Java tutorial
/* * Copyright 2014 Azige. * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at * * http://www.apache.org/licenses/LICENSE-2.0 * * Unless required by applicable law or agreed to in writing, software * distributed under the License is distributed on an "AS IS" BASIS, * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. * See the License for the specific language governing permissions and * limitations under the License. */ package io.github.azige.bbs.service; import java.nio.charset.Charset; import java.security.MessageDigest; import java.security.NoSuchAlgorithmException; import java.security.SecureRandom; import java.util.Base64; import java.util.Random; import io.github.azige.bbs.data.AccountRepository; import io.github.azige.bbs.entity.Account; import io.github.azige.bbs.entity.Profile; import org.springframework.beans.factory.annotation.Autowired; import org.springframework.context.annotation.Scope; import org.springframework.context.annotation.ScopedProxyMode; import org.springframework.security.authentication.AuthenticationProvider; import org.springframework.security.authentication.UsernamePasswordAuthenticationToken; import org.springframework.security.core.Authentication; import org.springframework.security.core.AuthenticationException; import org.springframework.security.core.userdetails.UsernameNotFoundException; import org.springframework.stereotype.Service; import org.springframework.transaction.annotation.Transactional; /** * * @author Azige */ @Service @Scope(proxyMode = ScopedProxyMode.TARGET_CLASS) @Transactional public class AccountService implements AuthenticationProvider { @Autowired private AccountRepository accountRepository; private final MessageDigest sha1; private final Random random = new SecureRandom(); public AccountService() throws NoSuchAlgorithmException { sha1 = MessageDigest.getInstance("SHA-1"); } public Profile register(String accountName, String password, String nickName, String description) throws ServiceException { if (accountRepository.findByAccountName(accountName) != null) { ServiceException.throwAccountAlreadyExist(); } Profile profile = new Profile(); profile.setNickName(nickName); profile.setDescription(description); String salt = generateSalt(); password = encryptPassword(password, salt); Account account = new Account(); account.setAccountName(accountName); account.setSalt(salt); account.setPassword(password); account.setProfile(profile); accountRepository.save(account); return profile; } public String generateSalt() { byte[] saltBytes = new byte[20]; random.nextBytes(saltBytes); return Base64.getEncoder().encodeToString(saltBytes); } public String encryptPassword(String password, String salt) { return Base64.getEncoder() .encodeToString(sha1.digest((salt + password).getBytes(Charset.forName("UTF-8")))); } @Override public Authentication authenticate(Authentication authentication) throws AuthenticationException { String username = authentication.getName(); String password = (String) authentication.getCredentials(); Account account = accountRepository.findByAccountName(username); if (account == null) { throw new UsernameNotFoundException("User name not found"); } password = encryptPassword(password, account.getSalt()); if (password.equals(account.getPassword())) { return new UsernamePasswordAuthenticationToken(account.getProfile(), password, Account.AUTHORITYS); } return authentication; } @Override public boolean supports(Class<?> authentication) { return true; } }