嘿,我有一点与我的基于springsecurity登录乱春季安全/休眠:即使它们是正确的,凭据也不正确?
我不断收到错误“坏凭据”
这里是我的用户表:
[用户表] [1 ]
下面是从ApplicationContext中我数据源:
<!-- database driver/location -->
<bean id="dataSource" class="org.springframework.jdbc.datasource.DriverManagerDataSource">
<property name="driverClassName" value="com.mysql.jdbc.Driver" />
<property name="url" value="jdbc:mysql://localhost:3306/ams" />
<property name="username" value="root" />
<property name="password" value="root" />
</bean>
和我的SecurityContext:
<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:context="http://www.springframework.org/schema/context"
xmlns:security="http://www.springframework.org/schema/security"
xmlns:tx="http://www.springframework.org/schema/tx"
xsi:schemaLocation="http://www.springframework.org/schema/beans
http://www.springframework.org/schema/beans/spring-beans-3.1.xsd
http://www.springframework.org/schema/security
http://www.springframework.org/schema/security/spring-security-3.0.xsd">
<!-- <security:http auto-config="true" access-decision-manager-ref="accessDecisionManager"> -->
<security:http auto-config="true">
<security:intercept-url pattern="/login/login.do" access="IS_AUTHENTICATED_ANONYMOUSLY" />
<security:intercept-url pattern="/login/doLogin.do" access="IS_AUTHENTICATED_ANONYMOUSLY" />
<security:intercept-url pattern="/lib/**" access="IS_AUTHENTICATED_ANONYMOUSLY" />
<security:intercept-url pattern="/css/**" access="IS_AUTHENTICATED_ANONYMOUSLY" />
<security:intercept-url pattern="/images/**" access="IS_AUTHENTICATED_ANONYMOUSLY" />
<security:intercept-url pattern="/resources/**" access="IS_AUTHENTICATED_ANONYMOUSLY" />
<security:intercept-url pattern="/**" access="IS_AUTHENTICATED_REMEMBERED" />
<security:form-login login-page="/login/login.do" authentication-failure-url="/login/login.do?login_error=true" default-target-url="/test/showTest.do"/>
<security:logout logout-success-url="/login/login.do" invalidate-session="true" />
<security:remember-me key="rememberMe"/>
</security:http>
<security:authentication-manager>
<security:authentication-provider>
<security:jdbc-user-service data-source-ref="dataSource"
users-by-username-query="select USERNAME as username, PASSWORD as password, DELETED as deleted from ams.user where USERNAME=?"
authorities-by-username-query="
select distinct user.USERNAME as username, permission.NAME as authority
from scu.user, scu.user_role, scu.role, scu.role_permission, scu.permission
where user.ID=user_role.USER_ID AND user_role.ROLE_ID=role_permission.ROLE_ID AND role_permission.PERMISSION_ID=permission.ID AND user.USERNAME=?"/>
<!-- security:password-encoder ref="passwordEncoder" /> -->
</security:authentication-provider>
</security:authentication-manager>
<bean id="passwordEncoder"
class="org.springframework.security.authentication.encoding.ShaPasswordEncoder">
<constructor-arg value="256" />
</bean>
</beans>
当我尝试登录:admin和init01
它给我的错误坏证书... =(
任何建议都感激!
哈希密码编码器不是问题,我刚刚评论它所以你可以看到真正的密码实际上是什么...... 它不改变任何东西,当我使用它或当我不使用它 – 2013-02-20 20:01:29
最有可能的是这个问题。没有它,它将不会工作,除非它生成的字符串与数据库中的字符串完全匹配,否则它将无法使用它。因此,链接。检查日志,如果有疑问,使用调试器并设置一个断点[here](https://github.com/SpringSource/spring-security/blob/master/core/src/main/java/org/springframework/security /authentication/dao/DaoAuthenticationProvider.java#L84)。如果验证因密码不匹配而失败,您还应该看到该日志消息。 – 2013-02-20 20:24:04
我知道init01的散列(这是与其他用户一起使用的散列),并且它绝对不起作用 但是,谢谢我一定会经历那个 – 2013-02-20 20:31:04