Ekiras Blogs

SpringDataJPA : One to one Mapping in Spring Boot Hibernate JPA with Spring Data

Read

Also Read

One To Many Mapping

Let's create two classes Employee and Address, such that they have the following relation between them.

Employee has-a Address which means a one-to-one mapping between the two and Employee is the owner of the relation.

Owner of the relation means that Owner can exist without the dependent entity but dependent entity cannot stay without the owner entity.

Dependent Entity of Relationship will containes the 'foreign key' ID of the Owner entity. In this case, Address will contian the Employee Id in its table as shown in the table structure below.

This means that Employee can stay without an Address but Address cannot stay without the Employee. In even more simpler words, If employee is deleted his address should also be deleted, but if address is deleted employee should not be deleted.

Employee.java

package com.ekiras.domain;

import javax.persistence.*;
import java.util.Date;

/**
 * @author ekiras
 */
@Entity
public class Employee {

    @Id
    @GeneratedValue(strategy = GenerationType.AUTO)
    protected long id;

    @Temporal(TemporalType.TIMESTAMP)
    protected Date dateCreated;

    @Temporal(TemporalType.TIMESTAMP)
    protected Date lastUpdated;

    private String email;
    private String name;
    private String password;
    
    @OneToOne(mappedBy = "employee",optional = false,cascade = CascadeType.ALL)
    private Address address;


    @Override
    public String toString() {
        return "Employee{" +
                "id=" + id +
                ", dateCreated=" + dateCreated +
                ", lastUpdated=" + lastUpdated +
                ", email='" + email + '\'' +
                ", name='" + name + '\'' +
                ", password='" + password + '\'' +
                '}';
    }
    // getters and setters
}

Address.java

package com.ekiras.domain;

import javax.persistence.*;
import java.util.Date;

/**
 * @author ekiras
 */
@Entity
public class Address {

    @Id
    @GeneratedValue(strategy = GenerationType.AUTO)
    private long id;

    @Temporal(TemporalType.TIMESTAMP)
    protected Date dateCreated;

    @Temporal(TemporalType.TIMESTAMP)
    protected Date lastUpdated;

    private String address;

    @OneToOne(fetch = FetchType.LAZY)
    private Employee employee;

    @Override
    public String toString() {
        return "Address{" +
                "id=" + id +
                ", dateCreated=" + dateCreated +
                ", lastUpdated=" + lastUpdated +
                ", address='" + address + '\'' +
                ", employee=" + employee +
                '}';
    }
    // getters and setters
}

Following Tables will be created from the Entities defined above.

mysql> show tables;
+-----------------------+
| Tables_in_jpa_mapping |
+-----------------------+
| address               |
| employee              |
+-----------------------+
2 rows in set (0.00 sec)

mysql> desc employee;
+--------------+--------------+------+-----+---------+----------------+
| Field        | Type         | Null | Key | Default | Extra          |
+--------------+--------------+------+-----+---------+----------------+
| id           | bigint(20)   | NO   | PRI | NULL    | auto_increment |
| date_created | datetime     | YES  |     | NULL    |                |
| email        | varchar(255) | YES  |     | NULL    |                |
| last_updated | datetime     | YES  |     | NULL    |                |
| name         | varchar(255) | YES  |     | NULL    |                |
| password     | varchar(255) | YES  |     | NULL    |                |
+--------------+--------------+------+-----+---------+----------------+
6 rows in set (0.00 sec)

mysql> desc address;
+--------------+--------------+------+-----+---------+----------------+
| Field        | Type         | Null | Key | Default | Extra          |
+--------------+--------------+------+-----+---------+----------------+
| id           | bigint(20)   | NO   | PRI | NULL    | auto_increment |
| address      | varchar(255) | YES  |     | NULL    |                |
| date_created | datetime     | YES  |     | NULL    |                |
| last_updated | datetime     | YES  |     | NULL    |                |
| employee_id  | bigint(20)   | YES  | MUL | NULL    |                |
+--------------+--------------+------+-----+---------+----------------+
5 rows in set (0.00 sec)

You can save the object's as shown in the example below

    public void test(){
    
        // create employee object
        Employee employee = new Employee();
        employee.setName("Ekansh");
        employee.setEmail("ekansh@ekiras.com");
        employee.setPassword("pwd");

        // create Address object
        Address address = new Address();
        address.setAddress("Some Address");

        employee.setAddress(address);
        
        // actual save call for the object
        employeeRepository.save(employee);

    }

Following are the images that show the working of the One-TO-One mapping.

