Spring Boot认证：如何基于自定义表单参数切换UserDetailService的Repository

Great question! When you need to authenticate users from separate entities (like Salespeople and Customers) with their own repositories, the key is to capture the user type from your login form and route the authentication request to the correct repository. Here are two practical approaches to implement this:

Approach 1: Quick & Simple (Using RequestContextHolder) #

This method is straightforward for smaller projects where you don't need heavy customization. We'll grab the user type directly from the HTTP request within your UserDetailsService.

Step 1: Update Your Login Form #

First, add a user type selection to your form (radio buttons work well here, but a dropdown is also fine):

<form th:action="@{/login}" method="post">
    <div>
        <label>User Name: <input type="text" name="username"/></label>
        <label>Password: <input type="password" name="password"/></label>
        <label>User Type:
            <input type="radio" name="userType" value="sales" checked/> Salesperson
            <input type="radio" name="userType" value="customer"/> Customer
        </label>
    </div>
    <button type="submit">Login</button>
</form>

Step 2: Implement Custom UserDetailsService #

Inject both your repositories, then use RequestContextHolder to fetch the userType parameter and switch repositories accordingly:

@Service
public class CustomUserDetailsService implements UserDetailsService {

    private final SalesPersonRepository salesRepo;
    private final CustomerRepository customerRepo;
    private final PasswordEncoder passwordEncoder;

    // Constructor injection (preferred over @Autowired)
    public CustomUserDetailsService(SalesPersonRepository salesRepo, CustomerRepository customerRepo, PasswordEncoder passwordEncoder) {
        this.salesRepo = salesRepo;
        this.customerRepo = customerRepo;
        this.passwordEncoder = passwordEncoder;
    }

    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        // Grab the current HTTP request to get the userType parameter
        HttpServletRequest request = ((ServletRequestAttributes) RequestContextHolder.currentRequestAttributes()).getRequest();
        String userType = request.getParameter("userType");

        if (userType == null || userType.isBlank()) {
            throw new BadCredentialsException("User type is required");
        }

        return switch (userType.toLowerCase()) {
            case "sales" -> buildUserDetails(
                salesRepo.findByUsername(username)
                    .orElseThrow(() -> new UsernameNotFoundException("Salesperson not found: " + username)),
                "ROLE_SALES"
            );
            case "customer" -> buildUserDetails(
                customerRepo.findByUsername(username)
                    .orElseThrow(() -> new UsernameNotFoundException("Customer not found: " + username)),
                "ROLE_CUSTOMER"
            );
            default -> throw new BadCredentialsException("Invalid user type: " + userType);
        };
    }

    // Helper method to convert your entity to Spring's UserDetails
    private UserDetails buildUserDetails(Object userEntity, String role) {
        String username = "";
        String password = "";

        // Extract credentials based on entity type
        if (userEntity instanceof SalesPerson salesPerson) {
            username = salesPerson.getUsername();
            password = salesPerson.getPassword();
        } else if (userEntity instanceof Customer customer) {
            username = customer.getUsername();
            password = customer.getPassword();
        }

        // Ensure passwords are encoded (your repo should store BCrypt hashes!)
        return User.withUsername(username)
            .password(password)
            .roles(role)
            .build();
    }
}

Step 3: Configure Spring Security #

Set up your security filter chain to use your custom service, password encoder, and role-based access control:

@Configuration
@EnableWebSecurity
public class SecurityConfig {

    private final CustomUserDetailsService userDetailsService;

    public SecurityConfig(CustomUserDetailsService userDetailsService) {
        this.userDetailsService = userDetailsService;
    }

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
            .authorizeHttpRequests(auth -> auth
                .requestMatchers("/login").permitAll()
                .requestMatchers("/sales/**").hasRole("SALES") // Sales-only routes
                .requestMatchers("/customer/**").hasRole("CUSTOMER") // Customer-only routes
                .anyRequest().authenticated()
            )
            .formLogin(form -> form
                .loginPage("/login") // Use your custom login page path
                .loginProcessingUrl("/login")
                .defaultSuccessUrl("/dashboard", true)
                .failureUrl("/login?error=true")
            )
            .logout(logout -> logout.permitAll());

        return http.build();
    }

    @Bean
    public AuthenticationProvider authenticationProvider() {
        DaoAuthenticationProvider provider = new DaoAuthenticationProvider();
        provider.setUserDetailsService(userDetailsService);
        provider.setPasswordEncoder(passwordEncoder());
        return provider;
    }

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder(); // Always use strong password encoding!
    }
}

Approach 2: Clean & Scalable (Custom Authentication Token/Filter) #

For larger projects or if you want to follow Spring Security's architecture more closely, create a custom authentication flow to pass the user type directly to your authentication provider (no reliance on RequestContextHolder).

