java 在 Spring Security 中添加新用户
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/2224873/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
Adding new users in Spring Security
提问by james
I have basic spring security set up in my Spring / Java EE web app. I can restrict access to certain pages and force login (with roles etc.). There needs to be a form where new users can register and specify a login name and password.
我在 Spring/Java EE Web 应用程序中设置了基本的 Spring 安全性。我可以限制对某些页面的访问并强制登录（使用角色等）。需要有一个新用户可以注册并指定登录名和密码的表单。
I am wondering if, to create new users, I simply query and update the appropriate spring security tables (e.g. using hibernate) as I would for any query, or is there built in functionality to create new users? If I am simply to use a standard DAO to update the users, how should I handle hashing of passwords?
我想知道，为了创建新用户，我是否像任何查询一样简单地查询和更新适当的 spring 安全表（例如使用休眠），或者是否有内置功能来创建新用户？如果我只是使用标准 DAO 来更新用户，我应该如何处理密码散列？
Thanks!
谢谢！
回答by Droo
You have to combine all of the answers on this page.
您必须结合此页面上的所有答案。
- Teja is correct, there is not facilitated way to add a user on the fly.
- Axtavt is also correct. You need some sort of data access/service layer to update your users table. In other words, you need to create the view like any other page with some kind of super user access.
- Michal and ax give good advice that you probably need to encode your password before saving it. The digest should match whatever you're using when you retrieve credentials.
- Teja 是正确的，没有方便的方法来即时添加用户。
- Axtavt 也是正确的。您需要某种数据访问/服务层来更新您的用户表。换句话说，您需要像具有某种超级用户访问权限的任何其他页面一样创建视图。
- Michal 和 ax 给出了很好的建议，您可能需要在保存密码之前对其进行编码。摘要应与检索凭据时使用的任何内容相匹配。
Here's an example config using JDBC:
这是使用 JDBC 的示例配置：
<?xml version="1.0" encoding="UTF-8"?>
<beans:beans xmlns="http://www.springframework.org/schema/security"
xmlns:beans="http://www.springframework.org/schema/beans"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://www.springframework.org/schema/beans
http://www.springframework.org/schema/beans/spring-beans-2.0.xsd
http://www.springframework.org/schema/security
http://www.springframework.org/schema/security/spring-security-2.0.1.xsd">
<global-method-security secured-annotations="enabled"/>
<http auto-config="true" access-denied-page="/accessDenied.jsp">
<!-- login page has anonymous access -->
<intercept-url pattern="/login.jsp*" filters="none"/>
<!-- all pages are authenticated -->
<intercept-url pattern="/**.action" access="ROLE_USER, ROLE_ADMIN" />
<!-- all admin contextual pages are authenticated by admin role -->
<intercept-url pattern="/admin/**" access="ROLE_ADMIN" />
<form-login authentication-failure-url="/login.jsp?login_error=1" default-target-url="/index.action" login-page="/login.jsp"/>
<logout logout-success-url="/index.action"/>
</http>
<authentication-provider>
<password-encoder hash="md5" />
<jdbc-user-service data-source-ref="dataSource"
authorities-by-username-query="SELECT username, role AS authority FROM sweet_users WHERE username = ?"
users-by-username-query="SELECT username, password, 1 AS enabled FROM sweet_users WHERE username = ?" />
</authentication-provider>
</beans:beans>
This is using a custom query to obtain users. Spring Security expects a users table with username, password, and authority column names respectively, so do what you need to do to return those. You need to provide the data source.
这是使用自定义查询来获取用户。Spring Security 需要一个分别包含用户名、密码和权限列名称的用户表，因此请执行您需要执行的操作以返回这些名称。您需要提供数据源。
If you created a page for adding users under the admin/ context, it would be authenticated according to this config.
如果您在 admin/ 上下文下创建了一个用于添加用户的页面，它将根据此配置进行身份验证。
Add a bean for your UserDao and/or UserService and/or AuthenticationService and pass it to your Users controller...
为您的 UserDao 和/或 UserService 和/或 AuthenticationService 添加一个 bean 并将其传递给您的用户控制器...
回答by axtavt
Spring Security has JdbcUserDetailsManager. It's a subclass of the default JDBC-based UserDetailsServicewith additional methods for creating users and so on. You can use it as a DAO instead of your own.
Spring Security 有JdbcUserDetailsManager. 它是基于 JDBC 的默认子类，UserDetailsService具有用于创建用户等的附加方法。您可以将其用作 DAO 而不是您自己的。
However password hashing should be handled explicitly. For example, if you use SHA hash, you can use ShaPasswordEncoder.encodePassword().
但是，应明确处理密码散列。例如，如果您使用 SHA 哈希，则可以使用ShaPasswordEncoder.encodePassword().
回答by Teja Kantamneni
There is no such built in functionality for creating users in spring security. It is implemented only to secure resources based on the rules for users who are trying to login and access resources.
在 Spring Security 中没有用于创建用户的内置功能。它仅用于根据尝试登录和访问资源的用户的规则来保护资源。
回答by Micha? Mech
To use hash algorithms You can add <password-encoder>to <authentication-provider>.
使用哈希算法您可以将<password-encoder>添加到<authentication-provider>。
