Spring Securityで認証機能を実装する方法

version: '3.1'

services:
  db:
    image: postgres:14
    restart: always
    environment:
      POSTGRES_PASSWORD: mugicha
      POSTGRES_DB: mugidb
      PGDATA: /var/lib/postgresql/data/pgdata
    ports:
      - 5432:5432
    volumes:
      - ./data/postgres/pgdata:/var/lib/postgresql/data/pgdata
      - ./data/postgres/log:/var/log

$ cd <path-to-project-root>

$ docker-compose up -d 

$ docker container ls
CONTAINER ID   IMAGE         COMMAND                  CREATED       STATUS         PORTS                    NAMES
12116f3546a8   postgres:14   "docker-entrypoint.s…"   5 hours ago   Up 5 minutes   0.0.0.0:5432->5432/tcp   demo_db_1

spring.datasource.url=jdbc:postgresql://localhost:5432/mugidb
spring.datasource.username=postgres
spring.datasource.password=mugicha
spring.datasource.driver-class-name=org.postgresql.Driver

CREATE TABLE users (
    id BIGSERIAL PRIMARY KEY,
    email VARCHAR(128) NOT NULL UNIQUE,
    password VARCHAR(256) NOT NULL,
    roles VARCHAR(32) NOT NULL
);

$ docker-compose exec db bash

root@12116f3546a8:/# psql -U postgres -d mugidb

mugidb=# CREATE TABLE users (
    id BIGSERIAL PRIMARY KEY,
    email VARCHAR(128) NOT NULL UNIQUE,
    password VARCHAR(256) NOT NULL,
    roles VARCHAR(32) NOT NULL
);

import javax.persistence.Column;
import javax.persistence.Entity;
import javax.persistence.GeneratedValue;
import javax.persistence.GenerationType;
import javax.persistence.Id;
import javax.persistence.Table;

@Entity
@Table(name = "users")
public class User {
    @Id
    @GeneratedValue(strategy = GenerationType.IDENTITY)
    private Long id;

    @Column(name = "email")
    private String email;

    @Column(name = "password")
    private String password;

    @Column(name = "roles")
    private String roles;

    public User() {
    }

    // setters / getters...

import java.util.Optional;
import com.mugicha.demo.entities.User;
import org.springframework.data.jpa.repository.JpaRepository;

public interface UserRepository extends JpaRepository<User, Long> {

    Optional<User> findByEmail(String email);
    
}

@Service
public class UserService {
    
    @Autowired
    UserRepository userRepository;

    @Autowired
    PasswordEncoder passwordEncoder;

    // ユーザー登録用API
    public User createUser(String email, String rawPassword, String[] roles) {
        User user = new User();
        user.setEmail(email);
        // パスワードはハッシュ化する
        user.setPassword(passwordEncoder.encode(rawPassword));
        user.setRoles(String.join(",", roles));
        return userRepository.save(user);
    }

}

@Service
public class DefaultUserDetailsService implements UserDetailsService {

    @Autowired
    UserRepository userRepository;

    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        User user = userRepository
            .findByEmail(username)
            .orElseThrow(() -> new UsernameNotFoundException("user not found"));

        Collection<GrantedAuthority> authority =
            Arrays.stream(user.getRoles().split(","))
                .map((role) -> new SimpleGrantedAuthority(role))
                .collect(Collectors.toList());

        return new org.springframework.security.core.userdetails.User(
            user.getEmail(),
            user.getPassword(),
            authority
        );
    }
    
}

@EnableWebSecurity
@Configuration
public class DemoSecurityConfigurerAdapter extends WebSecurityConfigurerAdapter {
    
    // (1) 自前で定義したUserDetailsService
    @Autowired
    UserDetailsService userDetailsService;

    // (2) パスワードハッシュ化する実装をBean登録
    @Bean
    PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }

    // (3) アクセス制御
    @Override
    public void configure(HttpSecurity http) throws Exception {
        http
            .authorizeRequests()
                .antMatchers("/login").permitAll()
                .antMatchers("/register").permitAll()
                .anyRequest().authenticated();

        http
            .formLogin()
                .usernameParameter("email")
                .passwordParameter("password")
                .loginPage("/login")
                .loginProcessingUrl("/login")
                .failureUrl("/login?error=1")
                .defaultSuccessUrl("/top");
    }