Step 1: Custom Authentication Token #

Extend UsernamePasswordAuthenticationToken to include the user type:

public class CustomAuthToken extends UsernamePasswordAuthenticationToken {

    private final String userType;

    public CustomAuthToken(String username, String password, String userType) {
        super(username, password);
        this.userType = userType;
    }

    public CustomAuthToken(Object principal, Object credentials, Collection<? extends GrantedAuthority> authorities, String userType) {
        super(principal, credentials, authorities);
        this.userType = userType;
    }

    public String getUserType() {
        return userType;
    }
}

Step 2: Custom Authentication Filter #

Override the default filter to parse the user type and create your custom token:

public class CustomAuthFilter extends UsernamePasswordAuthenticationFilter {

    @Override
    public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response) throws AuthenticationException {
        String username = obtainUsername(request).trim();
        String password = obtainPassword(request);
        String userType = request.getParameter("userType");

        if (userType == null || userType.isBlank()) {
            throw new BadCredentialsException("User type is required");
        }

        CustomAuthToken authRequest = new CustomAuthToken(username, password, userType);
        setDetails(request, authRequest);

        return getAuthenticationManager().authenticate(authRequest);
    }
}

Step 3: Custom Authentication Provider #

Implement AuthenticationProvider to handle your custom token and route to the correct repository:

@Component
public class CustomAuthProvider implements AuthenticationProvider {

    private final SalesPersonRepository salesRepo;
    private final CustomerRepository customerRepo;
    private final PasswordEncoder passwordEncoder;

    public CustomAuthProvider(SalesPersonRepository salesRepo, CustomerRepository customerRepo, PasswordEncoder passwordEncoder) {
        this.salesRepo = salesRepo;
        this.customerRepo = customerRepo;
        this.passwordEncoder = passwordEncoder;
    }

    @Override
    public Authentication authenticate(Authentication authentication) throws AuthenticationException {
        CustomAuthToken authToken = (CustomAuthToken) authentication;
        String username = authToken.getName();
        String password = (String) authToken.getCredentials();
        String userType = authToken.getUserType();

        UserDetails userDetails;
        switch (userType.toLowerCase()) {
            case "sales":
                SalesPerson salesPerson = salesRepo.findByUsername(username)
                    .orElseThrow(() -> new UsernameNotFoundException("Salesperson not found"));
                if (!passwordEncoder.matches(password, salesPerson.getPassword())) {
                    throw new BadCredentialsException("Invalid password");
                }
                userDetails = buildUserDetails(salesPerson, "ROLE_SALES");
                break;
            case "customer":
                Customer customer = customerRepo.findByUsername(username)
                    .orElseThrow(() -> new UsernameNotFoundException("Customer not found"));
                if (!passwordEncoder.matches(password, customer.getPassword())) {
                    throw new BadCredentialsException("Invalid password");
                }
                userDetails = buildUserDetails(customer, "ROLE_CUSTOMER");
                break;
            default:
                throw new BadCredentialsException("Invalid user type");
        }

        return new CustomAuthToken(userDetails.getUsername(), null, userDetails.getAuthorities(), userType);
    }

    @Override
    public boolean supports(Class<?> authentication) {
        return CustomAuthToken.class.isAssignableFrom(authentication);
    }

    private UserDetails buildUserDetails(Object userEntity, String role) {
        // Same helper method as Approach 1
        String username = "";
        String password = "";

        if (userEntity instanceof SalesPerson salesPerson) {
            username = salesPerson.getUsername();
            password = salesPerson.getPassword();
        } else if (userEntity instanceof Customer customer) {
            username = customer.getUsername();
            password = customer.getPassword();
        }

        return User.withUsername(username)
            .password(password)
            .roles(role)
            .build();
    }
}

Step 4: Update Security Config #

Replace the default filter and register your custom provider:

@Configuration
@EnableWebSecurity
public class SecurityConfig {

    private final CustomAuthProvider customAuthProvider;

    public SecurityConfig(CustomAuthProvider customAuthProvider) {
        this.customAuthProvider = customAuthProvider;
    }

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        // Replace default filter with our custom one
        http.addFilterAt(customAuthFilter(), UsernamePasswordAuthenticationFilter.class);

        http
            .authorizeHttpRequests(auth -> auth
                .requestMatchers("/login").permitAll()
                .requestMatchers("/sales/**").hasRole("SALES")
                .requestMatchers("/customer/**").hasRole("CUSTOMER")
                .anyRequest().authenticated()
            )
            .formLogin(form -> form
                .loginPage("/login")
                .loginProcessingUrl("/login")
                .defaultSuccessUrl("/dashboard", true)
                .failureUrl("/login?error=true")
            )
            .logout(logout -> logout.permitAll())
            .authenticationProvider(customAuthProvider);

        return http.build();
    }

    @Bean
    public CustomAuthFilter customAuthFilter() throws Exception {
        CustomAuthFilter filter = new CustomAuthFilter();
        filter.setAuthenticationManager(authenticationManagerBean());
        filter.setAuthenticationSuccessHandler(new SavedRequestAwareAuthenticationSuccessHandler());
        filter.setAuthenticationFailureHandler(new SimpleUrlAuthenticationFailureHandler("/login?error=true"));
        return filter;
    }

    @Bean
    @Override
    public AuthenticationManager authenticationManagerBean() throws Exception {
        return super.authenticationManagerBean();
    }

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }
}

Key Notes #

• Password Encoding: Never store plain-text passwords! Ensure your repositories store BCrypt (or similar) hashed passwords, and use PasswordEncoder to validate them.
• Frontend Validation: Add client-side checks to ensure the user selects a user type before submitting the form to avoid unnecessary backend errors.
• Role-Based Access: Use hasRole() or hasAuthority() to restrict routes to specific user types as shown in the config examples.

内容的提问来源于stack exchange，提问作者Roberto Petrilli