SpringMVC：使用用户密码创建Java密钥库，并在以后访问密钥 我正在开发一个SpringMVC应用程序，其中有一个人 使用BCrypt在数据库中为其存储密码的类 格式。现在，我想使用MD5和创建一个Java密钥库 用户的明文密码。 但由于我不知道Spring security如何以及在何处使用明文密码并对其执行BCrypt以检查vs数据库，因此我无法使用明文密码创建MD5总和 每次用户登录时，我都会重复这个过程，这样我就可以通过编程方式解锁密钥库，并以keyname和MD5 sum作为密码检索密钥

我正在粘贴我的个人模型和spring-security-application.xml：

 @Entity
@Table(name="person")
public class Person implements UserDetails{

    private static final GrantedAuthority USER_AUTH = new SimpleGrantedAuthority("ROLE_USER");

    private static final String emailRegexp = "^[a-zA-Z0-9_.+-]+@[a-zA-Z0-9-]+\\.[a-zA-Z0-9-.]+$";

    @Id
    @Column(name="id")
    @GeneratedValue(strategy = GenerationType.SEQUENCE,generator = "person_seq_gen")
    @SequenceGenerator(name = "person_seq_gen",sequenceName = "person_seq")
    private int id;

    @Valid
    @Email
    @Pattern(regexp = emailRegexp)
    @Column(name = "username")
    private String username;

    @Valid
    @NotEmpty(message = "Password may not be empty")
    @Column(name = "password")
    private String password;


 //getters and setters ommitted

}

PersonServiceImpl：

 @Override
    @Transactional
    public boolean addPerson(Person p) {
        try {
            Thread.sleep(2000);
        } catch (InterruptedException e) {
            e.printStackTrace();
        }
        Person existingUser = personDAO.findPersonByUsername(p.getUsername());
        if(existingUser == null) {
            this.personDAO.addPerson(p);
            p.setAccountstatus(false);
            p.setOnetimeemail(false);
            p.setUsername(p.getUsername().toLowerCase());
            p.setPassword(BCrypt.hashpw(p.getPassword(), BCrypt.gensalt(11)));
            p.setUsername(p.getUsername().toLowerCase());
            this.personDAO.addPerson(p);
            sendAccountActivationEmail(p.getUsername(), p.getFirstName());
            return true;
        } else {
            return  false;
        }
    }

@Transactional
@Service("userDetailsService")
public class LoginServiceImpl implements UserDetailsService{

    @Autowired private PersonDAO personDAO;
    @Autowired private Assembler assembler;


    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException,DataAccessException {
        Person person = personDAO.findPersonByUsername(username.toLowerCase());
            if(person == null) { throw new UsernameNotFoundException("Wrong username or password");} //Never specify which one was it exactly
        return assembler.buildUserFromUserEntity(person);
    }

    public LoginServiceImpl() {
    }
}

security-applicationContext.xml：

 <security:global-method-security pre-post-annotations="enabled" />

    <security:http create-session="ifRequired" use-expressions="true" auto-config="true" disable-url-rewriting="true">
        <security:form-login login-page="/login" default-target-url="/canvas/list" always-use-default-target="false" authentication-failure-url="/denied.jsp" />
        <security:remember-me key="_spring_security_remember_me" user-service-ref="userDetailsService" token-validity-seconds="1209600" data-source-ref="dataSource"/>
        <security:logout delete-cookies="JSESSIONID" invalidate-session="true" logout-url="/j_spring_security_logout"/>

<!--        <security:intercept-url pattern="/**" requires-channel="https"/> -->

  <!--  <security:port-mappings>
        <security:port-mapping http="80" https="443"/>
    </security:port-mappings>
-->
    </security:http>




    <!-- queries to be run on data -->
    <beans:bean id="rememberMeAuthenticationProvider" class="org.springframework.security.web.authentication.rememberme.PersistentTokenBasedRememberMeServices">
        <beans:property name="key" value="_spring_security_remember_me" />
        <beans:property name="tokenRepository" ref="jdbcTokenRepository"/>
        <beans:property name="userDetailsService" ref="LoginServiceImpl"/>
    </beans:bean>

    <!--Database management for remember-me -->
    <beans:bean id="jdbcTokenRepository"
                class="org.springframework.security.web.authentication.rememberme.JdbcTokenRepositoryImpl">
        <beans:property name="createTableOnStartup" value="false"/>
        <beans:property name="dataSource" ref="dataSource" />
    </beans:bean>

    <!-- Remember me ends here -->
    <security:authentication-manager alias="authenticationManager" erase-credentials="false">
        <security:authentication-provider user-service-ref="LoginServiceImpl">
           <security:password-encoder  ref="encoder"/>
        </security:authentication-provider>
    </security:authentication-manager>

    <beans:bean id="encoder"
                class="org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder">
        <beans:constructor-arg name="strength" value="11" />
    </beans:bean>

    <beans:bean id="daoAuthenticationProvider"
                class="org.springframework.security.authentication.dao.DaoAuthenticationProvider">
                <beans:property name="userDetailsService" ref="LoginServiceImpl"/>
<security:global-method-security pre-post-annotations="enabled" />

