Spring Security 시작하기 / MAVEN

다음의 의존성 추가

<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-security</artifactId>
</dependency>

 

SpringSecurityConfiguration.java 작성

package com.hyukjin.springboot.myfirstwebapp.security;

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.provisioning.InMemoryUserDetailsManager;
import java.util.function.Function;

@Configuration
public class SpringSecurityConfiguration {
    
    @Bean
    public InMemoryUserDetailsManager createUserDetailManget() {
        Function<String, String> passwordEncoder
                = input -> passwordEncoder().encode(input);
        UserDetails userDetails = User.builder()
                .passwordEncoder(passwordEncoder)
                .username("hyukjin")
                .password("981222")
                .roles("USER", "ADMIN")
                .build();

        return new InMemoryUserDetailsManager(userDetails);
    }
    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }
}

SpringSecurityConfiguration 을 빈으로 등록시 자동으로 스프링 시큐리티가 적용되어 로그인 페이지 생성..

 

로그인 했던 데이터는 어떻게 가져올까? 

만약 WelcomController 에서 로그인 했던 아이디를 가져오고 싶다면 아래의 코드 참조

package com.hyukjin.springboot.myfirstwebapp.login;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.stereotype.Controller;
import org.springframework.ui.ModelMap;
import org.springframework.web.bind.annotation.*;

@Controller
@SessionAttributes("name")
public class WelcomeController {

    @GetMapping("/")
    // src/main/resources/META-INF/resources/WEB-INF/jsp/sayHello.jsp
    public String gotoWelcomePage(ModelMap model ) {
        //model.put("name","hyukjin");
        model.put("name", getLoggedinUsername());
        return "welcome";
    }

    private String getLoggedinUsername() {
        Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
        return authentication.getName();

    }
    
}

SecurityHolder에서 인증정보를 가져올 수 있다. 되도록 사용자 정보는  SecurityContextHolder 에서 직접 가져오는게 좋다

 

 

만약 여러 사용자를 추가해놓고 싶다면? 

package com.hyukjin.springboot.myfirstwebapp.security;

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.provisioning.InMemoryUserDetailsManager;
import java.util.function.Function;

@Configuration
public class SpringSecurityConfiguration {

    @Bean
    public InMemoryUserDetailsManager createUserDetailManget() {

        UserDetails userDetails1 = createNewUser("hyukjin", "981222");
        UserDetails userDetails2 = createNewUser("mijin", "970104");

        return new InMemoryUserDetailsManager(userDetails1, userDetails2);
    }

    private UserDetails createNewUser(String username, String password) {
        Function<String, String> passwordEncoder
                = input -> passwordEncoder().encode(input);
        UserDetails userDetails = User.builder()
                .passwordEncoder(passwordEncoder)
                .username(username)
                .password(password)
                .roles("USER", "ADMIN")
                .build();
        return userDetails;
    }

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }
}

InMemoryUserDetailManaget 에 userDetail 을 추가해주면 된다! 

 

 

아무런 설정도 하지않으면 2가지 Default 설정이 된다

1. 모든 URL 은 보호된다.

2. 허가되지 않은 요청은 로그인 FORM 이 보여진다.