Spring Annotation based configuration - reading from property file

Spring can be configured using context xml files or using java annotations.

@Configuration can be used if you want to configure using java.

Full configuration code:

@Configuration

@EnableWebMvc

@ComponentScan(basePackages = "com.cv")

@EnableMongoRepositories(basePackages = { "com.cv.framework.mongorepositories",

              "com.cv.app.repository" })

@PropertySource(value = "classpath:app.properties")

public class AppConfig extends WebMvcConfigurerAdapter

       @Inject

       Environment environment;

       @Bean

       public InternalResourceViewResolver configureInternalResourceViewResolver() {

              InternalResourceViewResolver resolver = new InternalResourceViewResolver();

              resolver.setPrefix("/WEB-INF/views/");

              resolver.setSuffix(".jsp");

              return resolver;

       }

       @SuppressWarnings("deprecation")

       @Bean

       public Mongo mongo() throws Exception {

              return new Mongo(environment.getProperty("ip"));

       }

       @Bean

       public MongoTemplate mongoTemplate() throws Exception {

              return new MongoTemplate(mongo(),

                           environment.getProperty("mdbname"));

       }

}

@Configuration tells that the current java file is a spring configuration file. 

@ComponentScan tells the container to scan all the java files that starts with the package com.cv

@EnableMongoRepository informs the container where to search for mongo Repositories. 

@PropertySource annotation defines the property file this annotation java file uses to pull configurable values for the application. 

Environment is a spring api class which is used to read from the properties file. 

environment.getProperty("mdbname") tries to read the property mdbname from the app.properties file. 

Java based spring configuration is easier than the xml configuration since it throws all the errors at compile time and the context sensitive help comes very handy. 

Some developers prefer to keep some configuration in the xml to locate easily. 

Spring security using Java configuration

Authentication can be done in 2 ways in spring - using context xml files or using the latest java based configuration. This article explains how to implement spring security using java configurations.

The below steps need to be followed in order to configure security in spring applications.

• Define spring security security filter chain.
• Create custom user details service
• Security configuration

1Define spring security security filter chain.

       public class WebAppInitializer implements WebApplicationInitializer {

              public void onStartup(ServletContext servletContext)

                     throws ServletException {

              .

              .

              .

             

              servletContext.addFilter("springSecurityFilterChain",

                           new DelegatingFilterProxy("springSecurityFilterChain"))

                     .addMappingForUrlPatterns(EnumSet.allOf(DispatcherType.class),

                                         true, "/*");

              .

              .

              .

              }

       }

TThe above approach eliminates the need for using a web.xml. The springsecurityfilterchain is defined in this java

fifile instead of web.xml.

Create custom user details service class.

       @Service

       public class AppUserDetailsService implements UserDetailsService {

              @Autowired

              private AppUserRepository appUserRepository;

              @Override

              @Transactional

              public UserDetails loadUserByUsername(String userId)

                     throws UsernameNotFoundException {

                     UserValue userValue = null;

                     List<GrantedAuthority> grantedAuthorities = new  ArrayList                               <GrantedAuthority>();

                     AppUser appUser = null;

                     appUser = appUserRepository.findByUserId(userId);

                     if (appUser != null) {

                            grantedAuthorities.add(new SimpleGrantedAuthority(appUser

                                  .getAppRole().getName()));

                            userValue = new UserValue(

                                  appUser.getId(), appUser. getUserId(),

                                  appUser.getPassword(), grantedAuthorities,

                                   appUser.getFirstName(), appUser.getLastName());

                     }

                     return userValue;

              }

       }

 There are different ways to configure security, this approach uses a custom User details service which loads the user and role information from the db and returns it to the framework, the framework then stores the user and role information in the session for further processing

1Create security configuration java class

@Configuration

@EnableWebSecurity

@EnableGlobalMethodSecurity(prePostEnabled = true)

public class SecurityConfig extends WebSecurityConfigurerAdapter {

       @Autowired

       AppUserDetailsService appUserDetailsService;

       @Autowired

       public void configureGlobal(AuthenticationManagerBuilder auth)

                     throws Exception {

              auth.userDetailsService(appUserDetailsService);

       }

       @Override

       public void configure(WebSecurity builder) throws Exception {

              builder.expressionHandler(webexpressionHandler()).ignoring()

                           .antMatchers("/resources/**");

       }

       @Bean(name = "webexpressionHandler")

       public DefaultWebSecurityExpressionHandler webexpressionHandler() {

              return new DefaultWebSecurityExpressionHandler();

       }

       @Override

       protected void configure(HttpSecurity http) throws Exception {

              http.csrf().disable().authorizeRequests().

                                  .antMatchers("/loginPage").permitAll().

                                  anyRequest().fullyAuthenticated().and()                                                   .formLogin().loginPage("/loginPage").

                                  loginProcessingUrl("/j_spring_security_check")

                                  .usernameParameter("j_username")

                                   .passwordParameter("j_password").

                                  failureUrl("/errorPage")

                                   .defaultSuccessUrl("/myhome").permitAll().and().

                                  logout().logoutUrl("/j_spring_security_logout")

                     .logoutSuccessUrl("/loginPAge").deleteCookies("JSESSIONID")

                           .invalidateHttpSession(true);

       }

}

The configure method can be used to define the loginpage, logout page, the success url, failure url and whether to delete cookies and invalidate session while logout. 

• The configure method which accepts WebSecurity can be used to tell the resource folders so that those can be ignored by the security frameworks.
•  Now all the urls except the one in the resources folder will be intercepted by the security framework and will be redirected to the login page
•  Once the user enters the user id and password, the AppUserDetailsService.loadUserByUsername will be called by passing the current login userid. This method loads user information and passes it to the security framework
•  The framework then validates the credentials and if it is successful, then displays the home page based on the configuration defined in the security config class.
•  When the user logs out, the session is invalidated and the controls goes back to the login page.