Как реализовать в Spring Security роли унаследованные от класса User?
Всем привет! Пишу проект, необходима помощь, так как не нашёл на просторах ответа...
Есть класс User. У него есть наследники Customer и Seller.
Дело в том, что не могу понять, как настроить модели и SecurityConfig так, чтобы Spring при авторизации Customer'a или Seller'a, определял, что логинится Customer или Seller.
User.class
import lombok.Data;
import lombok.NoArgsConstructor;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.userdetails.UserDetails;
import javax.persistence.*;
import javax.validation.constraints.Email;
import java.util.Collection;
import java.util.Set;
@Entity
@Data
@NoArgsConstructor
@Inheritance(strategy = InheritanceType.JOINED)
@Table
public class User implements UserDetails {
@Id
@GeneratedValue(strategy = GenerationType.SEQUENCE)
private Long id;
private String login;
private String password;
@Email
private String email;
@ManyToMany(fetch = FetchType.EAGER)
@JoinTable(name = "users_roles",
joinColumns = @JoinColumn(name = "user_id"),
inverseJoinColumns = @JoinColumn(name = "role_id"))
private Set<Role> roles;
@Override
public Collection<? extends GrantedAuthority> getAuthorities() {
return roles;
}
@Override
public String getPassword() {
return password;
}
@Override
public String getUsername() {
return login;
}
@Override
public boolean isAccountNonExpired() {
return true;
}
@Override
public boolean isAccountNonLocked() {
return true;
}
@Override
public boolean isCredentialsNonExpired() {
return true;
}
@Override
public boolean isEnabled() {
return true;
}
}
Role.class
import lombok.Data;
import lombok.NoArgsConstructor;
import org.springframework.security.core.GrantedAuthority;
import javax.persistence.*;
@Entity
@NoArgsConstructor
@Data
@Table(name = "roles")
public class Role implements GrantedAuthority {
@Id
@GeneratedValue(strategy = GenerationType.SEQUENCE)
private Long id;
private String name;
@Override
public String getAuthority() {
return name;
}
}
Customer.class
import com.jm.spare_parts_shop.model.auto.Car;
import lombok.*;
import javax.persistence.*;
import java.util.Set;
@Entity
@Getter
@Setter
@NoArgsConstructor
@AllArgsConstructor
@Table
public class Customer extends User {
@Id
@GeneratedValue(strategy = GenerationType.SEQUENCE)
private Long id;
@ManyToMany(fetch = FetchType.EAGER)
@JoinTable(name = "customers_cars",
joinColumns = @JoinColumn(name = "customer_id"),
inverseJoinColumns = @JoinColumn(name = "car_id"))
private Set<Car> carSet;
}
Seller.class
import lombok.Getter;
import lombok.NoArgsConstructor;
import lombok.Setter;
import javax.persistence.*;
import java.util.Set;
@Entity
@NoArgsConstructor
@Getter
@Setter
@Table
public class Seller extends User {
@Id
private Long id;
private String name;
@ManyToMany(fetch = FetchType.EAGER)
@JoinTable(name = "sellers_suppliers",
joinColumns = @JoinColumn(name = "seller_id"),
inverseJoinColumns = @JoinColumn(name = "supplier_id"))
private Set<Supplier> sellerSet;
}
SecurityConfig.class
@Override
protected void configure(HttpSecurity http) throws Exception {
http
.csrf().disable()
.requestCache().requestCache(new CustomRequestCache())
.and()
.authorizeRequests()
.requestMatchers(SecurityUtils::isFrameworkInternalRequest).permitAll()
.antMatchers("/registration/**").not().fullyAuthenticated()
.antMatchers("/customer/**").hasRole("CUSTOMER")
.antMatchers("/seller/**").hasRole("SELLER")
.antMatchers("/login").permitAll()
.antMatchers("/").permitAll()
.anyRequest()
.authenticated()
.and()
.formLogin()
.loginPage("/login")
.successHandler(new LoginSuccessHandler())
.usernameParameter("login")
.passwordParameter("password")
.permitAll()
.and()
.logout()
.permitAll();
}
Ну и вдруг нужен
LoginSuccessHandler.class
import org.springframework.security.core.Authentication;
import org.springframework.security.core.authority.AuthorityUtils;
import org.springframework.security.web.authentication.AuthenticationSuccessHandler;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
import java.util.Set;
public class LoginSuccessHandler implements AuthenticationSuccessHandler {
@Override
public void onAuthenticationSuccess(HttpServletRequest httpServletRequest,
HttpServletResponse httpServletResponse,
Authentication authentication) throws IOException, ServletException {
Set<String> roles = AuthorityUtils.authorityListToSet(authentication.getAuthorities());
if (roles.contains("ROLE_CUSTOMER")) {
httpServletResponse.sendRedirect("/customer");
} else if (roles.contains("ROLE_SELLER")) {
httpServletResponse.sendRedirect("/seller");
} else {
httpServletResponse.sendRedirect("/registration");
}
}
}