java Spring Security 对用户进行身份验证时如何在会话中管理自定义用户对象？
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/1866225/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
How to manage a custom user object in session when Spring Security authenticates user?
提问by Nachiket
When Spring Securityauthenticates user, it creates a UserDetail object and it is available for finding current UserId in web-app. But let's say I want to keep a custom user object with preferences and other details along with UserDetails or Replacing UserDetails.
当Spring Security 对用户进行身份验证时，它会创建一个 UserDetail 对象，可用于在 web-app 中查找当前 UserId。但是假设我想保留一个带有首选项和其他详细信息以及 UserDetails 或 Replaceing UserDetails 的自定义用户对象。
So, how to add Custom User object to session when Spring Security authenticates successfully? And how to remove custom user object from session when Spring Security logs out logged-in user.
那么，当 Spring Security 认证成功时，如何将 Custom User 对象添加到 session 中呢？以及如何在 Spring Security 注销登录用户时从会话中删除自定义用户对象。
Or is there any appropriate way to do this?
或者有什么合适的方法可以做到这一点？
采纳答案by Gennadiy
The best way to do this IMO is to have one of your services (probably UserService) implement UserDetailsService and specify in the spring security XML that you wish to use your own user details service.
执行此 IMO 的最佳方法是让您的服务之一（可能是 UserService）实现 UserDetailsService 并在 spring security XML 中指定您希望使用自己的用户详细信息服务。
What the UserDetailsService will need to do is implement a loadByUsername(String username) method. This method will need to return a class that implements UserDetails. This can be your own custom object storing whatever you like. The advantage of this is that you can access the object's properties from a JSP via spring security taglib and it is also always available from the SecurityContextHolder singleton (thread safe) in spring security.
UserDetailsService 需要做的是实现一个 loadByUsername(String username) 方法。此方法需要返回一个实现 UserDetails 的类。这可以是您自己的自定义对象，存储您喜欢的任何内容。这样做的好处是您可以通过 spring security taglib 从 JSP 访问对象的属性，并且它也始终可以从 spring security 中的 SecurityContextHolder 单例（线程安全）获得。
Here is a link to the docs for this: spring security manual, chapter 8Here is a blog post talking about implementing a custom user details service for password encryption: example usage
这是文档的链接：spring security 手册，第 8 章这是一篇关于为密码加密实现自定义用户详细信息服务的博客文章：示例用法
Hope this helps
希望这可以帮助
Edit: Forgot to mention that the object will be removed from the security context and session on logout. That is what is most useful about it, it is fully managed by spring security.
编辑：忘记提及该对象将在注销时从安全上下文和会话中删除。这就是它最有用的地方，它完全由 Spring Security 管理。
回答by Gandalf
You definitely need to write your own UserDetailService. In the Principal object there is the user and there is also a Details object in the AuthenticationTokenthat you can store a Map(String, String) of other login info.
您肯定需要编写自己的UserDetailService. 在 Principal 对象中有用户，还有一个 Details 对象AuthenticationToken，您可以在其中存储其他登录信息的 Map(String, String) 。
public class RequestFormDeatils extends SpringSecurityFilter {
protected void doFilterHttp(HttpServletRequest request, ...) {
SecurityContext sec = SecurityContextHolder.getContent();
AbstractAuthenticationToken auth = (AbstractAuthenticationToken)sec.getAuthentication();
Map<String, String> m = new HashMap<String, String>;
m.put("myCustom1", request.getParameter("myCustom1"));
m.put("myCustom2", request.getParameter("myCustom2"));
auth.setDetails(m);
}
Now anywhere in your code you get use the SecurityContextto propagate this security related info without having to couple it to your UserDetailsobject, or pass it as arguments. I do this code in a SecurityFilterat the end of the Spring Security Filter chain.
现在，您可以在代码中的任何地方使用SecurityContext传播此安全相关信息，而无需将其耦合到您的UserDetails对象，或将其作为参数传递。我SecurityFilter在 Spring Security Filter 链的末尾执行此代码。
<bean id="requestFormFilter" class="...RequestFormDetails">
<custom-filter position="LAST" />
</bean>
This info will be removed when the user is removed (like at log out).
当用户被删除时（如注销），此信息将被删除。
