如何在 Spring Boot 2.7 中使用 userDetailsService 更新已弃用的 WebSecurityConfigurerAdapter答案

【问题标题】：How to update deprecated WebSecurityConfigurerAdapter with userDetailsService in Spring Boot 2.7如何在 Spring Boot 2.7 中使用 userDetailsService 更新已弃用的 WebSecurityConfigurerAdapter
【发布时间】：2022-10-23 20:28:04
【问题描述】：

Spring 2.7 中的 WebSecurityConfigurerAdapter 已弃用。我应该如何更新这个类：

public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

    private final UserRepository userRepository;

    @Autowired
    public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
        auth.userDetailsService(
                email -> {
                    log.debug("Authenticating '{}'", email);
                    Optional<User> optionalUser = userRepository.findByEmailIgnoreCase(email);
                    return new AuthUser(optionalUser.orElseThrow(
                            () -> new UsernameNotFoundException("User '" + email + "' was not found")));
                }
        ).passwordEncoder(PasswordEncoderFactories.createDelegatingPasswordEncoder());
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests()....
    }
}

【问题讨论】：

标签： java spring spring-boot security spring-security

【解决方案1】：

根据Spring Security without the WebSecurityConfigurerAdapter 可以更新：

public class SecurityConfiguration {

    private final UserRepository userRepository;

    @Bean
    public PasswordEncoder passwordEncoder() {
        return PasswordEncoderFactories.createDelegatingPasswordEncoder();
    }

    @Bean
    public UserDetailsService userDetailsService() {
        return email -> {
            log.debug("Authenticating '{}'", email);
            Optional<User> optionalUser = userRepository.findByEmailIgnoreCase(email);
            return new AuthUser(optionalUser.orElseThrow(
                    () -> new UsernameNotFoundException("User '" + email + "' was not found")));
        };
    }

    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http.authorizeRequests()...;
        return http.build();
    }
}

【讨论】：

【解决方案2】：

// spring boot 2.7.0 + changes with spring security

@Configuration
public class SecurityConfiguration {

    @Bean
    UserDetailsService userDetailsService() {

        return new MyUserDetailsService(); // to be created
    }

    @Bean
    BCryptPasswordEncoder passwordEncoder() {

        return new BCryptPasswordEncoder();
    }

    @Bean
    DaoAuthenticationProvider authenticationProvider() {

        DaoAuthenticationProvider authProvider = new DaoAuthenticationProvider();

        authProvider.setUserDetailsService(userDetailsService());

        authProvider.setPasswordEncoder(passwordEncoder());

        return authProvider;
    }

    @Bean
    SecurityFilterChain filterChain(HttpSecurity http) throws Exception {

        http.authenticationProvider(authenticationProvider()); 
    
        http.authorizeRequests()...;

        http.authorizeRequests().and().rememberMe().userDetailsService(userDetailsService()); // important
    
        http.authorizeRequests()...;

        return http.build();
    }
    
}

【讨论】：

【解决方案3】：

https://spring.io/blog/2022/02/21/spring-security-without-the-websecurityconfigureradapter

@Configuration
public class SecurityConfiguration {

    @Bean
    public InMemoryUserDetailsManager userDetailsService() {
        UserDetails user = User.withDefaultPasswordEncoder()
            .username("user")
            .password("password")
            .roles("USER")
            .build();
        return new InMemoryUserDetailsManager(user);
    }
}

【讨论】：