Ekiras Blogs: Security

Showing posts with label Security. Show all posts

SpringSecurity : How to disable Session Creation for Stateless Authentication

Read

How to disable Session Creation for Stateless Authentication

We need to disable session creation for authenticating requests based on token based authentication.
This can be easily configured by the following configurations.

view plain copy to clipboard print ?

package com.ekiras.ss.security.config;
import com.ekiras.ss.security.filter.TokenAuthenticationFilter;
import org.springframework.context.annotation.Bean;
import org.springframework.core.Ordered;
import org.springframework.core.annotation.Order;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.config.http.SessionCreationPolicy;
import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
/**
* @author ekansh
* @since 11/4/16
*/
@EnableWebSecurity
@Order(Ordered.LOWEST_PRECEDENCE-100)
public class RestSecurityConfigurerAdapter extends WebSecurityConfigurerAdapter {
@Override
protected void configure(HttpSecurity http) throws Exception {
http.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);
}
}

package com.ekiras.ss.security.config;

import com.ekiras.ss.security.filter.TokenAuthenticationFilter;
import org.springframework.context.annotation.Bean;
import org.springframework.core.Ordered;
import org.springframework.core.annotation.Order;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.config.http.SessionCreationPolicy;
import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;

/**
 * @author ekansh
 * @since 11/4/16
 */
@EnableWebSecurity
@Order(Ordered.LOWEST_PRECEDENCE-100)
public class RestSecurityConfigurerAdapter extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {

        http.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);

    }




}

The above configurations, will force the application to stop creating sessions and storing authentication data in session i.e The SecurityContextHolder will not be holding the authentication for each authentication.

Pros

Each call will be stateless.
No session will be created or maintained.
Very good for rest applications.
Authentication expiry will be handled by the token expiry

Cons

Response time will increase, as each request needs to be authenticated every time.
To maintain state of an authenticated request you need to persist token, if auth token can be used multiple times.

Read More Add comment

SpringSecurity : Authenticate User with Custom UserDetailsService

By Ekansh Rastogi

Read

0 Comments

Points To Remember

Create class that implement UserDetailsService and override loadUserByUsername() method.
Throw UsernameNotFoundException if no user was found by username.
Register this class as a bean by overriding WebSecurityConfigurerAdapter.

Authenticate User with Custom UserDetailsService

Step 1 : Create Entities for User and Role

Create Entity User

package com.ekiras.ss.domain;

import javax.persistence.*;
import java.util.Set;

/**
 * @author ekiras
 */
 
@Entity
public class User {

    @Id
    @GeneratedValue(strategy = GenerationType.AUTO)
    private long id;

    private String username;

    private String password;

    private boolean enabled;

    @ManyToMany(fetch = FetchType.EAGER,cascade = CascadeType.ALL)
    @JoinTable(joinColumns = @JoinColumn(name = "user_id"),inverseJoinColumns = @JoinColumn(name = "role_id"))
    private Set<role> roles;

    // GETTERS and SETTERS
}

Create Entity Role

package com.ekiras.ss.domain;

import javax.persistence.*;
import java.util.Set;

/**
 * @author ekiras
 */
 
@Entity
public class Role {

    @Id
    @GeneratedValue(strategy = GenerationType.AUTO)
    private long id;

    private String role;

    @ManyToMany(mappedBy = "roles",fetch = FetchType.LAZY)
    private Set<user> users;

    // GETTERS and SETTERS
}

This will create three tables in your database

user
role
user_roles

Step 2 : Create CustomUserDetailsService

Now, create a new class named as SSUserDetailsService that implements UserDetailsService and override the loadUserByUsername() method as follows.

package com.ekiras.ss.config;

import com.ekiras.ss.domain.Role;
import com.ekiras.ss.domain.User;
import com.ekiras.ss.repository.UserRepository;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.authority.SimpleGrantedAuthority;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.core.userdetails.UsernameNotFoundException;

import javax.transaction.Transactional;
import java.util.HashSet;
import java.util.Set;

