laravel修改用戶模塊的密碼驗(yàn)證實(shí)現(xiàn)

第laravel修改用戶模塊的密碼驗(yàn)證實(shí)現(xiàn)|--------------------------------------------------------------------------

|AuthenticationDefaults

|--------------------------------------------------------------------------

|Thisoptioncontrolsthedefaultauthentication"guard"andpassword

|resetoptionsforyourapplication.Youmaychangethesedefaults

|asrequired,butthey'reaperfectstartformostapplications.

'defaults'=[

'guard'='web',

'passwords'='users',

|--------------------------------------------------------------------------

|AuthenticationGuards

|--------------------------------------------------------------------------

|Next,youmaydefineeveryauthenticationguardforyourapplication.

|Ofcourse,agreatdefaultconfigurationhasbeendefinedforyou

|herewhichusessessionstorageandtheEloquentuserprovider.

|Allauthenticationdrivershaveauserprovider.Thisdefineshowthe

|usersareactuallyretrievedoutofyourdatabaseorotherstorage

|mechanismsusedbythisapplicationtopersistyouruser'sdata.

|Supported:"session","token"

'guards'=[

'web'=[

'driver'='session',

'provider'='users',

'api'=[

'driver'='passport',

'provider'='users',

|--------------------------------------------------------------------------

|UserProviders

|--------------------------------------------------------------------------

|Allauthenticationdrivershaveauserprovider.Thisdefineshowthe

|usersareactuallyretrievedoutofyourdatabaseorotherstorage

|mechanismsusedbythisapplicationtopersistyouruser'sdata.

|Ifyouhavemultipleusertablesormodelsyoumayconfiguremultiple

|sourceswhichrepresenteachmodel/table.Thesesourcesmaythen

|beassignedtoanyextraauthenticationguardsyouhavedefined.

|Supported:"database","eloquent"

'providers'=[

'users'=[

'driver'='eloquent',

'model'=App\User::class,

//'users'=[

//'driver'='database',

//'table'='users',

//],

|--------------------------------------------------------------------------

|ResettingPasswords

|--------------------------------------------------------------------------

|Youmayspecifymultiplepasswordresetconfigurationsifyouhavemore

|thanoneusertableormodelintheapplicationandyouwanttohave

|separatepasswordresetsettingsbasedonthespecificusertypes.

|Theexpiretimeisthenumberofminutesthattheresettokenshouldbe

|consideredvalid.Thissecurityfeaturekeepstokensshort-livedso

|theyhavelesstimetobeguessed.Youmaychangethisasneeded.

'passwords'=[

'users'=[

'provider'='users',

'table'='password_resets',

'expire'=60,

默認(rèn)使用的守衛(wèi)是web，而web守衛(wèi)使用的認(rèn)證驅(qū)動(dòng)是session，用戶提供器是users。假設(shè)我們的需求只是將用戶的提供器由users改為admins，那么我們需要做兩步操作：

修改默認(rèn)的用戶提供器，將provider='users'改為provider='admins'

'guards'=[

'web'=[

'driver'='session',

'provider'='users',

配置admins提供器，假設(shè)依舊使用eloquent作為驅(qū)動(dòng)，并創(chuàng)建好了admins表的模型

'providers'=[

'admins'=[

'driver'='eloquent',

'model'=App\Admin::class

使用Auth門面的attempt方法進(jìn)行登錄

SessionGuard中的attempt方法：

//Illuminate\Auth\SessionGuard

publicfunctionattempt(array$credentials=[],$remember=false)

$this-fireAttemptEvent($credentials,$remember);

$this-lastAttempted=$user=$this-provider-retrieveByCredentials($credentials);

//IfanimplementationofUserInterfacewasreturned,we'llasktheprovider

//tovalidatetheuseragainstthegivencredentials,andiftheyarein

//factvalidwe'lllogtheusersintotheapplicationandreturntrue.

if($this-hasValidCredentials($user,$credentials)){

$this-login($user,$remember);

returntrue;

//Iftheauthenticationattemptfailswewillfireaneventsothattheuser

//maybenotifiedofanysuspiciousattemptstoaccesstheiraccountfrom

//anunrecognizeduser.Adevelopermaylistentothiseventasneeded.

