Class DaoAuthenticationProvider
- java.lang.Object
-
- org.springframework.security.authentication.dao.AbstractUserDetailsAuthenticationProvider
-
- org.springframework.security.authentication.dao.DaoAuthenticationProvider
-
- All Implemented Interfaces:
org.springframework.beans.factory.Aware
,org.springframework.beans.factory.InitializingBean
,org.springframework.context.MessageSourceAware
,AuthenticationProvider
public class DaoAuthenticationProvider extends AbstractUserDetailsAuthenticationProvider
AnAuthenticationProvider
implementation that retrieves user details from aUserDetailsService
.
-
-
Field Summary
-
Fields inherited from class org.springframework.security.authentication.dao.AbstractUserDetailsAuthenticationProvider
hideUserNotFoundExceptions, logger, messages
-
-
Constructor Summary
Constructors Constructor Description DaoAuthenticationProvider()
-
Method Summary
All Methods Instance Methods Concrete Methods Modifier and Type Method Description protected void
additionalAuthenticationChecks(UserDetails userDetails, UsernamePasswordAuthenticationToken authentication)
Allows subclasses to perform any additional checks of a returned (or cached)UserDetails
for a given authentication request.protected Authentication
createSuccessAuthentication(java.lang.Object principal, Authentication authentication, UserDetails user)
Creates a successfulAuthentication
object.protected void
doAfterPropertiesSet()
protected PasswordEncoder
getPasswordEncoder()
protected UserDetailsService
getUserDetailsService()
protected UserDetails
retrieveUser(java.lang.String username, UsernamePasswordAuthenticationToken authentication)
Allows subclasses to actually retrieve theUserDetails
from an implementation-specific location, with the option of throwing anAuthenticationException
immediately if the presented credentials are incorrect (this is especially useful if it is necessary to bind to a resource as the user in order to obtain or generate aUserDetails
).void
setPasswordEncoder(PasswordEncoder passwordEncoder)
Sets the PasswordEncoder instance to be used to encode and validate passwords.void
setUserDetailsPasswordService(UserDetailsPasswordService userDetailsPasswordService)
void
setUserDetailsService(UserDetailsService userDetailsService)
-
Methods inherited from class org.springframework.security.authentication.dao.AbstractUserDetailsAuthenticationProvider
afterPropertiesSet, authenticate, getPostAuthenticationChecks, getPreAuthenticationChecks, getUserCache, isForcePrincipalAsString, isHideUserNotFoundExceptions, setAuthoritiesMapper, setForcePrincipalAsString, setHideUserNotFoundExceptions, setMessageSource, setPostAuthenticationChecks, setPreAuthenticationChecks, setUserCache, supports
-
-
-
-
Method Detail
-
additionalAuthenticationChecks
protected void additionalAuthenticationChecks(UserDetails userDetails, UsernamePasswordAuthenticationToken authentication) throws AuthenticationException
Description copied from class:AbstractUserDetailsAuthenticationProvider
Allows subclasses to perform any additional checks of a returned (or cached)UserDetails
for a given authentication request. Generally a subclass will at least compare theAuthentication.getCredentials()
with aUserDetails.getPassword()
. If custom logic is needed to compare additional properties ofUserDetails
and/orUsernamePasswordAuthenticationToken
, these should also appear in this method.- Specified by:
additionalAuthenticationChecks
in classAbstractUserDetailsAuthenticationProvider
- Parameters:
userDetails
- as retrieved from theAbstractUserDetailsAuthenticationProvider.retrieveUser(String, UsernamePasswordAuthenticationToken)
orUserCache
authentication
- the current request that needs to be authenticated- Throws:
AuthenticationException
- AuthenticationException if the credentials could not be validated (generally aBadCredentialsException
, anAuthenticationServiceException
)
-
doAfterPropertiesSet
protected void doAfterPropertiesSet()
- Overrides:
doAfterPropertiesSet
in classAbstractUserDetailsAuthenticationProvider
-
retrieveUser
protected final UserDetails retrieveUser(java.lang.String username, UsernamePasswordAuthenticationToken authentication) throws AuthenticationException
Description copied from class:AbstractUserDetailsAuthenticationProvider
Allows subclasses to actually retrieve theUserDetails
from an implementation-specific location, with the option of throwing anAuthenticationException
immediately if the presented credentials are incorrect (this is especially useful if it is necessary to bind to a resource as the user in order to obtain or generate aUserDetails
).Subclasses are not required to perform any caching, as the
AbstractUserDetailsAuthenticationProvider
will by default cache theUserDetails
. The caching ofUserDetails
does present additional complexity as this means subsequent requests that rely on the cache will need to still have their credentials validated, even if the correctness of credentials was assured by subclasses adopting a binding-based strategy in this method. Accordingly it is important that subclasses either disable caching (if they want to ensure that this method is the only method that is capable of authenticating a request, as noUserDetails
will ever be cached) or ensure subclasses implementAbstractUserDetailsAuthenticationProvider.additionalAuthenticationChecks(UserDetails, UsernamePasswordAuthenticationToken)
to compare the credentials of a cachedUserDetails
with subsequent authentication requests.Most of the time subclasses will not perform credentials inspection in this method, instead performing it in
AbstractUserDetailsAuthenticationProvider.additionalAuthenticationChecks(UserDetails, UsernamePasswordAuthenticationToken)
so that code related to credentials validation need not be duplicated across two methods.- Specified by:
retrieveUser
in classAbstractUserDetailsAuthenticationProvider
- Parameters:
username
- The username to retrieveauthentication
- The authentication request, which subclasses may need to perform a binding-based retrieval of theUserDetails
- Returns:
- the user information (never
null
- instead an exception should the thrown) - Throws:
AuthenticationException
- if the credentials could not be validated (generally aBadCredentialsException
, anAuthenticationServiceException
orUsernameNotFoundException
)
-
createSuccessAuthentication
protected Authentication createSuccessAuthentication(java.lang.Object principal, Authentication authentication, UserDetails user)
Description copied from class:AbstractUserDetailsAuthenticationProvider
Creates a successfulAuthentication
object.Protected so subclasses can override.
Subclasses will usually store the original credentials the user supplied (not salted or encoded passwords) in the returned
Authentication
object.- Overrides:
createSuccessAuthentication
in classAbstractUserDetailsAuthenticationProvider
- Parameters:
principal
- that should be the principal in the returned object (defined by theAbstractUserDetailsAuthenticationProvider.isForcePrincipalAsString()
method)authentication
- that was presented to the provider for validationuser
- that was loaded by the implementation- Returns:
- the successful authentication token
-
setPasswordEncoder
public void setPasswordEncoder(PasswordEncoder passwordEncoder)
Sets the PasswordEncoder instance to be used to encode and validate passwords. If not set, the password will be compared usingPasswordEncoderFactories.createDelegatingPasswordEncoder()
- Parameters:
passwordEncoder
- must be an instance of one of thePasswordEncoder
types.
-
getPasswordEncoder
protected PasswordEncoder getPasswordEncoder()
-
setUserDetailsService
public void setUserDetailsService(UserDetailsService userDetailsService)
-
getUserDetailsService
protected UserDetailsService getUserDetailsService()
-
setUserDetailsPasswordService
public void setUserDetailsPasswordService(UserDetailsPasswordService userDetailsPasswordService)
-
-