Spring Security多登录表单配置：分表凭据的差异化查询实现

Hey there! This is a super common scenario when dealing with role-separated authentication in Spring Security, and you’re already on the right track with leveraging multiple <http> elements. Let’s break down exactly how to make this work for your admin and regular user tables:

Each <http> block will handle authentication for a specific user type, using request-matcher to target their respective URL paths. The order property ensures Spring Security processes more specific paths first (lower numbers = higher priority).

<!-- Admin authentication flow - higher priority (order=1) -->
<http pattern="/admin/**" auto-config="false" use-expressions="true" order="1">
    <!-- Allow unauthenticated access to admin login page -->
    <intercept-url pattern="/admin/login" access="permitAll()" />
    <!-- Restrict all other admin paths to users with ADMIN role -->
    <intercept-url pattern="/admin/**" access="hasRole('ADMIN')" />
    
    <!-- Admin login configuration -->
    <form-login 
        login-page="/admin/login" 
        login-processing-url="/admin/login" 
        default-target-url="/admin/dashboard"
        authentication-failure-url="/admin/login?error=true"
        username-parameter="adminUsername" <!-- Match your login form's username input name -->
        password-parameter="adminPassword" <!-- Match your login form's password input name -->
    />
    
    <!-- Admin logout configuration -->
    <logout 
        logout-url="/admin/logout" 
        logout-success-url="/admin/login?logout=true"
    />
    
    <!-- Admin-specific authentication manager -->
    <authentication-manager>
        <authentication-provider user-service-ref="adminUserDetailsService">
            <password-encoder ref="passwordEncoder" />
        </authentication-provider>
    </authentication-manager>
</http>

<!-- Regular user authentication flow - lower priority (order=2) -->
<http pattern="/user/**" auto-config="false" use-expressions="true" order="2">
    <intercept-url pattern="/user/login" access="permitAll()" />
    <intercept-url pattern="/user/**" access="hasRole('USER')" />
    
    <form-login 
        login-page="/user/login" 
        login-processing-url="/user/login" 
        default-target-url="/user/dashboard"
        authentication-failure-url="/user/login?error=true"
        username-parameter="userUsername"
        password-parameter="userPassword"
    />
    
    <logout 
        logout-url="/user/logout" 
        logout-success-url="/user/login?logout=true"
    />
    
    <!-- Regular user-specific authentication manager -->
    <authentication-manager>
        <authentication-provider user-service-ref="regularUserDetailsService">
            <password-encoder ref="passwordEncoder" />
        </authentication-provider>
    </authentication-manager>
</http>

<!-- Optional: Default block for unhandled paths (deny all access) -->
<http auto-config="false" use-expressions="true" order="3">
    <intercept-url pattern="/**" access="denyAll()" />
</http>

<!-- Shared password encoder (use same encoder for both tables if passwords are stored identically) -->
<beans:bean id="passwordEncoder" class="org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder" />

<!-- Register your custom UserDetailsService beans -->
<beans:bean id="adminUserDetailsService" class="com.yourpackage.AdminUserDetailsService" />
<beans:bean id="regularUserDetailsService" class="com.yourpackage.RegularUserDetailsService" />

These classes will handle fetching user credentials from their respective database tables.

Admin User Details Service #

package com.yourpackage;

import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.core.userdetails.UsernameNotFoundException;
import org.springframework.stereotype.Service;

import javax.persistence.EntityManager;
import javax.persistence.PersistenceContext;
import javax.persistence.Query;

@Service
public class AdminUserDetailsService implements UserDetailsService {

    @PersistenceContext
    private EntityManager entityManager;

    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        // Adjust query to match your admin table structure
        Query query = entityManager.createQuery("SELECT a FROM Admin a WHERE a.username = :username");
        query.setParameter("username", username);
        
        Admin admin = (Admin) query.getSingleResult();
        
        if (admin == null) {
            throw new UsernameNotFoundException("Admin user not found: " + username);
        }

        // Return UserDetails with ADMIN role
        return User.withUsername(admin.getUsername())
                .password(admin.getPassword())
                .roles("ADMIN")
                .build();
    }
}

Regular User Details Service #

package com.yourpackage;

import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.core.userdetails.UsernameNotFoundException;
import org.springframework.stereotype.Service;

import javax.persistence.EntityManager;
import javax.persistence.PersistenceContext;
import javax.persistence.Query;

@Service
public class RegularUserDetailsService implements UserDetailsService {

    @PersistenceContext
    private EntityManager entityManager;

    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        // Adjust query to match your regular user table structure
        Query query = entityManager.createQuery("SELECT u FROM RegularUser u WHERE u.username = :username");
        query.setParameter("username", username);
        
        RegularUser user = (RegularUser) query.getSingleResult();
        
        if (user == null) {
            throw new UsernameNotFoundException("Regular user not found: " + username);
        }

        // Return UserDetails with USER role
        return User.withUsername(user.getUsername())
                .password(user.getPassword())
                .roles("USER")
                .build();
    }
}

• Table Structure: Adjust the JPQL queries and entity classes (Admin, RegularUser) to match your actual database table schemas.
• Password Encoding: Ensure passwords in both tables are encrypted using the same PasswordEncoder (or use separate encoders if your tables use different hashing algorithms).
• Form Parameters: Double-check that username-parameter and password-parameter match the name attributes in your login page forms.
• Order Priority: Always set smaller order values for more specific URL patterns (like /admin/**) so they’re processed before broader patterns.

内容的提问来源于stack exchange，提问作者Prasad Parab