Spring Boot配置UserDetailsChecker用于认证前后检查的最佳实践及疑问

Great question! Let's walk through the best practices for configuring preAuthenticationChecks and postAuthenticationChecks in Spring Boot, plus clarify your key doubts.

First, a quick recap: preAuthenticationChecks runs before validating credentials (to check things like account lock status, expiration, or disabled flags), while postAuthenticationChecks runs after successful credential validation (typically to check if a password is expired).

Option 1: Inject Custom UserDetailsChecker into Default DaoAuthenticationProvider #

This is the most straightforward approach—you don't need to create a full custom DaoAuthenticationProvider. Instead, you can instantiate the default provider, attach your custom checkers, and register it via AuthenticationManagerBuilder.

Step 1: Create Your Custom Checker #

First, implement UserDetailsChecker for your pre or post authentication logic:

@Component
public class CustomPreAuthChecker implements UserDetailsChecker {
    @Override
    public void check(UserDetails user) {
        // Add your custom pre-auth checks first
        if (user.getAuthorities().isEmpty()) {
            throw new InsufficientAuthenticationException("User has no assigned roles");
        }
        // Optional: Keep default checks (like account non-disabled, non-expired)
        new DefaultPreAuthenticationChecks().check(user);
    }
}

// Similarly for post-auth checks
@Component
public class CustomPostAuthChecker implements UserDetailsChecker {
    @Override
    public void check(UserDetails user) {
        // Custom post-auth logic
        if (isPasswordExpired(user)) {
            throw new CredentialsExpiredException("Your password needs to be updated");
        }
        // Optional: Keep default post-checks
        new DefaultPostAuthenticationChecks().check(user);
    }

    private boolean isPasswordExpired(UserDetails user) {
        // Implement your password expiration check logic here
        return false;
    }
}

Step 2: Register the Provider in Your Security Config #

Use AuthenticationManagerBuilder within your WebSecurityConfigurerAdapter to set up the provider with your custom checkers:

@Configuration
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    private final CustomPreAuthChecker customPreAuthChecker;
    private final CustomPostAuthChecker customPostAuthChecker;
    private final UserDetailsService userDetailsService;
    private final PasswordEncoder passwordEncoder;

    // Constructor injection (preferred over @Autowired)
    public SecurityConfig(CustomPreAuthChecker customPreAuthChecker,
                          CustomPostAuthChecker customPostAuthChecker,
                          UserDetailsService userDetailsService,
                          PasswordEncoder passwordEncoder) {
        this.customPreAuthChecker = customPreAuthChecker;
        this.customPostAuthChecker = customPostAuthChecker;
        this.userDetailsService = userDetailsService;
        this.passwordEncoder = passwordEncoder;
    }

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        // Instantiate the default DaoAuthenticationProvider
        DaoAuthenticationProvider authProvider = new DaoAuthenticationProvider();
        authProvider.setUserDetailsService(userDetailsService);
        authProvider.setPasswordEncoder(passwordEncoder);
        
        // Attach your custom checkers
        authProvider.setPreAuthenticationChecks(customPreAuthChecker);
        authProvider.setPostAuthenticationChecks(customPostAuthChecker);
        
        // Register the provider with the authentication manager
        auth.authenticationProvider(authProvider);
    }
}

Option 2: Extend DaoAuthenticationProvider for Advanced Customization #

If you need to override more core logic (like how users are retrieved, or extra credential checks), you can extend DaoAuthenticationProvider directly:

public class CustomDaoAuthProvider extends DaoAuthenticationProvider {

    @Override
    protected void additionalAuthenticationChecks(UserDetails userDetails,
                                                  UsernamePasswordAuthenticationToken authentication) throws AuthenticationException {
        // Run default credential checks first
        super.additionalAuthenticationChecks(userDetails, authentication);
        // Add your custom post-auth logic here
        if (isUserRequiredToResetPassword(userDetails)) {
            throw new CredentialsExpiredException("Please reset your password to continue");
        }
    }

    @Override
    protected UserDetails retrieveUser(String username,
                                       UsernamePasswordAuthenticationToken authentication) throws AuthenticationException {
        UserDetails user = super.retrieveUser(username, authentication);
        // Attach custom pre-auth checker (or add checks directly here)
        this.setPreAuthenticationChecks(new CustomPreAuthChecker());
        return user;
    }

    private boolean isUserRequiredToResetPassword(UserDetails userDetails) {
        // Your custom logic here
        return false;
    }
}

Then register this custom provider in your security config:

@Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
    CustomDaoAuthProvider customProvider = new CustomDaoAuthProvider();
    customProvider.setUserDetailsService(userDetailsService);
    customProvider.setPasswordEncoder(passwordEncoder);
    auth.authenticationProvider(customProvider);
}

Key Answers to Your Questions #

1. Do I Have to Create a Custom DaoAuthenticationProvider? #

No! You don't need to create a custom provider unless you need to override core methods (like retrieveUser or additionalAuthenticationChecks). The first option above shows you can use the default DaoAuthenticationProvider and just swap out the UserDetailsChecker instances.

2. Can I Configure This via WebSecurityConfigurerAdapter/AuthenticationManagerBuilder? #

Absolutely! As shown in the examples, the configure(AuthenticationManagerBuilder auth) method inside WebSecurityConfigurerAdapter is exactly where you set up these customizations. You don't need any external configuration—all setup happens within your security config class.

内容的提问来源于stack exchange，提问作者bgraves