Spring security 4 custom jdbc authentication -
i'm using spring boot, spring mvc 4, spring security 4 , mysql data store new web app , have 2 questions
i've never used spring security before, after seeing it, have question regarding queries used find users' authorities: why use username instead of user id. mean searching authorities based on user id faster , gives ability change username in future. tried overload usersbyusernamequery , authoritiesbyusernamequery use user id didn't work (and if works, name of method bugging me) .. please can explain me why used username?
in previous php web apps worked on, used store salt in db along password if want use bcrypt .. notice not required have column in spring .. salt part of encryption , spring internally knows how use shouldn't worry number of iterations, cost , salt storing?
1) not understand question since if have find authorities of user called "quentin", how know id of "quentin" ?
please have @ query use retrieve user @ logon
<authentication-manager> <authentication-provider> <jdbc-user-service data-source-ref="datasource" users-by-username-query="select username, password, case enabled when 1 'true' else 'false' end 'enabled' users binary username=?" authorities-by-username-query="select username, authority users binary username=?" id="jdbcuserservice" /> <password-encoder ref="passwordencoder" hash="bcrypt" /> </authentication-provider> </authentication-manager> <beans:bean id="passwordencoder" class="org.springframework.security.crypto.bcrypt.bcryptpasswordencoder" />
2) salt saved password. there amazing explanation here on how done
Comments
Post a Comment