SoFunction
Updated on 2025-03-08

Detailed explanation of spring Security's custom user authentication process

First I need to declare it in the xml file. I want to customize the authentication class of the user, that is, I want to query from the database myself

<http pattern="/*.html" security="none"/>
  <http pattern="/css/**" security="none"/>
  <http pattern="/img/**" security="none"/>
  <http pattern="/js/**" security="none"/>
  <http pattern="/plugins/**" security="none"/>
  <http pattern="/seller/" security="none"/>

  <!-- use-expressions:Set whether to startSpELexpression,The default value istrue。 -->
  <http use-expressions="false">
    <!--
      ConfigurationSpringSecurityIntercept path(Intercepting rules)
      * pattern:ConfigurationIntercepting rules。  /* Represents all resources under the root path(Not included in subpaths) /**Represents all resources under the root path(Includes subpaths)
      * access:Set up roles Character naming ROLE_Role name like: ROLE_USER
    -->
    <intercept-url pattern="/**" access="ROLE_SELLER"/>

    <!--
    Turn on form verification
      username-parameter="username"
      password-parameter="password"
      login-page      :Login page name by / start
      default-target-url  :Page that jumps after login is successful
      login-processing-url:Settings of submitted paths default value"/login" 可by修改
    -->
    <form-login login-page="/" default-target-url="/admin/" always-use-default-target="true" authentication-failure-url="/"/>

    <!-- Not usedcsrfVerification of -->
    <csrf disabled="true"/>

    <!-- Configuration框架页面不拦截 -->
    <headers>
      <frame-options policy="SAMEORIGIN"/>
    </headers>

    <!-- 注销的Configuration -->
    <logout logout-url="/logout" logout-success-url="/" />
  </http>

  <!-- Configuration认证管理器 -->
  <authentication-manager>
    <!-- Certified provider -->
    <authentication-provider user-service-ref="userDetailService">
      <password-encoder ref="passwordEncoder"></password-encoder>
    </authentication-provider>
  </authentication-manager>
<!-- Configuration自定义的认证类 -->
  <beans:bean  class="com.">
    <beans:property name="sellerService" ref="sellerService"></beans:property>
  </beans:bean>

<!--The algorithm used during encryption isBCryptPasswordEncoder-->
  <beans:bean  class=""/>

After configuring the custom file, implement it in modules that require custom authentication classes.

UserDetailsService

package com.;
import ;
import com.;
import ;
import ;
import ;
import ;
import ;
import ;
import ;

import ;
import ;
import ;
import ;

/**
  * Customized authentication classes
  * @Auther:qingmu
  * @Description: Be down to earth, just to make a name for yourself
  * @Date:Created in 8:33 2019/5/31
  */
public class UserDetailServiceImpl implements UserDetailsService {

  private SellerService sellerService;

  public UserDetailServiceImpl() {
  }
  @Override
  public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
    Seller seller = (username);
    if(null!=seller){
      //Judge whether the merchant has been approved once.      if("1".equals(())){
        //Create a collection to store permissions        HashSet<GrantedAuthority> authorities = new HashSet<>();
        (new SimpleGrantedAuthority("ROLE_SELLER"));
        //Return the user's information to the authentication class        return new User(username,(),authorities);
      }
    }
    // Without this user, null will be returned    return null;
  }

  public UserDetailServiceImpl(SellerService sellerService) {
     = sellerService;
  }

  public SellerService getSellerService() {
    return sellerService;
  }

  public void setSellerService(SellerService sellerService) {
     = sellerService;
  }
}

The above is all the content of this article. I hope it will be helpful to everyone's study and I hope everyone will support me more.