Initial Interface

Download from GITHUB

SpringDataJpa : How to override the domain mapping defined in Parent Entity class with MappedSuperclass

Read

Download code from GITHUB

Points To Remember

Your Parent class should be annotated with @MappedSuperclass.
Follow the Tutorial : How to handle Inheritence with Entities to know how to wrap common properties of entities to a base class.
To override any property you must
a. Apply the @AttributeOverride annotation on the class that need to override the property
b. set name property of @AttributeOverride as the name of the field in super class.
c. set the column property of @AttributeOverride to override the column definition of the attribute.

Let's say our Base class looks as follows

package com.ekiras.domain.base;

import javax.persistence.*;
import java.util.Date;

/**
* @author ekiras
*/
@MappedSuperclass
public abstract class BaseDomain {

  @Id
  @GeneratedValue(strategy = GenerationType.AUTO)
  protected long id;

  @Temporal(TemporalType.TIMESTAMP)
  protected Date dateCreated;

  @Temporal(TemporalType.TIMESTAMP)
  protected Date lastUpdated;

  @Override
  public String toString() {
      return "BaseDomain{" +
              "id=" + id +
              ", dateCreated=" + dateCreated +
              ", lastUpdated=" + lastUpdated +
              '}';
  }
  // getters and setters
}

We can override the id field of the BaseDomain class in inheriting class as follows

package com.ekiras.domain;

import com.ekiras.domain.base.BaseDomain;

import javax.persistence.AttributeOverride;
import javax.persistence.Column;
import javax.persistence.Entity;

/**
 * @author ekiras
 */
@Entity
@AttributeOverride(name = "id",column = @Column(name = "userId"))
public class User extends BaseDomain{

    private String email;
    private String name;
    private String password;

    // getters and setters
}

As shown in the code above we have used @AttributeOverride

@AttributeOverride(name = "id",column = @Column(name = "userId"))

Here, name= "id" states that we are going to override the mapping for the id field of the super class. column = @Column(name = "userId") states the new configuration of the id defined in the super class. Here we simple change the name of the column for table user defined by class User.

This will create the table user as shown below.

mysql> show tables;
+-----------------------+
| Tables_in_jpa_mapping |
+-----------------------+
| user                  |
+-----------------------+
1 row in set (0.00 sec)

mysql> desc user;
+--------------+--------------+------+-----+---------+----------------+
| Field        | Type         | Null | Key | Default | Extra          |
+--------------+--------------+------+-----+---------+----------------+
| user_id      | bigint(20)   | NO   | PRI | NULL    | auto_increment |
| date_created | datetime     | YES  |     | NULL    |                |
| last_updated | datetime     | YES  |     | NULL    |                |
| email        | varchar(255) | YES  |     | NULL    |                |
| name         | varchar(255) | YES  |     | NULL    |                |
| password     | varchar(255) | YES  |     | NULL    |                |
+--------------+--------------+------+-----+---------+----------------+
6 rows in set (0.00 sec)

@AttributeOverride

May be applied to an entity that extends a mapped superclass or to an embedded field or
property to override a basic mapping or id mapping defined by the mapped superclass or embeddable class (or embeddable class of one of its attributes).

May be applied to an element collection containing instances of an embeddable class or to a map collection whose key and/or value is an embeddable class. When AttributeOverride is applied to a map, "key." or "value." must be used to prefix the name of the attribute that is being overridden in order to specify it as part of the map key or map value.

To override mappings at multiple levels of embedding, a dot (".") notation form must be used in the name element to indicate an attribute within an embedded attribute. The value of each identifier used with the dot notation is the name of the respective embedded field or property.