/**
 * @author ekiras
 */
 
@Transactional
public class SSUserDetailsService implements UserDetailsService {

    private static final Logger LOGGER = LoggerFactory.getLogger(SSUserDetailsService.class);

    private UserRepository userRepository;

    public SSUserDetailsService(UserRepository userRepository){
        this.userRepository=userRepository;
    }

    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        try {
            User user = userRepository.findByUsername(username);
            if (user == null) {
                LOGGER.debug("user not found with the provided username");
                return null;
            }
            LOGGER.debug(" user from username " + user.toString());
            return new org.springframework.security.core.userdetails.User(user.getUsername(), user.getPassword(), getAuthorities(user));
        }
        catch (Exception e){
            throw new UsernameNotFoundException("User not found");
        }
    }

    private Set<grantedauthority> getAuthorities(User user){
        Set<grantedauthority> authorities = new HashSet<grantedauthority>();
        for(Role role : user.getRoles()) {
            GrantedAuthority grantedAuthority = new SimpleGrantedAuthority(role.getRole());
            authorities.add(grantedAuthority);
        }
        LOGGER.debug("user authorities are " + authorities.toString());
        return authorities;
    }


}

This class will load the User from username. When the login form is submitted, spring security will use this class to load the user by the username provided. If the User is not found with that name then the UsernameNotFoundException is thrown.

Note

loadUserByUsername() method should return an object of UserDetails. You can user two constructors to return this object

org.springframework.security.core.userdetails.User class

Object of any other class that implements UserDetails interface

Step 3 : Register our Custom UserDetailsService to SpringSecurity as a Bean

Now, we need to register this class as a bean and tell spring security to use this class for loading user from database. So, first we will override the userDetailsBean

    @Autowired private UserRepository userRepository;

    @Override
    public UserDetailsService userDetailsServiceBean() throws Exception {
        return new SSUserDetailsService(userRepository);
    }

Note
We will pass the bean UserRepository to the UserDetailsService because this bean will be loaded before the repository is loaded, so we might get the useeRepository bean as null in out SSUserDetailsService.

Now we will configure spring security to use our UserDetailsService as follows

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.userDetailsService(userDetailsServiceBean());
    }

So, our spring security configurer may look like as shown in code below.

package com.ekiras.ss.config;

import com.ekiras.ss.repository.UserRepository;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.web.util.matcher.AntPathRequestMatcher;

/**
 * @author ekiras
 */
 
@Configuration
@EnableWebSecurity
public class SpringSecurityConfigurer extends WebSecurityConfigurerAdapter{

    @Autowired private UserRepository userRepository;

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.userDetailsService(userDetailsServiceBean());
    }

    @Override
    public UserDetailsService userDetailsServiceBean() throws Exception {
        return new SSUserDetailsService(userRepository);
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
            .authorizeRequests()
                .antMatchers("/admin/**").hasAuthority("ADMIN")
                .antMatchers("/user/**").hasAuthority("USER")
                .anyRequest().authenticated()
            .and()
            .formLogin()
            .and()
            .logout().logoutRequestMatcher(new AntPathRequestMatcher("/logout")).logoutSuccessUrl("/login");
        ;
    }





}

Also Read

Configure Spring Security with Spring boot

Configure JDBC Authetication using MYSQL Query

Authenticate User with Custom UserDetailsService

Implement Role Hierarchy with In-Memory Authentication

How to list the User Authorities in Controller,Filter and Services

Disable Session Creation for Stateless Authentication

    Download from Github

Read More Add comment

SpringSecurity : Configure JDBC Authetication using MYSQL Query

By Ekansh Rastogi

Read

0 Comments

Create Database Schema and tables

First we will create a Database Schema as shown in the image below.

Sql schema

We have to create 3 Tables in database.

user - to hold the user data.
role - to hold the data of roles that a user can have.
user_roles - to hold the mapping of user and roles.

Configure JDBC Authetication using MYSQL Query.

