+ * WARNING: This method is considered unsafe for production and is only intended + * for sample applications. + *
+ *+ * Creates a user and automatically encodes the provided password using + * {@code PasswordEncoderFactories.createDelegatingPasswordEncoder()}. For example: + *
+ * + *
+ *
+ * UserDetails user = User.withDefaultPasswordEncoder()
+ * .username("user")
+ * .password("password")
+ * .roles("USER")
+ * .build();
+ * // outputs {bcrypt}$2a$10$dXJ3SW6G7P50lGmMkkmwe.20cQQubK3.HZWzG3YB1tlRy.fqvM/BG
+ * System.out.println(user.getPassword());
+ *
+ *
+ *
+ * This is not safe for production (it is intended for getting started experience)
+ * because the password "password" is compiled into the source code and then is
+ * included in memory at the time of creation. This means there are still ways to
+ * recover the plain text password making it unsafe. It does provide a slight
+ * improvement to using plain text passwords since the UserDetails password is
+ * securely hashed. This means if the UserDetails password is accidentally exposed,
+ * the password is securely stored.
+ *
+ * In a production setting, it is recommended to hash the password ahead of time.
+ * For example:
+ *
+ *
+ *
+ * PasswordEncoder encoder = PasswordEncoderFactories.createDelegatingPasswordEncoder();
+ * // outputs {bcrypt}$2a$10$dXJ3SW6G7P50lGmMkkmwe.20cQQubK3.HZWzG3YB1tlRy.fqvM/BG
+ * // remember the password that is printed out and use in the next step
+ * System.out.println(encoder.encode("password"));
+ *
+ *
+ *
+ *
+ *
+ * UserDetails user = User.withUsername("user")
+ * .password("{bcrypt}$2a$10$dXJ3SW6G7P50lGmMkkmwe.20cQQubK3.HZWzG3YB1tlRy.fqvM/BG")
+ * .roles("USER")
+ * .build();
+ *
+ *
+ *
+ * @return a UserBuilder that automatically encodes the password with the default
+ * PasswordEncoder
+ * @deprecated Using this method is not considered safe for production, but is
+ * acceptable for demos and getting started. For production purposes, ensure the
+ * password is encoded externally. See the method Javadoc for additional details.
+ * There are no plans to remove this support. It is deprecated to indicate
+ * that this is considered insecure for production purposes.
+ */
+ @Deprecated
+ public static UserBuilder withDefaultPasswordEncoder() {
+ logger.warn("User.withDefaultPasswordEncoder() is considered unsafe for production and is only intended for sample applications.");
+ PasswordEncoder encoder = PasswordEncoderFactories.createDelegatingPasswordEncoder();
+ return builder().passwordEncoder(encoder);
+ }
+
+ public static UserBuilder withUserDetails(UserDetails userDetails) {
+ return withUsername(userDetails.getUsername())
+ .password(userDetails.getPassword())
+ .accountExpired(!userDetails.isAccountNonExpired())
+ .accountLocked(!userDetails.isAccountNonLocked())
+ .authorities(userDetails.getAuthorities())
+ .credentialsExpired(!userDetails.isCredentialsNonExpired())
+ .disabled(!userDetails.isEnabled());
}
/**
@@ -260,6 +358,7 @@ public class User implements UserDetails, CredentialsContainer {
private boolean accountLocked;
private boolean credentialsExpired;
private boolean disabled;
+ private PasswordEncoder passwordEncoder = NoOpPasswordEncoder.getInstance();
/**
* Creates a new instance
@@ -274,7 +373,7 @@ public class User implements UserDetails, CredentialsContainer {
* @return the {@link UserBuilder} for method chaining (i.e. to populate
* additional attributes for this user)
*/
- private UserBuilder username(String username) {
+ public UserBuilder username(String username) {
Assert.notNull(username, "username cannot be null");
this.username = username;
return this;
@@ -293,6 +392,20 @@ public class User implements UserDetails, CredentialsContainer {
return this;
}
+ /**
+ * Encodes the current password (if non-null) and any future passwords supplied
+ * to {@link #password(String)}.
+ *
+ * @param encoder the encoder to use
+ * @return the {@link UserBuilder} for method chaining (i.e. to populate
+ * additional attributes for this user)
+ */
+ private UserBuilder passwordEncoder(PasswordEncoder encoder) {
+ Assert.notNull(encoder, "encoder cannot be null");
+ this.passwordEncoder = encoder;
+ return this;
+ }
+
/**
* Populates the roles. This method is a shortcut for calling
* {@link #authorities(String...)}, but automatically prefixes each entry with
@@ -351,7 +464,7 @@ public class User implements UserDetails, CredentialsContainer {
* additional attributes for this user)
* @see #roles(String...)
*/
- public UserBuilder authorities(List authorities) {
+ public UserBuilder authorities(Collection authorities) {
this.authorities = new ArrayList