$this-fireFailedEvent($user,$credentials);

returnfalse;

該方法中調(diào)用UserProvider接口的retrieveByCredentials方法檢索用戶，根據(jù)我們的配置，UserProvider接口的具體實(shí)現(xiàn)應(yīng)該是EloquentUserProvider，因此，我們定位到EloquentUserProvider的retrieveByCredentials方法：

//Illuminate\Auth\EloquentUserProvider

publicfunctionretrieveByCredentials(array$credentials)

if(empty($credentials)||

(count($credentials)===1

array_key_exists('password',$credentials))){

return;

//Firstwewilladdeachcredentialelementtothequeryasawhereclause.

//Thenwecanexecutethequeryand,ifwefoundauser,returnitina

//EloquentUser"model"thatwillbeutilizedbytheGuardinstances.

$query=$this-createModel()-newQuery();

foreach($credentialsas$key=$value){

if(Str::contains($key,'password')){

continue;

if(is_array($value)||$valueinstanceofArrayable){

$query-whereIn($key,$value);

}else{

$query-where($key,$value);

return$query-first();

}

該方法會(huì)使用傳入的參數(shù)（不包含password）到我們配置的數(shù)據(jù)表中搜索數(shù)據(jù)，查詢到符合條件的數(shù)據(jù)之后返回對應(yīng)的用戶信息，然后attempt方法會(huì)進(jìn)行密碼校驗(yàn)，校驗(yàn)密碼的方法為：

//Illuminate\Auth\SessionGuard

*Determineiftheusermatchesthecredentials.

*@parammixed$user

*@paramarray$credentials

*@returnbool

protectedfunctionhasValidCredentials($user,$credentials)

return!is_null($user)$this-provider-validateCredentials($user,$credentials);

進(jìn)一步查看EloquentUserProvider中的validateCredentials方法

//Illuminate\Auth\EloquentUserProvider

publicfunctionvalidateCredentials(UserContract$user,array$credentials)

$plain=$credentials['password'];

return$this-hasher-check($plain,$user-getAuthPassword());

通過validateCredentials可以看出，提交的認(rèn)證數(shù)據(jù)中密碼字段名必須是password，這個(gè)無法自定義。同時(shí)可以看到，入?yún)?user必須實(shí)現(xiàn)Illuminate\Contracts\Auth\Authenticatable接口（UserContract是別名）。

修改Admin模型

Admin模型必須實(shí)現(xiàn)Illuminate\Contracts\Auth\Authenticatable接口，可以借鑒一下User模型，讓Admin直接繼承Illuminate\Foundation\Auth\User就可以，然后重寫getAuthPassword方法，正確獲取密碼字段：

//App\Admin

publicfunctiongetAuthPassword()

return$this-login_pass;

不出意外的話，這個(gè)時(shí)候就能使用admins表進(jìn)行登錄了。

Larval5.4的默認(rèn)Auth登陸傳入郵件和用戶密碼到attempt方法來認(rèn)證，通過email的值獲取，如果用戶被找到，經(jīng)哈希運(yùn)算后存儲(chǔ)在數(shù)據(jù)中的password將會(huì)和傳遞過來的經(jīng)哈希運(yùn)算處理的passwrod值進(jìn)行比較。如果兩個(gè)經(jīng)哈希運(yùn)算的密碼相匹配那么將會(huì)為這個(gè)用戶開啟一個(gè)認(rèn)證Session。

參考上面的分析，我們就需要對EloquentUserProvider中的validateCredentials方法進(jìn)行重寫,步驟如下

1.修改App\Models\User.php添加如下代碼

publicfunctiongetAuthPassword()

return['password'=$this-attributes['password'],'salt'=$this-attributes['salt']];

2.建立一個(gè)自己的UserProvider.php的實(shí)現(xiàn)

php

namespaceApp\Foundation\Auth;

useIlluminate\Auth\EloquentUserProvider;

useIlluminate\Contracts\Auth\Authenticatable;

useIlluminate\Support\Str;

*重寫用戶密碼校驗(yàn)邏輯

*ClassGfzxEloquentUserProvider

*@packageApp\Foundation\Auth

classGfzxEloquentUserProviderextendsEloquentUserProvider

*Validateauseragainstthegivencredentials.

*@param\Illuminate\Contracts\Auth\Authenticatable$user

*@paramarray$credentials

*@returnbool

publicfunctionvalidateCredentials(Authenticatable$user,array$credentials)

$plain=$credentials['password'];

$authPassword=$user-getAuthPassword();

returnmd5($plain.$authPassword['salt'])==$authPassword['password'];

3.將UserProviders換成我們自己的GfzxEloquentUserProvide