Step 1 : Add the Dependencies

 compile('org.springframework.boot:spring-boot-starter-data-jpa')
 runtime('mysql:mysql-connector-java')

Step 2 : Add the Datasource properties

spring.jpa.hibernate.ddl-auto=update

spring.datasource.url=jdbc:mysql://localhost/demo_ss
spring.datasource.username=root
spring.datasource.password=root
spring.datasource.driver-class-name=com.mysql.jdbc.Driver
spring.datasource.maxActive=10
spring.datasource.max-idle=4
spring.datasource.min-idle=2
spring.datasource.test-while-idle=true
spring.datasource.test-on-borrow=true
spring.datasource.validation-query=SELECT 1
spring.datasource.time-between-eviction-runs-millis=60000
spring.datasource.min-evictable-idle-time-millis=300000
spring.jpa.properties.hibernate.current_session_context_class=org.springframework.orm.hibernate4.SpringSessionContext

Step 3 : Add the Datasource Bean to SpringSecurity Configurer class

    @Autowired
    private DataSource dataSource;

Add queries to be fired for user authentication

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.jdbcAuthentication()
                .usersByUsernameQuery("select username,password,enabled from user where username=?")
                .authoritiesByUsernameQuery("select u.username,r.role from user u inner join user_roles ur on(u.id=ur.user_id) inner join role r on(ur.role_id=r.id)  where u.username=?")
                .dataSource(dataSource);
        auth.userDetailsService(userDetailsService());
    }

Following code will demonstrate how to configure spring security to authenticate the user using a simple mysql query.

package com.ekiras.ss.config;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;

import javax.sql.DataSource;

/**
 * @author ekiras
 */
@EnableWebSecurity
public class SpringSecurityConfigurer extends WebSecurityConfigurerAdapter{

    @Autowired
    private DataSource dataSource;

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.jdbcAuthentication()
                .usersByUsernameQuery("select username,password,enabled from user where username=?")
                .authoritiesByUsernameQuery("select u.username,r.role from user u inner join user_roles ur on(u.id=ur.user_id) inner join role r on(ur.role_id=r.id)  where u.username=?")
                .dataSource(dataSource);
        auth.userDetailsService(userDetailsService());
    }


    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
            .authorizeRequests()
                .antMatchers("/admin/**").hasAuthority("ADMIN")
                .antMatchers("/user/**").hasAuthority("USER")
                .anyRequest().fullyAuthenticated()
                .and()
            .formLogin()
            .and()
            .logout()
        ;
    }
}

Also Read

Configure Spring Security with Spring boot

Configure JDBC Authetication using MYSQL Query

Authenticate User with Custom UserDetailsService

Implement Role Hierarchy with In-Memory Authentication

How to list the User Authorities in Controller,Filter and Services

Disable Session Creation for Stateless Authentication

    Download from Github

Read More Add comment

SpringSecurity : How to list the User Authorities in Controller,Filter and Services

By Ekansh Rastogi

Read

0 Comments

Read More Add comment

SpringSecurity : Configure In Memory Authentication

By Ekansh Rastogi

Read

0 Comments

Configure Spring Security to Authenticate user using In-Memory Authentication.

To implement inMemory authentication, all you need to do is

extend WebSecurityConfigurerAdapter.
override configure(AuthenticationManagerBuilder) method
add username, password and roles/authorities for authentication.

After adding the following class to your application, you will be able to login using these username password pairs.

package com.ekiras.ss.config;

import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;

/**
 * @author ekiras
 */
@EnableWebSecurity
public class SpringSecurityConfigurer extends WebSecurityConfigurerAdapter{
    

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.inMemoryAuthentication()
                .withUser("ekansh")
                .password("password")
                .roles("USER", "ROLE");
        auth.inMemoryAuthentication()
                .withUser("admin")
                .password("admin")
                .roles("ADMIN");
    }

}

As shown in the code above, we have configured two user-password pairs,

username : user , password : user and role/authorities : USER.
username : admin , password : admin and role/authorities : ADMIN.