    // (4) 認証マネージャの構築
    @Override
    public void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth
            .userDetailsService(userDetailsService)
            .passwordEncoder(passwordEncoder());
    }
}

http
    .authorizeRequests()
        .antMatchers("/login").permitAll()
        .antMatchers("/register").permitAll()
        .anyRequest().authenticated();

http
    .formLogin()
        .usernameParameter("email")
        .passwordParameter("password")
        .loginPage("/login")
        .loginProcessingUrl("/login")
        .failureUrl("/login?error=1")
        .defaultSuccessUrl("/top");

<form method="POST" action="#" th:action="@{/login}">
    <div>
        <p>メールアドレス</p>
        <p><input type="text" name="email" /></p>
    </div>
    <div>
        <p>パスワード</p>
        <p><input type="password" name="password" /></p>
    </div>
    <div>
        <button type="submit">ログイン</button>
    </div>
</form>

<!doctype html>
<html xmlns:th="http://www.thymeleaf.org">
<head>
    <meta charset="UTF-8" />
</head>
<body>
    <form method="POST" action="#" th:action="@{/register}" th:object="${registerForm}">
        <div>
            <p>メールアドレス</p>
            <p><input type="text" name="email" th:value="*{email}" /></p>
            <p th:if="${#fields.hasErrors('email')}" th:errors="*{email}">
                メールアドレスに関するエラー
            </p>
        </div>
        <div>
            <p>パスワード</p>
            <p><input type="password" name="password" th:value="*{password}" /></p>
            <p th:if="${#fields.hasErrors('password')}" th:errors="*{password}">
                パスワードに関するエラー
            </p>
        </div>
        <div>
            <button type="submit">登録</button>
        </div>
    </form>
</body>
</html>

public class RegisterForm {

    @NotBlank
    private String email;

    @NotBlank
    private String password;

    public RegisterForm() {
    }

    // setter, getters ...

@Controller
public class SampleController {

    @Autowired
    UserService userService;

    // 登録画面
    @GetMapping("/register")
    public String register(Model model) {
        model.addAttribute("registerForm", new RegisterForm());
        return "register";
    }

    // 登録画面の POST 受け付け
    @PostMapping("/register")
    public String postRegister(
        @ModelAttribute @Valid RegisterForm registerForm,
        BindingResult bindingResult) {
        if (bindingResult.hasErrors()) {
            // エラーがある場合は、エラーメッセージを表示したいので
            // View をレンダリングする。
            return "register";
        }

        userService.createUser(
            registerForm.getEmail(),
            registerForm.getPassword(),
            new String[] { "ADMIN", "USER" });

        // ユーザー登録処理が成功したらログイン画面にリダイレクトする。
        return "redirect:/login";
    }
}

mugidb=# \x
Expanded display is on.

mugidb=# select * from users;
-[ RECORD 1 ]----------------------------------------------------------
id       | 3
email    | hoge@mugicha.com
password | $2a$10$OkJDXDALYl4wxluFDgpQIOreYQ8TomtfZyJG2MT57weFWNngp44Qu
roles    | ADMIN,USER

<!doctype html>
<html xmlns:th="http://www.thymeleaf.org">
<head>
    <meta charset="UTF-8" />
</head>
<body>
    <form method="POST" action="#" th:action="@{/login}">
        <div>
            <p>メールアドレス</p>
            <p><input type="text" name="email" /></p>
        </div>
        <div>
            <p>パスワード</p>
            <p><input type="password" name="password" /></p>
        </div>
        <div>
            <button type="submit">ログイン</button>
        </div>
    </form>
</body>
</html>

    @GetMapping("/login")
    public String login() {
        return "login";
    }

    @GetMapping("/top")
    public String top() {
        return "top";
    }

<!doctype html>
<html xmlns:th="http://www.thymeleaf.org"
  xmlns:sec="http://www.thymeleaf.org/extras/spring-security">
<head>
    <meta charset="UTF-8" />
</head>
<body>
    <div sec:authorize="hasAuthority('ADMIN')">
        管理者のみ見えるdivブロックです。
    </div>
    <div sec:authorize="hasAuthority('USER')">
        ユーザーのみ見えるdivブロックです。
    </div>
    <div>
        誰でも見えるdivブロックです。
    </div>
</body>
</html>

mugidb=# UPDATE users SET roles = 'USER' WHERE id = 3;
UPDATE 1

mugidb=# SELECT * FROM users WHERE id = 3;
-[ RECORD 1 ]----------------------------------------------------------
id       | 3
email    | hoge@mugicha.com
password | $2a$10$OkJDXDALYl4wxluFDgpQIOreYQ8TomtfZyJG2MT57weFWNngp44Qu
roles    | USER