基于用户从数据库多角色中选择的角色实现Spring Security登录

Got it, let's walk through how to build this role-selection authentication flow with Spring Security. The core idea is to let users pick one of their assigned roles at login, then lock the app's permissions to that role for the entire session. Here's a step-by-step implementation:

First, you'll need tables to track users, roles, and which roles each user is assigned to. Here's a typical schema:

-- Users table
CREATE TABLE users (
    id BIGINT PRIMARY KEY AUTO_INCREMENT,
    username VARCHAR(50) NOT NULL UNIQUE,
    password VARCHAR(255) NOT NULL,
    enabled BOOLEAN NOT NULL DEFAULT TRUE
);

-- Roles table
CREATE TABLE roles (
    id BIGINT PRIMARY KEY AUTO_INCREMENT,
    name VARCHAR(50) NOT NULL UNIQUE -- e.g., 'ROLE_ADMIN', 'ROLE_USER'
);

-- User-Role association (many-to-many)
CREATE TABLE user_roles (
    user_id BIGINT NOT NULL,
    role_id BIGINT NOT NULL,
    PRIMARY KEY (user_id, role_id),
    FOREIGN KEY (user_id) REFERENCES users(id),
    FOREIGN KEY (role_id) REFERENCES roles(id)
);

Map these tables to JPA entities, then create repositories to fetch user roles:

User Entity #

@Entity
@Table(name = "users")
public class User {
    @Id
    @GeneratedValue(strategy = GenerationType.IDENTITY)
    private Long id;
    private String username;
    private String password;
    private boolean enabled;

    @ManyToMany(fetch = FetchType.EAGER)
    @JoinTable(
        name = "user_roles",
        joinColumns = @JoinColumn(name = "user_id"),
        inverseJoinColumns = @JoinColumn(name = "role_id")
    )
    private Set<Role> roles;

    // Getters and setters
}

Role Entity #

@Entity
@Table(name = "roles")
public class Role {
    @Id
    @GeneratedValue(strategy = GenerationType.IDENTITY)
    private Long id;
    private String name;

    // Getters and setters
}

Repositories #

public interface UserRepository extends JpaRepository<User, Long> {
    Optional<User> findByUsername(String username);
}

public interface RoleRepository extends JpaRepository<Role, Long> {
    Optional<Role> findByName(String name);
}

Update your login form to include a dropdown that loads the user's assigned roles. For example, using Thymeleaf:

<form th:action="@{/login}" method="post">
    <div>
        <label>Username:</label>
        <input type="text" name="username" required>
    </div>
    <div>
        <label>Password:</label>
        <input type="password" name="password" required>
    </div>
    <div>
        <label>Select Role:</label>
        <select name="selectedRole" required>
            <option th:each="role : ${userRoles}" th:value="${role.name}" th:text="${role.name}"></option>
        </select>
    </div>
    <button type="submit">Login</button>
</form>

Note: You'll need a controller endpoint to fetch the user's roles before rendering the login page (or load them via AJAX if using a single-page app). For example:

@GetMapping("/login")
public String showLoginPage(@RequestParam(required = false) String username, Model model) {
    if (username != null) {
        Optional<User> user = userRepository.findByUsername(username);
        user.ifPresent(u -> model.addAttribute("userRoles", u.getRoles()));
    }
    return "login";
}

Spring Security's default authentication only uses username/password, so we need to customize it to account for the selected role. Here's how to do it with a custom AuthenticationProvider:

@Component
public class RoleSelectionAuthenticationProvider implements AuthenticationProvider {

    @Autowired
    private UserRepository userRepository;
    @Autowired
    private PasswordEncoder passwordEncoder;

    @Override
    public Authentication authenticate(Authentication authentication) throws AuthenticationException {
        // Extract credentials and selected role from the authentication request
        String username = authentication.getName();
        String password = authentication.getCredentials().toString();
        String selectedRole = ((WebAuthenticationDetails) authentication.getDetails()).getRequest().getParameter("selectedRole");

        // Fetch user from DB
        User user = userRepository.findByUsername(username)
                .orElseThrow(() -> new UsernameNotFoundException("User not found: " + username));

        // Validate password
        if (!passwordEncoder.matches(password, user.getPassword())) {
            throw new BadCredentialsException("Invalid password");
        }

        // Check if user has the selected role
        boolean hasRole = user.getRoles().stream()
                .anyMatch(role -> role.getName().equals(selectedRole));
        if (!hasRole) {
            throw new AccessDeniedException("User does not have access to role: " + selectedRole);
        }

        // Create authentication token with only the selected role
        List<GrantedAuthority> authorities = Collections.singletonList(new SimpleGrantedAuthority(selectedRole));
        return new UsernamePasswordAuthenticationToken(username, password, authorities);
    }

    @Override
    public boolean supports(Class<?> authentication) {
        return UsernamePasswordAuthenticationToken.class.isAssignableFrom(authentication);
    }
}

Update your security config to use the custom provider and set up role-based access rules:

@Configuration
@EnableWebSecurity
public class SecurityConfig {

    @Autowired
    private RoleSelectionAuthenticationProvider authProvider;

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
            .authorizeHttpRequests(auth -> auth
                .requestMatchers("/login", "/css/**", "/js/**").permitAll()
                .requestMatchers("/admin/**").hasRole("ADMIN")
                .requestMatchers("/user/**").hasRole("USER")
                .anyRequest().authenticated()
            )
            .formLogin(form -> form
                .loginPage("/login")
                .defaultSuccessUrl("/dashboard")
                .permitAll()
            )
            .logout(logout -> logout
                .permitAll()
            )
            .authenticationProvider(authProvider); // Register custom provider

        return http.build();
    }

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }
}

• Role Validation: Always validate that the selected role is actually assigned to the user (we do this in the custom provider) to prevent spoofing.
• Session Consistency: The selected role is tied to the authentication token in the session. If you want users to switch roles without logging out, you'll need an endpoint to update the authentication token with a new selected role.
• Testing: Verify that after selecting Admin, users can access /admin/** but not /user/** (or vice versa, depending on your rules) to ensure the flow works as expected.

内容的提问来源于stack exchange，提问作者RAVINDRA PRATAP SINGH