClient {
@Id
@GeneratedValue(strategy = GenerationType.AUTO)
private Long id;
@NotNull
@Column(name = "username")
@Size(max = 50)
private String username;
@NotNull
@Column(name = "password")
@Size(max = 65)
private String password;
@NotNull
@Column(name = "role")
@Size(max = 15)
private String role;
public Long getId() {
return id;
}
public void setId(Long id) {
this.id = id;
}
public String getUsername() {
return username;
}
public void setUsername(String username) {
this.username = username;
}
public String getPassword() {
return password;
}
public void setPassword(String password) {
this.password = password;
}
public String getRole() {
return role;
}
public void setRole(String role) {
this.role = role;
}
@Override
public String toString() {
return "ApiClient{" +
"id=" + id +
", username='" + username + '\'' +
", password='" + password + '\'' +
", role='" + role + '\'' +
'}';
}
}
- REST CONTROLLER
@RestController
public class HelloController {
@RequestMapping(path = "/user")
public String showUserMsg() {
return "User has logged in!!!";
}
@RequestMapping(path = "/admin")
public String showAdminMsg() {
return "Admin has logged in!!!";
}
}
- SECURITY CLASS
@Configuration
@EnableWebSecurity
public class SpringSecurityConfig extends WebSecurityConfigurerAdapter {
@Autowired
private DataSource dataSource;
@Override
protected void configure(HttpSecurity http) throws Exception {
http.httpBasic();
http.authorizeRequests()
.antMatchers("/admin/**").hasRole("ADMIN")
.antMatchers("/user/**").hasRole("USER")
.antMatchers("/h2-console/**").permitAll()
.anyRequest().authenticated();
http.csrf().ignoringAntMatchers("/h2-console/**");
http.headers().frameOptions().disable();
}
@Autowired
public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
auth.jdbcAuthentication().dataSource(dataSource)
.usersByUsernameQuery("select username, password, true"
+ " from apiclient where username='?'")
.authoritiesByUsernameQuery("select username, role"
+ " from apiclient where username='?'");
}
@Bean
public PasswordEncoder passwordEncoder() {
return new BCryptPasswordEncoder();
}
}
- COMMAND LINE RUNNER OF AUTO USER REGISTRATION
public class SampleDataLoader implements CommandLineRunner {
@PersistenceContext
EntityManager entityManager;
@Autowired
private PasswordEncoder passwordEncoder;
@Override
@Transactional
public void run(String... args) throws Exception {
ApiClient user = new ApiClient();
user.setRole("USER");
user.setPassword(passwordEncoder.encode("TESTPAS123"));
user.setUsername("USER");
entityManager.persist(user);
entityManager.flush();
System.out.println(user);
ApiClient admin = new ApiClient();
admin.setRole("ADMIN");
admin.setPassword(passwordEncoder.encode("TESTPAS123"));
admin.setUsername("ADMIN");
entityManager.persist(admin);
entityManager.flush();
System.out.println(admin);
}
}
After start springboot application h2 database look like:
回答1:
Query with single quote username='?' causing problem.
Modify
@Autowired
public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception
{
auth.jdbcAuthentication().dataSource(dataSource)
.usersByUsernameQuery("select username, password, true"
+ " from apiclient where username='?'")
.authoritiesByUsernameQuery("select username, role"
+ " from apiclient where username='?'");
}
to
@Autowired
public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
auth.jdbcAuthentication()
.dataSource(dataSource)
.usersByUsernameQuery("select username, password, true"
+ " from apiclient where username=?")
.authoritiesByUsernameQuery("select username, role"
+ " from apiclient where username=?");
}
After looking at your code shared from github link,
In your project you have not enabled logs with level DEBUG.
After enabling DEBUG logs i noticed
DEBUG - Executing prepared SQL statement [select username, password, true from apiclient where username='?']
DEBUG - Fetching JDBC Connection from DataSource
...
DEBUG - Caching SQL error codes for DataSource [com.zaxxer.hikari.HikariDataSource@3bcd426c]: database product name is 'H2'
DEBUG - Unable to translate SQLException with Error code '90008', will now try the fallback translator
...
DEBUG - Access is denied (user is anonymous); redirecting to authentication entry point
org.springframework.security.access.AccessDeniedException: Access is denied
at org.springframework.security.access.vote.AffirmativeBased.decide(AffirmativeBased.java:84)
Your query was failing to get usersByUsername (because of single quote in query) and authoritiesByUsername query was not fired due to exception, resulting spring-security to treat user as ROLE_ANONYMOUS and hence 401(Unauthorized)
If you want to see logs in STS/Eclipse console.
1. create logback.xml file under src/main/resources
2. Copy below code
<?xml version="1.0" encoding="UTF-8"?>
<configuration>
<appender name="ALL_ROLLING_FILE"
class="ch.qos.logback.core.rolling.RollingFileAppender">
<rollingPolicy
class="ch.qos.logback.core.rolling.TimeBasedRollingPolicy">
<fileNamePattern>..\logs\SMTH_Project.%d{yyyy-MM-dd_HH}.%i.log.zip</fileNamePattern>
<timeBasedFileNamingAndTriggeringPolicy
class="ch.qos.logback.core.rolling.SizeAndTimeBasedFNATP">
<maxFileSize>100MB</maxFileSize>
</timeBasedFileNamingAndTriggeringPolicy>
<MaxHistory>30</MaxHistory>
</rollingPolicy>
<encoder>
<pattern>%d{yyyy MM dd HH:mm:ss:SSS} [%-40thread] %-5level{5} - %msg %n</pattern>
</encoder>
</appender>
<appender name="ASYNC"
class="ch.qos.logback.classic.AsyncAppender">
<appender-ref ref="ALL_ROLLING_FILE" />
<queueSize>1000000</queueSize>
<discardingThreshold>0</discardingThreshold>
</appender>
<appender name="STDOUT" class="ch.qos.logback.core.ConsoleAppender">
<encoder>
<pattern>%-5level{5} - %msg %n</pattern>
</encoder>
</appender>
<root level="DEBUG">
<appender-ref ref="STDOUT" />
</root>
</configuration>
来源：https://stackoverflow.com/questions/57892424/problem-with-user-validation-by-httpbasic-and-jdbcauthentication-in-websecurityc