Use the following three interfaces to check the checksum logic for spring Security (hereinafter called SS).
- Handling user Information Get logic Userdetailsservice
- Handling User Check Logic Userdetails
- Handling Password Encryption decryption Passwordencoder
public interface UserDetailsService { UserDetails loadUserByUsername(String var1) throws UsernameNotFoundException;}
Implement the Userdetailsservice interface, overriding the Loaduserbyusername method. SS will call this method (of course you have to give the implementation class to the spring container to manage, to ensure that the SS can be found when the need to call), Loaduserbyusername will return a package of user name, password and permission information, There are also userdetails objects for information such as whether the password expires.
See Userdetails interface:
public interface UserDetails extends Serializable { Collection<? extends GrantedAuthority> getAuthorities(); String getPassword(); String getUsername(); boolean isAccountNonExpired(); boolean isAccountNonLocked(); boolean isCredentialsNonExpired(); boolean isEnabled(); }
SS will take this information (from memory or from the database) to the client side of the account password to compare.
In general, when registering a password, we need to encrypt the original password.
We know that when encrypting a password, our ciphers are automatically injected into the IOC container. As follows
@Autowired private PasswordEncoder passwordEncoder;
So where does the cipher come from?
We need to configure an encryption device in the configuration class (Browsersecurityconfig extends Websecurityconfigureradapter).
@Bean public PasswordEncoder passwordEncoder(){ return new BCryptPasswordEncoder(); }
Once you have given the dongle to SPRING,SS, you can use the dongle at the appropriate time (such as encrypting the original password from the client and then userdetails with the password in the pin).
Spring Security's checksum logic