添加@EnableWebSecurity与InMemoryUserDetailsManager仍生成默认User问题

开发基于自定义User和Admin凭据做身份认证的应用时，使用自定义凭据登录会返回unauthorized异常，仅能通过系统自动生成的默认user账号及随机密码登录。

SecurityConfig.java #

import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;

@Configuration
@EnableWebSecurity
public class SecurityConfig {

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http.authorizeHttpRequests(requests -> requests.anyRequest().authenticated())
                .formLogin(withDefaults())
                .httpBasic(withDefaults());

        return http.build();
    }

    @Bean
    public InMemoryUserDetailsManager userDetailsService() {
        System.out.println("--------------------------------In UserDetailsService");
        UserDetails user = User.withUsername("user")
                .password("{noop}password")
                .roles("USER")
                .build();

        UserDetails admin = User.withUsername("admin")
                .password("{noop}password")
                .roles("USER", "ADMIN")
                .build();

        return new InMemoryUserDetailsManager(user, admin);
    }
}

ApiGatewayApplication.java #

@SpringBootApplication
public class ApiGatewayApplication {

    public static void main(String[] args) {
        SpringApplication.run(ApiGatewayApplication.class, args);
    }
}

application.properties #

spring.application.name=ApiGateway
server.port=8083
spring.main.allow-bean-definition-overriding=true
logging.level.org.springframework.security=DEBUG

spring.cloud.gateway.routes[0].id=QuestionService
spring.cloud.gateway.routes[0].uri=lb://QuestionService
spring.cloud.gateway.routes[0].predicates[0]=Path=/question/**

spring.cloud.gateway.routes[1].id=QuizService
spring.cloud.gateway.routes[1].uri=lb://QuizService
spring.cloud.gateway.routes[1].predicates[0]=Path=/quiz/**, /quiz-test/**

pom.xml #

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>
    <parent>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-parent</artifactId>
        <version>3.3.4</version>
        <relativePath/> <!-- lookup parent from repository -->
    </parent>
    <groupId>com.gateway</groupId>
    <artifactId>ApiGateway</artifactId>
    <version>0.0.1-SNAPSHOT</version>
    <name>ApiGateway</name>
    <description>This is a API Gateway Server</description>
    <url/>
    <licenses>
        <license/>
    </licenses>
    <developers>
        <developer/>
    </developers>
    <scm>
        <connection/>
        <developerConnection/>
        <tag/>
        <url/>
    </scm>
    <properties>
        <java.version>23</java.version>
        <spring-cloud.version>2023.0.3</spring-cloud.version>
    </properties>
    <dependencies>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-actuator</artifactId>
        </dependency>
        <dependency>
            <groupId>org.springframework.cloud</groupId>
            <artifactId>spring-cloud-starter-gateway</artifactId>
        </dependency>
        <dependency>
            <groupId>org.springframework.cloud</groupId>
            <artifactId>spring-cloud-starter-netflix-eureka-client</artifactId>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-security</artifactId>
        </dependency>
        <dependency>
            <groupId>org.springframework.security</groupId>
            <artifactId>spring-security-test</artifactId>
            <scope>test</scope>
        </dependency>
        <dependency>
            <groupId>jakarta.servlet</groupId>
            <artifactId>jakarta.servlet-api</artifactId>
            <version>5.0.0</version>
        </dependency>

        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-test</artifactId>
            <scope>test</scope>
        </dependency>
    </dependencies>
    <dependencyManagement>
        <dependencies>
            <dependency>
                <groupId>org.springframework.cloud</groupId>
                <artifactId>spring-cloud-dependencies</artifactId>
                <version>${spring-cloud.version}</version>
                <type>pom</type>
                <scope>import</scope>
            </dependency>
        </dependencies>
    </dependencyManagement>

    <build>
        <plugins>
            <plugin>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-maven-plugin</artifactId>
            </plugin>
        </plugins>
    </build>

</project>

API Gateway 日志 #

2024-10-10T15:00:11.167-04:00  INFO 21580 --- [ApiGateway] [           main] ctiveUserDetailsServiceAutoConfiguration : 

Using generated security password: da26512d-fcb0-49c0-a8e3-5814686ed7a5

从日志可见，Spring Security仍在使用自动生成的凭据，说明自定义的InMemoryUserDetailsManager Bean未被正确加载，可通过以下方式修复：

• 避免Bean命名冲突：将自定义Bean方法名从userDetailsService改为customUserDetailsService，防止与Spring自动配置的Bean重名：

@Bean
public InMemoryUserDetailsManager customUserDetailsService() {
    // 原有代码保持不变
}

• 禁用自动配置的用户服务：在ApiGatewayApplication上添加注解，阻止Spring生成默认用户：

@SpringBootApplication
@EnableAutoConfiguration(exclude = {UserDetailsServiceAutoConfiguration.class})
public class ApiGatewayApplication {
    // 原有代码保持不变
}

• 显式配置密码编码器：虽然使用了{noop}前缀标记明文密码，仍可显式配置编码器确保兼容性：

@Bean
public PasswordEncoder passwordEncoder() {
    return NoOpPasswordEncoder.getInstance();
}

完成调整后重启应用，自定义的user和admin凭据即可正常登录。

内容的提问来源于stack exchange，提问作者Masum