Spring security - different options

Spring provides options to perform authentication and authorisation. 

Authenticating using Spring: 

Spring provides the following features as part of authentication: 

• Basic Authentication: process authentication based on user credentials present int he urls. 
• Form based login: This is a default form which is provided as popup box to enter user credentials. 
• Custom form: You can also create your own forms, but need to follow some rules so that Spring knows which is the form, its userid and password fields. 
• Logout service: The user can logout using the logout url, the user object maintained in the session is removed. 
• Remember me support. 

The data for authentication can reside in different places. Spring authentication provider provides support for user details to be 

• hardcoded in memory files 

  <authentication-provider>

    <user-service>

        <user name="admin" password="secret" authorities="ROLE_ADMIN,ROLE_USER" />

        <user name="user1" password="1111" authorities="ROLE_USER" />

        <user name="user2" password="2222" disabled="true" authorities="ROLE_USER" />

    </user-service>

  </authentication-provider>

• in the user SQL database. 

    @Override

    protected void configure(AuthenticationManagerBuilder auth) throws Exception {

        auth.jdbcAuthentication()

                .dataSource(dataSource)

                .usersByUsernameQuery(

                        "SELECT username, password, 'true' as enabled FROM member WHERE username = ?")

                .authoritiesByUsernameQuery(

                        "SELECT member.username, member_role.role as authorities " +

                        "FROM member, member_role " +

                        "WHERE  member.username = ? AND member.id = member_role.member_id");

    }

• Custom store - may be file or NOSQL storage. 

Create your own user details object and validate from wherever you want - DB, ftp etc., 

• Identity store, you can retrieve using LDAP.

    <authentication-manager>

      <authentication-provider>

        <password-encoder hash="{sha}" />

        <ldap-user-service server-ref="ldapServer"

          user-search-filter="uid={0}" user-search-base="ou=people"

          group-search-filter="member={0}" group-search-base="ou=groups" />

      </authentication-provider>

    </authentication-manager>

    <ldap-server id="ldapServer"

        url="ldap://localhost:1389/dc=springrecipes,dc=com"

        manager-dn="cn=Directory Manager" manager-password="ldap" />

The configuration will also need to take care of what is the form page, what is the default successful url once logged in, the logout url, url signatures that need to be authenticated, userid and password field, action url of spring security. 

Securing URL Access

You can secure methods using different ways: 

@Configuration

@EnableGlobalMethodSecurity(securedEnabled = true)

public class ApplicationConfig { ... }

In the controller, 

  @Secured({"ROLE_USER", "ROLE_GUEST"})

    public List<Message> listMessages() {

        ...

    }

Spring security using Java configuration

Authentication can be done in 2 ways in spring - using context xml files or using the latest java based configuration. This article explains how to implement spring security using java configurations.

The below steps need to be followed in order to configure security in spring applications.

• Define spring security security filter chain.
• Create custom user details service
• Security configuration

1Define spring security security filter chain.

       public class WebAppInitializer implements WebApplicationInitializer {

              public void onStartup(ServletContext servletContext)

                     throws ServletException {

              .

              .

              .

             

              servletContext.addFilter("springSecurityFilterChain",

                           new DelegatingFilterProxy("springSecurityFilterChain"))

                     .addMappingForUrlPatterns(EnumSet.allOf(DispatcherType.class),

                                         true, "/*");

              .

              .

              .

              }

       }

TThe above approach eliminates the need for using a web.xml. The springsecurityfilterchain is defined in this java

fifile instead of web.xml.

Create custom user details service class.

       @Service

       public class AppUserDetailsService implements UserDetailsService {

              @Autowired

              private AppUserRepository appUserRepository;

              @Override

              @Transactional

              public UserDetails loadUserByUsername(String userId)

                     throws UsernameNotFoundException {

                     UserValue userValue = null;

                     List<GrantedAuthority> grantedAuthorities = new  ArrayList                               <GrantedAuthority>();

                     AppUser appUser = null;

                     appUser = appUserRepository.findByUserId(userId);

                     if (appUser != null) {

                            grantedAuthorities.add(new SimpleGrantedAuthority(appUser

                                  .getAppRole().getName()));

                            userValue = new UserValue(

                                  appUser.getId(), appUser. getUserId(),

                                  appUser.getPassword(), grantedAuthorities,

                                   appUser.getFirstName(), appUser.getLastName());

                     }

                     return userValue;

              }

       }

 There are different ways to configure security, this approach uses a custom User details service which loads the user and role information from the db and returns it to the framework, the framework then stores the user and role information in the session for further processing

1Create security configuration java class

@Configuration

@EnableWebSecurity

@EnableGlobalMethodSecurity(prePostEnabled = true)

public class SecurityConfig extends WebSecurityConfigurerAdapter {

       @Autowired

       AppUserDetailsService appUserDetailsService;

       @Autowired

       public void configureGlobal(AuthenticationManagerBuilder auth)

                     throws Exception {

              auth.userDetailsService(appUserDetailsService);

       }

       @Override

       public void configure(WebSecurity builder) throws Exception {

              builder.expressionHandler(webexpressionHandler()).ignoring()

                           .antMatchers("/resources/**");

       }

       @Bean(name = "webexpressionHandler")

       public DefaultWebSecurityExpressionHandler webexpressionHandler() {

              return new DefaultWebSecurityExpressionHandler();

       }

       @Override

       protected void configure(HttpSecurity http) throws Exception {

              http.csrf().disable().authorizeRequests().

                                  .antMatchers("/loginPage").permitAll().

                                  anyRequest().fullyAuthenticated().and()                                                   .formLogin().loginPage("/loginPage").

                                  loginProcessingUrl("/j_spring_security_check")

                                  .usernameParameter("j_username")

                                   .passwordParameter("j_password").

                                  failureUrl("/errorPage")

                                   .defaultSuccessUrl("/myhome").permitAll().and().

                                  logout().logoutUrl("/j_spring_security_logout")

                     .logoutSuccessUrl("/loginPAge").deleteCookies("JSESSIONID")

                           .invalidateHttpSession(true);

       }

}

The configure method can be used to define the loginpage, logout page, the success url, failure url and whether to delete cookies and invalidate session while logout. 

• The configure method which accepts WebSecurity can be used to tell the resource folders so that those can be ignored by the security frameworks.
•  Now all the urls except the one in the resources folder will be intercepted by the security framework and will be redirected to the login page
•  Once the user enters the user id and password, the AppUserDetailsService.loadUserByUsername will be called by passing the current login userid. This method loads user information and passes it to the security framework
•  The framework then validates the credentials and if it is successful, then displays the home page based on the configuration defined in the security config class.
•  When the user logs out, the session is invalidated and the controls goes back to the login page.