SpringBoot : How to create a Filter in Spring Boot Application

Read

Points To Remember

Implement the class Filter.
Add @Configuration annotation to the class to register it as a filter bean.
Call method

filterChain.doFilter(resquest,response) to continue the request flow

Call method sendError to send error,

((HttpServletResponse)response).sendError(HttpServletResponse.SC_BAD_REQUEST);

Call method sendRedirect to redirect request to error handler
```
((HttpServletResponse)response).sendRedirect("/errorUrl");
```

How to create a Filter in Spring Boot Application

IN order to make a filter, we have create a class SecurityFilter

package com.ekiras.filter;
import org.springframework.core.Ordered;
import org.springframework.core.annotation.Order;
import org.springframework.stereotype.Component;
import javax.servlet.*;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
/**
* @author ekansh
*/
@Component
@Order(Ordered.HIGHEST_PRECEDENCE)
public class SecurityFilter implements Filter {
private static final boolean CONDITION = true;
@Override
public void init(FilterConfig filterConfig) throws ServletException {
}
@Override
public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
if(CONDITION==true)
chain.doFilter(request,response);
else{
((HttpServletResponse)response).setStatus(HttpServletResponse.SC_BAD_REQUEST);
}
}
@Override
public void destroy() {
}
}

package com.ekiras.filter;

import org.springframework.core.Ordered;
import org.springframework.core.annotation.Order;
import org.springframework.stereotype.Component;

import javax.servlet.*;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;

/**
 * @author ekansh
 */
@Component
@Order(Ordered.HIGHEST_PRECEDENCE)
public class SecurityFilter implements Filter {

    private static final boolean CONDITION = true;

    @Override
    public void init(FilterConfig filterConfig) throws ServletException {

    }

    @Override
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
        if(CONDITION==true)
            chain.doFilter(request,response);
        else{
            ((HttpServletResponse)response).setStatus(HttpServletResponse.SC_BAD_REQUEST);
        }

    }

    @Override
    public void destroy() {

    }
}

This is how you can create the filter and register it in the Spring Boot Application.

SpringBoot : What is Spring Boot

Read

Spring : Difference between @Autowired, @Inject and @Resource

Read

Points To Remember

@Inject is not a spring feature you need to include javax inject dependency in order to use @Inject.
@Autowired is Spring annotation used to inject dependency just like @Inject. It use @Qualifier annotation to differentiate between the beans.
@Resource is also Spring annotation, but it uses bean name to inject dependencies and differentiate between beans.

Problem Statement :: Structure

In order to show how @Autowired @Inject and @Resource annotations work we will create 3 services

Interface PersonService, this is the interface for all person related operations.
Class EngineerService, this is the service that will do operations for engineer.
Class ManagerService, this is the service that will do operations for manager.

Here, both EngineerService and ManagerService implements PersonService. Now we will try to add the services to a controller by different ways to test how @Autowire, @Inject and @Resource will work.

So the above structure looks like as shown in the code below.

public interface PersonService {
public String getName();
}
@Service
public class EngineerService implements PersonService {
@Override
public String getName() {
return "EngineerService";
}
}
@Service
public class ManagerService implements PersonService {
@Override
public String getName() {
return "ManagerService";
}
}

public interface PersonService {

    public String getName();
}


@Service
public class EngineerService implements PersonService {

    @Override
    public String getName() {
        return "EngineerService";
    }

}

@Service
public class ManagerService implements PersonService {

    @Override
    public String getName() {
        return "ManagerService";
    }
}

Test with @Autowired annotations

Parent Reference Type and name
view plain copy to clipboard print ?
1. @RestController
2. public class PersonController {
4. @Autowired
5. private PersonService personService;
7. @Resource
8. private PersonService personService;
10. @Inject
11. private PersonService personService;
12. }
@RestController public class PersonController { @Autowired private PersonService personService; @Resource private PersonService personService; @Inject private PersonService personService; }
In this case @Autowired @Inject and @Resource all will throw the following exception.