Note

You can use any of the above pairs to login and authenticate user. First, can be used for requests that can be accessed by USER role and Second can be used to access the requests with ADMIN role.

Also Read

Configure Spring Security with Spring boot

Configure JDBC Authetication using MYSQL Query

Authenticate User with Custom UserDetailsService

Implement Role Hierarchy with In-Memory Authentication

How to list the User Authorities in Controller,Filter and Services

Disable Session Creation for Stateless Authentication

    Download project from Github

Read More Add comment

SpringSecurity : How to configure Spring Security with Spring boot

By Ekansh Rastogi

Read

0 Comments

Read More Add comment

Spring Security : Getting started with Spring Security and Spring Boot

By Ekansh Rastogi

Read

0 Comments

Points To Remember

Add dependency of spring security
Add custom username password in application.properties
A unique password is generated each time application is started if no authentication process is specified.
You can configure your own authentication providers, managers, filters, entry points, tokens etc as required.

Getting started with Spring Security and Spring Boot

In order to apply Spring Security to a Spring Boot application, firstly you need to add the dependency in the application as follows

In Maven you can do it as follows.

<dependencies>
    <dependency>
        <groupId>org.springframework.security</groupId>
        <artifactId>spring-security-web</artifactId>
        <version>4.0.3.RELEASE</version>
    </dependency>
</dependencies>

In Gradle you can do it as follows.

dependencies {
    compile 'org.springframework.security:spring-security-web:4.0.3.RELEASE'
}

Your initial project may look like as shown in the image

Create a controller HomeController as in out case and just add a /home mapping for the application.

package com.ekiras.controller;

import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RestController;

/**
 * Created by ekansh on 18/11/15.
 */
@RestController
@RequestMapping(value = "/")
public class HomeController {

    @RequestMapping(value = "home")
    public String home(){
        return "Hello World";
    }
}

Now, just run the application using command

gradle run

Now open the application in browser, you will get a popup to enter the user name and password. This is the default security provided by spring security.

You can login using the default

username - user
password - generated at application startup as shown in image below

Note : A unique password is generated each time the application is started.

You can also create a custom username and password by specifying it in the application.properties as follows

security.user.name=ekansh
security.user.password=password

Now you can login with the credentials

username - ekansh
password - password

Read More Add comment

Spring Security : Custom UserDetailsService and Custom UserDetails

By Ekansh Rastogi

Read

0 Comments

Points To Remember

You need to change the UserDetailsService, User Object of the spring security to achieve this.

Add Custom User Details to Spring Security Authentication Object

First of all we nee to create a new User Object that will override the User class of the spring security in package org.springframework.security.core.userdetails.User After this, you need to tell UserDetailsService to use this object as the principal for the authentication token. For this you will have to override the UserDetailsService of the spring security.

You can have the custom User object like.
Custom User Class -> MyUser.groovy

package com.ekiras

import org.springframework.security.core.GrantedAuthority

/**
 * Created by ekansh on 24/1/15.
 */
class MyUser extends org.springframework.security.core.userdetails.User {

    // Declare all custom attributes here
    private final Object id;
    private String name;

    public MyUser(String username, String password, boolean enabled, boolean accountNonExpired,
                      boolean credentialsNonExpired, boolean accountNonLocked,
                      Collection<GrantedAuthority> authorities, Object id, String name) {
        super(username, password, enabled, accountNonExpired, credentialsNonExpired,
                accountNonLocked, authorities);

        // Initialize all the custom attributes here like the following.
        this.id = id;
        this.name = name;
    }

    /**
     * Get the id.
     * @return the id
     */
    public Object getId() {
        return id;
    }
}

