#冲刺创作新星#springsecurity默认用户生成 原创

急需吃饭的小谢
发布于 2022-10-20 15:52
浏览
0收藏

springsecurity默认用户生成

springboot背后默默做了很多事情:

  • 开启springSecurity自动化配置,开启后,会自动创建一个名为SpringSecurityFilterChain的过滤器,并注入到spring容器中,这个过滤器将负责所有的安全管理,包括用户的认证,授权,重定向到登录页面等(springSecurityFilterChain实际上代理了SpringSecurity中的过滤器链)
  • 创建一个UserDetailsService实例,UserDetailsService负责提供用户数据,默认的用户数据是基于内存的用户,用户名为user,密码为随机生成的UUID字符串。
  • 给用户生成一个默认的登录页面。
  • 开启CSRF攻击防御。
  • 开启会话固定攻击防御。
  • 集成X-XSS-Protection
  • 集成X-Frame-Options以防止单击劫持。

默认用户生成

SpringSecurity定义UserDetails接口来规范开发者自定义的用户对象

负责提供用户数据源的接口是UserDetailsService

springSecurity为UserDetailsService提供了默认实现,默认是InMemoryUserDetailsManager

springboot之所以零配置使用SpringSecurity 是因为他提供了很多自动化配置,针对UserDetailsService的自动化配置是UserDetailsServiceAutoConfiguration

//
// Source code recreated from a .class file by IntelliJ IDEA
// (powered by FernFlower decompiler)
//

package org.springframework.boot.autoconfigure.security.servlet;

import java.util.List;
import java.util.regex.Pattern;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
import org.springframework.beans.factory.ObjectProvider;
import org.springframework.boot.autoconfigure.condition.ConditionalOnBean;
import org.springframework.boot.autoconfigure.condition.ConditionalOnClass;
import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean;
import org.springframework.boot.autoconfigure.security.SecurityProperties;
import org.springframework.boot.autoconfigure.security.SecurityProperties.User;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.context.annotation.Lazy;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.authentication.AuthenticationProvider;
import org.springframework.security.config.annotation.ObjectPostProcessor;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.provisioning.InMemoryUserDetailsManager;
import org.springframework.util.StringUtils;

@Configuration(
   proxyBeanMethods = false
)
@ConditionalOnClass({AuthenticationManager.class})
@ConditionalOnBean({ObjectPostProcessor.class})
@ConditionalOnMissingBean(
   value = {AuthenticationManager.class, AuthenticationProvider.class, UserDetailsService.class},
   type = {"org.springframework.security.oauth2.jwt.JwtDecoder", "org.springframework.security.oauth2.server.resource.introspection.OpaqueTokenIntrospector"}
)
public class UserDetailsServiceAutoConfiguration {
   private static final String NOOP_PASSWORD_PREFIX = "{noop}";
   private static final Pattern PASSWORD_ALGORITHM_PATTERN = Pattern.compile("^\\{.+}.*$");
   private static final Log logger = LogFactory.getLog(UserDetailsServiceAutoConfiguration.class);

   public UserDetailsServiceAutoConfiguration() {
   }

   @Bean
   @ConditionalOnMissingBean(
       type = {"org.springframework.security.oauth2.client.registration.ClientRegistrationRepository"}
   )
   @Lazy
   public InMemoryUserDetailsManager inMemoryUserDetailsManager(SecurityProperties properties, ObjectProvider<PasswordEncoder> passwordEncoder) {
       User user = properties.getUser();
       List<String> roles = user.getRoles();
       return new InMemoryUserDetailsManager(new UserDetails[]{org.springframework.security.core.userdetails.User.withUsername(user.getName()).password(this.getOrDeducePassword(user, (PasswordEncoder)passwordEncoder.getIfAvailable())).roles(StringUtils.toStringArray(roles)).build()});
   }

   private String getOrDeducePassword(User user, PasswordEncoder encoder) {
       String password = user.getPassword();
       if (user.isPasswordGenerated()) {
           logger.info(String.format("%n%nUsing generated security password: %s%n", user.getPassword()));
       }

       return encoder == null && !PASSWORD_ALGORITHM_PATTERN.matcher(password).matches() ? "{noop}" + password : password;
   }
}

从上述代码中,有两个比较重要的促使系统自动提供一个InMemoryUserDetailsManager的实例:

  1. 当前classpath下存在AuthenticationManager
  2. 当前项目中,系统没有提供AuthenticationManager AuthenticationProvider UserDetailsService ClientRegistrationRepository

满足以上条件,springSecurity会创建InMemoryUserDetailsManager 实例,从方法中可以看到,用户数据源来自SecurityProperties#getUser方法

//
// Source code recreated from a .class file by IntelliJ IDEA
// (powered by FernFlower decompiler)
//

package org.springframework.boot.autoconfigure.security;

import java.util.ArrayList;
import java.util.Arrays;
import java.util.HashSet;
import java.util.List;
import java.util.Set;
import java.util.UUID;
import org.springframework.boot.context.properties.ConfigurationProperties;
import org.springframework.boot.web.servlet.DispatcherType;
import org.springframework.util.StringUtils;

@ConfigurationProperties(
    prefix = "spring.security"
)
public class SecurityProperties {
    public static final int BASIC_AUTH_ORDER = 2147483642;
    public static final int IGNORED_ORDER = -2147483648;
    public static final int DEFAULT_FILTER_ORDER = -100;
    private final SecurityProperties.Filter filter = new SecurityProperties.Filter();
    private SecurityProperties.User user = new SecurityProperties.User();

    public SecurityProperties() {
    }

    public SecurityProperties.User getUser() {
        return this.user;
    }

    public SecurityProperties.Filter getFilter() {
        return this.filter;
    }

    public static class User {
        private String name = "user";
        private String password = UUID.randomUUID().toString();
        private List<String> roles = new ArrayList();
        private boolean passwordGenerated = true;

        public User() {
        }

        public String getName() {
            return this.name;
        }

        public void setName(String name) {
            this.name = name;
        }

        public String getPassword() {
            return this.password;
        }

        public void setPassword(String password) {
            if (StringUtils.hasLength(password)) {
                this.passwordGenerated = false;
                this.password = password;
            }
        }

        public List<String> getRoles() {
            return this.roles;
        }

        public void setRoles(List<String> roles) {
            this.roles = new ArrayList(roles);
        }

        public boolean isPasswordGenerated() {
            return this.passwordGenerated;
        }
    }

    public static class Filter {
        private int order = -100;
        private Set<DispatcherType> dispatcherTypes;

        public Filter() {
            this.dispatcherTypes = new HashSet(Arrays.asList(DispatcherType.ASYNC, DispatcherType.ERROR, DispatcherType.REQUEST));
        }

        public int getOrder() {
            return this.order;
        }

        public void setOrder(int order) {
            this.order = order;
        }

        public Set<DispatcherType> getDispatcherTypes() {
            return this.dispatcherTypes;
        }

        public void setDispatcherTypes(Set<DispatcherType> dispatcherTypes) {
            this.dispatcherTypes = dispatcherTypes;
        }
    }
}

我们可以看到默认用户为user 默认密码是UUID

默认通过getOrDeducePassword方法中进行二次处理,默认encoder为null ,就在密码加一个{noop}前缀,我们可以通过配置文件添加配置来修改SecurityProperties.User类中的属性

spring.security.user.name=admin
spring.security.user.password=123
spring.security.user.roles=admin,user

©著作权归作者所有,如需转载,请注明出处,否则将追究法律责任
标签
已于2022-10-20 15:53:17修改
收藏
回复
举报
回复
    相关推荐