Caused by: org.springframework.beans.factory.NoUniqueBeanDefinitionException
Parent Reference Type and Child Reference Name
view plain copy to clipboard print ?
1. @RestController
2. public class PersonController {
4. @Autowired
5. private PersonService engineerService;
7. @Resource
8. private PersonService engineerService;
10. @Inject
11. private PersonService engineerService;
13. }
@RestController public class PersonController { @Autowired private PersonService engineerService; @Resource private PersonService engineerService; @Inject private PersonService engineerService; }
In this case, all @Autowired, @Inject and @Resource annotations will inject EngineerService, and getName() will return "EngineerService".
Note :: When beans are created, they are created by name of the class, EngineerService will resolve to engineerService and its bean will be resolved by name engineerService. Hence when we try to use it with PersonService engineerService , this will inject engineerService bean.
view plain copy to clipboard print ?
1. public interface PersonService {
3. public String getName();
4. }
6. @Service
7. @Qualifier(value = "engineer")
8. public class EngineerService implements PersonService {
10. @Override
11. public String getName() {
12. return "EngineerService";
13. }
15. }
17. @Service
18. @Qualifier(value = "manager")
19. public class ManagerService implements PersonService {
21. @Override
22. public String getName() {
23. return "ManagerService";
24. }
25. }
27. @RestController
28. public class PersonController {
30. @Autowired
31. @Qualifier(value = "engineer")
32. private PersonService personService;
34. @Resource
35. @Qualifier(value = "engineer")
36. private PersonService personService;
38. @Inject
39. @Qualifier(value = "engineer")
40. private PersonService personService;
42. }
public interface PersonService { public String getName(); } @Service @Qualifier(value = "engineer") public class EngineerService implements PersonService { @Override public String getName() { return "EngineerService"; } } @Service @Qualifier(value = "manager") public class ManagerService implements PersonService { @Override public String getName() { return "ManagerService"; } } @RestController public class PersonController { @Autowired @Qualifier(value = "engineer") private PersonService personService; @Resource @Qualifier(value = "engineer") private PersonService personService; @Inject @Qualifier(value = "engineer") private PersonService personService; }
In this case, all will inject the EngineerService bean to the PersonCOntroller. This is because we have given names to beans using @Qualifier annotation and then used them with the same name.
Ambiguous Qualifiers with Parent Reference Type and name
view plain copy to clipboard print ?
1. public interface PersonService {
3. public String getName();
4. }
6. @Service
7. @Qualifier(value = "person")
8. public class EngineerService implements PersonService {
10. @Override
11. public String getName() {
12. return "EngineerService";
13. }
15. }
17. @Service
18. @Qualifier(value = "person")
19. public class ManagerService implements PersonService {
21. @Override
22. public String getName() {
23. return "ManagerService";
24. }
25. }
27. @RestController
28. public class PersonController {
30. @Autowired
31. @Qualifier(value = "person")
32. private PersonService personService;
34. @Resource
35. @Qualifier(value = "person")
36. private PersonService personService;
38. @Inject
39. @Qualifier(value = "person")
40. private PersonService personService;
42. }
public interface PersonService { public String getName(); } @Service @Qualifier(value = "person") public class EngineerService implements PersonService { @Override public String getName() { return "EngineerService"; } } @Service @Qualifier(value = "person") public class ManagerService implements PersonService { @Override public String getName() { return "ManagerService"; } } @RestController public class PersonController { @Autowired @Qualifier(value = "person") private PersonService personService; @Resource @Qualifier(value = "person") private PersonService personService; @Inject @Qualifier(value = "person") private PersonService personService; }
In this case, since the qualifiers are ambiguous, all the three will result in the exception.

Caused by: org.springframework.beans.factory.NoUniqueBeanDefinitionException

This is because spring will not be able to find a unique bean with the qualifier "person".
Ambiguous Qualifiers with Parent Reference type and Child Reference name
view plain copy to clipboard print ?
1. public interface PersonService {
3. public String getName();
4. }
6. @Service
7. @Qualifier(value = "engineer")
8. public class EngineerService implements PersonService {
10. @Override
11. public String getName() {
12. return "EngineerService";
13. }
15. }
17. @Service
18. @Qualifier(value = "manager")
19. public class ManagerService implements PersonService {
21. @Override
22. public String getName() {
23. return "ManagerService";
24. }
25. }
27. @RestController
28. public class PersonController {
30. @Autowired
31. @Qualifier(value = "engineer")
32. private PersonService engineerService;
34. @Resource
35. @Qualifier(value = "engineer")
36. private PersonService engineerService;
38. @Inject
39. @Qualifier(value = "engineer")
40. private PersonService engineerService;
42. }
public interface PersonService { public String getName(); } @Service @Qualifier(value = "engineer") public class EngineerService implements PersonService { @Override public String getName() { return "EngineerService"; } } @Service @Qualifier(value = "manager") public class ManagerService implements PersonService { @Override public String getName() { return "ManagerService"; } } @RestController public class PersonController { @Autowired @Qualifier(value = "engineer") private PersonService engineerService; @Resource @Qualifier(value = "engineer") private PersonService engineerService; @Inject @Qualifier(value = "engineer") private PersonService engineerService; }
In this case, @Autowired and @Inject will throw the following exception

Caused by: org.springframework.beans.factory.NoUniqueBeanDefinitionException
But, @Resouce will still inject the EngineerService bean.

