开启 jHipster spring-boot security答案

【问题标题】：Opening up jHipster spring-boot security开启 jHipster spring-boot security
【发布时间】：2017-11-07 05:18:07
【问题描述】：

我想在开发过程中向“世界”开放spring security。 jHipster 有一个很棒的生成器，但我有点困惑。我怎样才能毫无问题地为安静的通话打开弹簧安全性？

/**
 * Authenticate a user from the database.
 */
@Component("userDetailsService")
public class DomainUserDetailsService implements UserDetailsService {

    private final Logger log = LoggerFactory.getLogger(DomainUserDetailsService.class);

    private final UserRepository userRepository;

    public DomainUserDetailsService(UserRepository userRepository) {
        this.userRepository = userRepository;
    }

    @Override
    @Transactional
    public UserDetails loadUserByUsername(final String login) {
        log.debug("Authenticating {}", login);
        String lowercaseLogin = login.toLowerCase(Locale.ENGLISH);
        Optional<User> userFromDatabase = userRepository.findOneWithAuthoritiesByLogin(lowercaseLogin);
        return userFromDatabase.map(user -> {
            if (!user.getActivated()) {
                throw new UserNotActivatedException("User " + lowercaseLogin + " was not activated");
            }
            List<GrantedAuthority> grantedAuthorities = user.getAuthorities().stream()
                    .map(authority -> new SimpleGrantedAuthority(authority.getName()))
                .collect(Collectors.toList());
            return new org.springframework.security.core.userdetails.User(lowercaseLogin,
                user.getPassword(),
                grantedAuthorities);
        }).orElseThrow(() -> new UsernameNotFoundException("User " + lowercaseLogin + " was not found in the " +
        "database"));
    }
}

【问题讨论】：

标签： spring-boot spring-security jhipster

【解决方案1】：

要允许任何人访问 REST API，请在位于 src/main/java/com/mycompany/myapp/config/SecurityConfiguration.java 的 SecurityConfiguration.java 中更改以下行

        .antMatchers("/api/**").authenticated()

到

        .antMatchers("/api/**").permitAll()

如果需要，您可以使用以下任一注释来限制特定的 API 端点：

        @Secured(AuthoritiesConstants.ADMIN)

或

        @PreAuthorize("hasRole('ROLE_USER')")

【讨论】：