Spring Boot Security API中JWT Token角色为空的问题求助

问题根源 #

你的自定义User实体类未实现Spring Security的UserDetails接口，且未正确将用户关联的Role转换为GrantedAuthority集合，导致认证后的Authentication对象中权限集合为空，最终生成的JWT里roles字段是空数组。

解决方案 #

1. 修改自定义User类，实现UserDetails接口 #

让你的User实体类实现UserDetails，并重写getAuthorities方法将Role转换为Spring Security可识别的权限对象：

@Entity
@Data
public class User implements UserDetails {

    @Id
    @GeneratedValue(strategy = GenerationType.AUTO)
    private long id;
    private String username;
    private String password;
    @ManyToMany(fetch = FetchType.EAGER)
    private Collection<Role> roles = new ArrayList<>();

    @Override
    public Collection<? extends GrantedAuthority> getAuthorities() {
        // 将Role转换为SimpleGrantedAuthority
        return roles.stream()
                .map(role -> new SimpleGrantedAuthority(role.getName()))
                .collect(Collectors.toList());
    }

    @Override
    public boolean isAccountNonExpired() {
        return true; // 根据业务需求调整
    }

    @Override
    public boolean isAccountNonLocked() {
        return true;
    }

    @Override
    public boolean isCredentialsNonExpired() {
        return true;
    }

    @Override
    public boolean isEnabled() {
        return true;
    }
}

2. 确保UserDetailsService返回正确的User对象 #

检查你的UserDetailsService实现，确保从数据库查询到自定义User后直接返回（因为已经实现了UserDetails）：

@Service
public class CustomUserDetailsService implements UserDetailsService {

    @Autowired
    private UserRepository userRepository;

    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        User user = userRepository.findByUsername(username)
                .orElseThrow(() -> new UsernameNotFoundException("用户不存在: " + username));
        return user;
    }
}

3. 调整JwtTokenProvider中的生成逻辑 #

修改generateToken(Authentication authentication)方法，直接从UserDetails中获取权限，避免类型转换错误：

public String generateToken(Authentication authentication){
    UserDetails userDetails = (UserDetails) authentication.getPrincipal();
    return generateToken(userDetails.getUsername(), userDetails.getAuthorities().stream()
            .map(GrantedAuthority::getAuthority)
            .collect(Collectors.toList()));
}

验证 #

重新启动服务，获取新的JWT Token后在线解析，roles字段将包含用户实际拥有的角色列表。

内容的提问来源于stack exchange，提问作者ayeshchanaka