So now our User object will also contain a field name that is the concatenation of first name and last name.
Custom UserDertailService -> MyUserDetailsService.groovy

package com.ekiras

import grails.plugin.springsecurity.SpringSecurityUtils
import grails.plugin.springsecurity.userdetails.NoStackUsernameNotFoundException
import org.springframework.security.core.GrantedAuthority
import org.springframework.security.core.authority.SimpleGrantedAuthority
import org.springframework.security.core.userdetails.UserDetails
import org.springframework.security.core.userdetails.UserDetailsService
import org.springframework.security.core.userdetails.UsernameNotFoundException

/**
 * Created by ekansh on 23/1/15.
 */
class MyUserDetailsService implements UserDetailsService {

    static final GrantedAuthority NO_ROLE = new SimpleGrantedAuthority(SpringSecurityUtils.NO_ROLE)

    @Override
    UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {

        User user = User.findByUsername(username)
        if(!user)
            throw new NoStackUsernameNotFoundException();
        
        Collection<GrantedAuthority> authorities;
        
        user.authorities.each {authority->
            authorities.collect(new SimpleGrantedAuthority(authority))
        }
        
        authorities = authorities ?: [NO_ROLE]

        // Return the Custom User object 
        return new MyUser(username, user.password, user.enabled, !user.accountExpired, !user.passwordExpired,!user.accountLocked, authorities, user.id, user.firstName+ user.lastName);
    }
}

So now we have a custom UserDetailsService that will load our MyUser object in spring security authentication principal, instead of conventional GromUser object. You need to do one last thing to make things work. You need to override the UserDetailsService and tell spring security to use your custom UserDetailsService and you can do it like the following.
Add this in resources.groovy

userDetailsService(MyUserDetailsService)

Thats it, now you have can add any number of custom attributes of the User object to spring security authentication.

Read More Add comment

Spring Security : Create a Custom Authentication Filter

By Ekansh Rastogi

Read

0 Comments

Points To Remember

You may need to create an AuthenticatioFilter when you want to create a custom logic for handling the authentication filter. You may also want to create your own Authentication Provider, Entry Point, Authentication Token etc to customize the authentication process to a new level.

Step 1 : Create a Filter

Let us first create a class named MyAuthenticationFilter and then register it as a bean in resources.groovy. After we have created the class and registered the it as a bean, we can use this class as a filter for our custom spring security authentication.

Class : MyAuthenticationFilter.groovy

package com.ekiras

import org.springframework.context.ApplicationEventPublisher
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken
import org.springframework.security.authentication.event.InteractiveAuthenticationSuccessEvent
import org.springframework.security.core.Authentication
import org.springframework.security.core.AuthenticationException
import org.springframework.security.core.context.SecurityContextHolder
import org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter
import org.springframework.security.web.authentication.AuthenticationFailureHandler
import org.springframework.security.web.authentication.AuthenticationSuccessHandler

import javax.servlet.FilterChain
import javax.servlet.ServletException
import javax.servlet.ServletRequest
import javax.servlet.ServletResponse
import javax.servlet.http.HttpServletRequest
import javax.servlet.http.HttpServletResponse

/**
 * Created by ekansh on 19/1/15.
 */
class MyAuthenticationFilter extends AbstractAuthenticationProcessingFilter{

    public static final String USERNAME = 'j_username';
    public static final String PASSWORD = 'j_password';


    AuthenticationSuccessHandler authenticationSuccessHandler
    AuthenticationFailureHandler authenticationFailureHandler
    ApplicationEventPublisher applicationEventPublisher



    protected MyAuthenticationFilter() {
        super('/mylogin') // Register the url that will be intercepted by this filter.
    }

    @Override
    public void doFilter(ServletRequest req, ServletResponse resp, FilterChain chain)  throws IOException, ServletException {
        HttpServletRequest request = (HttpServletRequest) req
        HttpServletResponse response = (HttpServletResponse) resp
            //Check if the url contains the filterProcessUrl and required authentication is false, if not then pass the request to the next filter. 
        if (!request.getRequestURI().contains(filterProcessesUrl) && !requiresAuthentication(request, response)) {
            chain.doFilter(request, response)
            return
        }

