spring security 6 인증 관리자 설정

Question

spring boot 관련 책을 통해 security config 설정을 하는데security버전이 최신이 아니라 문법이 다릅니다다른것들은 최신버전 문법으로 바꿧는데&#64;Bean public AuthenticationManager authenticationManager(HttpSecurity http, BCryptPasswordEncoder bCryptPasswordEncoder, UserDetailService userDetailService) throws Exception { return http.getSharedObject(AuthenticationManagerBuilder.class) .userDetailsService(userService) .passwordEncoder(bCryptPasswordEncoder) .and() .build(); }이 코드를 어떻게 최신 문법으로 바꾸어야 할지 모르겠습니다... -전체 코드-package create.sharecon.Config; import create.sharecon.Service.UserDetailService; import org.springframework.beans.factory.annotation.Autowired; import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Configuration; import org.springframework.security.authentication.AuthenticationManager; import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder; import org.springframework.security.config.annotation.web.builders.HttpSecurity; import org.springframework.security.config.annotation.web.configuration.WebSecurityCustomizer; import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder; import org.springframework.security.web.SecurityFilterChain; import static org.springframework.boot.autoconfigure.security.servlet.PathRequest.toH2Console; &#64;Configuration public class SecurityConfig { private final UserDetailService userService; &#64;Autowired public SecurityConfig(UserDetailService userService){ this.userService &#61; userService; } &#64;Bean public WebSecurityCustomizer configure(){ return (web) -> web.ignoring() .requestMatchers(toH2Console()) .requestMatchers(&#34;/static/**&#34;); } &#64;Bean public SecurityFilterChain filterChain(HttpSecurity http) throws Exception { http.authorizeHttpRequests((authorize)-> authorize .requestMatchers(&#34;/login&#34;, &#34;/signup&#34;, &#34;/user&#34;).permitAll() .anyRequest().authenticated() ); http.formLogin((formLogin)-> formLogin .loginPage(&#34;/login&#34;) .defaultSuccessUrl(&#34;/&#34;) ); http.logout((logout)-> logout .logoutUrl(&#34;/logout&#34;) .logoutSuccessUrl(&#34;/&#34;) .invalidateHttpSession(true) ); http.csrf((csrf)-> csrf.disable() ); return http.build(); } &#64;Bean public AuthenticationManager authenticationManager(HttpSecurity http, BCryptPasswordEncoder bCryptPasswordEncoder, UserDetailService userDetailService) throws Exception { return http.getSharedObject(AuthenticationManagerBuilder.class) .userDetailsService(userService) .passwordEncoder(bCryptPasswordEncoder) .and() .build(); } }

charlatan · Answer

AuthenticationManager 가 빈으로 등록되면 디폴트를 오버라이드할 것 같은데... 등록한 authenticationManager가 적용되는지 확인해보면 될 것 같습니다.

xxrcn11 · Answer

다음 코드를 참고하시면 될 듯 합니다. import com.baeldung.jwtsignkey.jwtconfig.AuthEntryPointJwt; import com.baeldung.jwtsignkey.jwtconfig.AuthTokenFilter; import org.springframework.beans.factory.annotation.Autowired; import org.springframework.boot.autoconfigure.security.servlet.PathRequest; import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Configuration; import org.springframework.security.authentication.AuthenticationManager; import org.springframework.security.authentication.dao.DaoAuthenticationProvider; import org.springframework.security.config.annotation.authentication.configuration.AuthenticationConfiguration; import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity; import org.springframework.security.config.annotation.web.builders.HttpSecurity; import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity; import org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer; import org.springframework.security.core.userdetails.UserDetailsService; import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder; import org.springframework.security.crypto.password.PasswordEncoder; import org.springframework.security.web.SecurityFilterChain; import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter; import org.springframework.security.web.servlet.util.matcher.MvcRequestMatcher; import org.springframework.web.servlet.handler.HandlerMappingIntrospector; import static org.springframework.security.config.http.SessionCreationPolicy.STATELESS; &#64;Configuration &#64;EnableWebSecurity &#64;EnableMethodSecurity public class SecurityConfiguration { &#64;Autowired UserDetailsService userDetailsService; &#64;Autowired private AuthEntryPointJwt unauthorizedHandler; private static final String[] WHITE_LIST_URL &#61; { &#34;/h2-console/**&#34;, &#34;/signin&#34;, &#34;/signup&#34;, &#34;/user-dashboard&#34; }; &#64;Bean public AuthTokenFilter authenticationJwtTokenFilter() { return new AuthTokenFilter(); } &#64;Bean public DaoAuthenticationProvider authenticationProvider() { DaoAuthenticationProvider authProvider &#61; new DaoAuthenticationProvider(); authProvider.setUserDetailsService(userDetailsService); authProvider.setPasswordEncoder(passwordEncoder()); return authProvider; } &#64;Bean public PasswordEncoder passwordEncoder() { return new BCryptPasswordEncoder(); } &#64;Bean public AuthenticationManager authenticationManager(AuthenticationConfiguration authConfig) throws Exception { return authConfig.getAuthenticationManager(); } &#64;Bean public SecurityFilterChain securityFilterChain(HttpSecurity http, HandlerMappingIntrospector introspector) throws Exception { http.csrf(AbstractHttpConfigurer::disable) .cors(AbstractHttpConfigurer::disable) .authorizeHttpRequests(req -> req.requestMatchers(WHITE_LIST_URL) .permitAll() .anyRequest() .authenticated()) .exceptionHandling(ex -> ex.authenticationEntryPoint(unauthorizedHandler)) .sessionManagement(session -> session.sessionCreationPolicy(STATELESS)) .authenticationProvider(authenticationProvider()) .addFilterBefore(authenticationJwtTokenFilter(), UsernamePasswordAuthenticationFilter.class); return http.build(); } }

spring security 6 인증 관리자 설정

2개의 답변

Q&A 목록