- Spring Security(Third Edition)
- Mick Knutson Robert Winch Peter Mularien
- 127字
- 2025-04-04 17:54:29
Making Spring Security aware of the PasswordEncoder method
We'll need to configure Spring Security to have a reference to PasswordEncoder, so that it can encode and compare the presented password during user login. Simply add a passwordEncoder method and refer to the bean ID we defined in the previous step:
//src/main/java/com/packtpub/springsecurity/configuration/SecurityConfig.java
@Override
public void configure(AuthenticationManagerBuilder auth)
throws Exception {
auth
.jdbcAuthentication()
.dataSource(dataSource)
.usersByUsernameQuery(CUSTOM_USERS_BY_USERNAME_QUERY)
.authoritiesByUsernameQuery(
CUSTOM_AUTHORITIES_BY_USERNAME_QUERY)
.passwordEncoder(passwordEncoder())
;
}
If you were to try the application at this point, you'd notice that what were previously valid login credentials would now be rejected. This is because the passwords stored in the database (loaded with the calendar-users.sql script) are not stored as a hash that matches the password encoder. We'll need to update the stored passwords to be hashed values.