已创建CustomUserDetailService，Spring Security中如何配置使用？

你得做这几件事，才能让自定义的UserDetailService生效，完成PostgreSQL的用户认证：

1. 让CustomUserDetailService被Spring管理 #

要么给CustomUserDetailService加@Service注解，Spring会自动扫描并创建实例：

import org.springframework.stereotype.Service;

@Service
public class CustomUserDetailService implements UserDetailsService {
    private final UserRepository userRepository;

    public CustomUserDetailService(UserRepository userRepository) {
        this.userRepository = userRepository;
    }

    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        User user = userRepository.findByUsername(username);
        if (user == null) {
            throw new UsernameNotFoundException("用户不存在: " + username);
        }
        return new CustomUserDetails(user);
    }
}

要是不想用@Service，也可以在Configurator里把它注册成Bean：

@Bean
public CustomUserDetailService customUserDetailService(UserRepository userRepository) {
    return new CustomUserDetailService(userRepository);
}

2. 在Configurator里配置认证流程 #

首先得加一个PasswordEncoder的Bean——Spring Security强制要求用密码编码器处理密码，不能明文验证：

@Bean
public PasswordEncoder passwordEncoder() {
    // BCrypt是Spring推荐的哈希算法，安全性高
    return new BCryptPasswordEncoder();
}

然后把CustomUserDetailService和PasswordEncoder注入到Configurator，并关联到SecurityFilterChain里：

@Configuration
@EnableWebSecurity
@EnableMethodSecurity
public class Configurator { // 类名首字母大写更符合Java规范
    private final CustomUserDetailService customUserDetailService;
    private final PasswordEncoder passwordEncoder;

    // 构造注入，Spring会自动匹配Bean
    public Configurator(CustomUserDetailService customUserDetailService, PasswordEncoder passwordEncoder) {
        this.customUserDetailService = customUserDetailService;
        this.passwordEncoder = passwordEncoder;
    }

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
                .csrf().disable()
                .authorizeHttpRequests(auth -> auth.anyRequest().authenticated())
                // 关联自定义的用户服务和密码编码器
                .userDetailsService(customUserDetailService)
                .passwordEncoder(passwordEncoder)
                .httpBasic();
        return http.build();
    }
}

3. 修复CustomUserDetailService的空指针问题 #

原来的代码里，如果查询不到用户直接返回CustomUserDetails会触发空指针，必须抛出UsernameNotFoundException：

@Override
public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
    User user = userRepository.findByUsername(username);
    if (user == null) {
        throw new UsernameNotFoundException("用户不存在: " + username);
    }
    return new CustomUserDetails(user);
}

4. 完善CustomUserDetails的权限方法 #

现在getAuthorities返回null会导致权限校验异常，要是暂时不需要权限，可以返回空集合：

@Override
public Collection<? extends GrantedAuthority> getAuthorities() {
    // 后期可以根据用户角色生成对应的GrantedAuthority
    return Collections.emptyList();
}

最后确认你的User实体类有username和password字段，UserRepository的findByUsername方法能正确从PostgreSQL查询用户（用Spring Data JPA的话，只要方法名符合规范，框架会自动生成SQL）。

内容的提问来源于stack exchange，提问作者xRay