        // Create an authentication token that will be returned.
        Authentication authentication;
        try{ // If the credentials to not match then an AuthenticationException is thrown.
            authentication = attemptAuthentication(request, response)
            // If successfully authenticated then pass the request to the success handler
            if(authentication.authenticated)
                successfulAuthentication(request,response,authentication)
        }
        catch(AuthenticationException exception){
            // Pass the request to authentication failure handler.
            unsuccessfulAuthentication(request,response,exception)
            return
        }
    }

    @Override
    protected boolean requiresAuthentication(HttpServletRequest request, HttpServletResponse response) {
        return true;
    }


    @Override
    Authentication attemptAuthentication(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse) throws AuthenticationException, IOException, ServletException {

        String username = getUsername(httpServletRequest);
        String password = getPassword(httpServletRequest);

        Authentication authentication = new UsernamePasswordAuthenticationToken(username, password);

        return this.authenticationManager.authenticate(authentication);
    }
    @Override
    protected void successfulAuthentication(HttpServletRequest request, HttpServletResponse response, Authentication authentication) throws IOException, ServletException{
        SecurityContextHolder.getContext().setAuthentication(authentication)
        applicationEventPublisher.publishEvent(new InteractiveAuthenticationSuccessEvent(authentication, this.class))
        authenticationSuccessHandler.onAuthenticationSuccess(request,response,authentication)
    }

    @Override
    protected void unsuccessfulAuthentication(HttpServletRequest request, HttpServletResponse response, AuthenticationException exception) throws IOException, ServletException{
        authenticationFailureHandler.onAuthenticationFailure(request,response, exception)
    }

    // Get the username from the request object
    String getUsername(HttpServletRequest request){
        return request.getParameter(USERNAME);
    }

    // get the password from the request object
    String getPassword(HttpServletRequest request){
        return request.getParameter(PASSWORD);
    }
}

Now we register the class as a spring bean in resources.groovy like this.

    myAuthenticationFilter(MyAuthenticationFilter){
        authenticationManager = ref('authenticationManager')
        sessionAuthenticationStrategy = ref('sessionAuthenticationStrategy')
        authenticationSuccessHandler = ref('authenticationSuccessHandler')
        authenticationFailureHandler = ref('authenticationFailureHandler')
        rememberMeServices = ref('rememberMeServices')
        authenticationDetailsSource = ref('authenticationDetailsSource')
        filterProcessesUrl = '/mylogin'
    }

Now you need to register this filter in the deployment descriptor so that the these effects take place. There are two ways of doing this

You can declare your filter using a filter chain in Config.groovy. See the documentation how to do this.

You can declare the filter in bootsrap as following

SpringSecurityUtils.clientRegisterFilter('myAuthenticationFilter', SecurityFilterPosition.SECURITY_CONTEXT_FILTER.order + 10)

How to disable Session Creation for Stateless Authentication

Pros

Cons

Points To Remember

Authenticate User with Custom UserDetailsService

Step 1 : Create Entities for User and Role

Create Entity User

Create Entity Role

Step 2 : Create CustomUserDetailsService

Step 3 : Register our Custom UserDetailsService to SpringSecurity as a Bean

Create Database Schema and tables

Configure JDBC Authetication using MYSQL Query.

Step 1 : Add the Dependencies

Step 2 : Add the Datasource properties

Step 3 : Add the Datasource Bean to SpringSecurity Configurer class

Add queries to be fired for user authentication

How to get the User Authorities in Controller,Filter and Services

Configure Spring Security to Authenticate user using In-Memory Authentication.

How to integrate Spring Security with Spring boot

Basic Spring Security Configurations

Spring Security Configurations with defined username and password

Points To Remember

Getting started with Spring Security and Spring Boot

Points To Remember

Add Custom User Details to Spring Security Authentication Object

Points To Remember

Step 1 : Create a Filter

Points To Remember

Integrate Spring Security in Grails

Points To Remember

Program : Test CAS Rest Api from a Java Code

Recent Posts

Facebook