<security:http create-session="ifRequired" use-expressions="true" auto-config="true" disable-url-rewriting="true">
    <security:form-login login-page="/login" default-target-url="/canvas/list" always-use-default-target="false" authentication-failure-url="/denied.jsp" />
    <security:remember-me key="_spring_security_remember_me" user-service-ref="userDetailsService" token-validity-seconds="1209600" data-source-ref="dataSource"/>
    <security:logout delete-cookies="JSESSIONID" invalidate-session="true" logout-url="/j_spring_security_logout"/>
</security:http>

<beans:bean id="rememberMeAuthenticationProvider" class="org.springframework.security.web.authentication.rememberme.PersistentTokenBasedRememberMeServices">
    <beans:property name="key" value="_spring_security_remember_me" />
    <beans:property name="tokenRepository" ref="jdbcTokenRepository"/>
    <beans:property name="userDetailsService" ref="LoginServiceImpl"/>
</beans:bean>
<beans:bean id="jdbcTokenRepository"
            class="org.springframework.security.web.authentication.rememberme.JdbcTokenRepositoryImpl">
    <beans:property name="createTableOnStartup" value="false"/>
    <beans:property name="dataSource" ref="dataSource" />
</beans:bean>
<security:authentication-manager alias="authenticationManager" erase-credentials="false">
    <security:authentication-provider user-service-ref="LoginServiceImpl">
       <security:password-encoder  ref="encoder"/>
    </security:authentication-provider>
</security:authentication-manager>

<beans:bean id="encoder"
            class="org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder">
    <beans:constructor-arg name="strength" value="11" />
</beans:bean>

<beans:bean id="daoAuthenticationProvider"
            class="org.springframework.security.authentication.dao.DaoAuthenticationProvider">
            <beans:property name="userDetailsService" ref="LoginServiceImpl"/>
           <beans:property name="passwordEncoder" ref="encoder"/>
</beans:bean>
            <beans:property name="passwordEncoder" ref="encoder"/>
    </beans:bean>

汇编程序：

@Service("assembler")
public class Assembler {
    @Transactional(readOnly = true)
    User buildUserFromUserEntity(Person userEntity){
        String username = userEntity.getUsername().toLowerCase();
        String password = userEntity.getPassword();

        boolean enabled = userEntity.isEnabled();
        boolean accountNonExpired = userEntity.isAccountNonExpired();
        boolean credentialsNonExpired = userEntity.isCredentialsNonExpired();
        boolean accountNonLocked = userEntity.isAccountNonLocked();

        Collection<GrantedAuthority> authorities = new ArrayList<>();
        authorities.add(new SimpleGrantedAuthority("ROLE_USER"));

        return new User(username,password,enabled,accountNonExpired,credentialsNonExpired,accountNonLocked,authorities);
        }
}

@服务（“汇编程序”）
公共类汇编程序{
@事务（只读=真）
用户buildUserFromUserEntity（Person userEntity）{
字符串username=userEntity.getUsername（）.toLowerCase（）；
字符串password=userEntity.getPassword（）；
boolean enabled=userEntity.isEnabled（）；
布尔AccountNoneExpired=userEntity.IsAccountNoneExpired（）；
boolean credentialsNonExpired=userEntity.isCredentialsNonExpired（）；
布尔AccountNonlock=userEntity.IsAccountNonlock（）；
收集权限=新建ArrayList（）；
添加（新的SimpleGrantedAuthority（“角色用户”）；
返回新用户（用户名、密码、已启用、AccountNoExpired、CredentialsNoExpired、AccountNoLocked、权限）；
}
}

---

我希望我说的很清楚，如果有任何疑问，请告诉我。。任何帮助都很好。非常感谢…：-）

您可以让Spring Security在会话中保留密码：

---

查看
用户名密码验证筛选器
@chrylis:谢谢，我没有实现用户名密码验证筛选器。那样的话我该怎么办？我查过了，我相信你的意思是使用公共静态最终字符串SPRING\u SECURITY\u FORM\u PASSWORD\u KEY。你没有实现它。我说去看看,；这就是你要问的代码。你好，我试过你的代码。我只是用另一种方法。我调用了Authentication Authentication=SecurityContextHolder.getContext（）.getAuthentication（）；，然后是authentication.getCredentials.toString。我只得到了用户名作为回报。您能告诉我如何获得密码吗。@WeareBorg
getCredentials（）
通常会返回密码，但根据配置的不同，密码可能会有所不同。你的安全配置中有什么奇怪的东西吗？没有，我正在编辑我的帖子以粘贴完整的security-application-context.xml。我还将粘贴用于findByUsername和build实体的汇编程序和LoginServiceImpl。请给我5分钟时间。：-）完成。请看一看。：-）它成功了，我甚至不需要扩展UsernamePasswordAuthenticationFilter。我只是将false设置为擦除凭据，然后通过身份验证对象获取密码。非常感谢。：-）