Hence following conclusion can be made on the basis of the above test scenario's

All, @Autowired, @Inject and @Resource throws exception with Ambiguous Bean names.
If Unique Qualifiers are used, all will inject the specified beans.
If Ambiguous beans are there only @Resouce can inject beans based on names of Bean name.

SpringBoot : How to display static html file in Spring boot MVC application

Read

Points To Remember

In order to serve static files like js, css, images etc ,all your files should be under the resources/static folder. Spring application can serve all the static files inside folders

resources/static/
resources/public/

In order to serve html files from spring boot application

your html files should be under static/public folder
you need to add view controller to serve html file

How to display static html file in Spring boot MVC application

Step 1 : Extend Class WebMvcConfigurerAdapter

You should create a class that extends WebMvcConfigurerAdapter
Your class should have @Configuration annotation.
You class should not have @EnableMvc annotation.
Override addViewControllers method and add your mapping.
Override configurePathMatch method and update suffix path matching.

@Configuration
public class MvcConfigurer extends WebMvcConfigurerAdapter {
@Override
public void addViewControllers(ViewControllerRegistry registry) {
registry.addViewController("/error").setViewName("error.html");
registry.setOrder(Ordered.HIGHEST_PRECEDENCE);
}
@Override
public void configurePathMatch(PathMatchConfigurer configurer) {
super.configurePathMatch(configurer);
configurer.setUseSuffixPatternMatch(false);
}
}

@Configuration
public class MvcConfigurer extends WebMvcConfigurerAdapter {

    @Override
    public void addViewControllers(ViewControllerRegistry registry) {
        registry.addViewController("/error").setViewName("error.html");
        registry.setOrder(Ordered.HIGHEST_PRECEDENCE);
    }

    @Override
    public void configurePathMatch(PathMatchConfigurer configurer) {
        super.configurePathMatch(configurer);
        configurer.setUseSuffixPatternMatch(false);
    }


}

In the above code we have added a mapping for "/error" to show "/error.html"
Set the registry order to highest precedence, otherwise app will not render the page.
Ovveride configurePathMatch to set suffix pattern to false, this will allow /error to render /error.html

NOTE :: Similarly you can add other mappings to display your html pages. To add a default landing page to the application you can add "index.html" under static folder. For index file, you do not need to add any mapping.

Download from Github

SpringBoot : How to run Spring boot application to custom port

Read

SpringSecurity : How to disable Session Creation for Stateless Authentication

Read

How to disable Session Creation for Stateless Authentication

We need to disable session creation for authenticating requests based on token based authentication.
This can be easily configured by the following configurations.

package com.ekiras.ss.security.config;
import com.ekiras.ss.security.filter.TokenAuthenticationFilter;
import org.springframework.context.annotation.Bean;
import org.springframework.core.Ordered;
import org.springframework.core.annotation.Order;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.config.http.SessionCreationPolicy;
import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
/**
* @author ekansh
* @since 11/4/16
*/
@EnableWebSecurity
@Order(Ordered.LOWEST_PRECEDENCE-100)
public class RestSecurityConfigurerAdapter extends WebSecurityConfigurerAdapter {
@Override
protected void configure(HttpSecurity http) throws Exception {
http.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);
}
}

package com.ekiras.ss.security.config;

import com.ekiras.ss.security.filter.TokenAuthenticationFilter;
import org.springframework.context.annotation.Bean;
import org.springframework.core.Ordered;
import org.springframework.core.annotation.Order;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.config.http.SessionCreationPolicy;
import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;

/**
 * @author ekansh
 * @since 11/4/16
 */
@EnableWebSecurity
@Order(Ordered.LOWEST_PRECEDENCE-100)
public class RestSecurityConfigurerAdapter extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {

        http.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);

    }




}

The above configurations, will force the application to stop creating sessions and storing authentication data in session i.e The SecurityContextHolder will not be holding the authentication for each authentication.

Pros

Each call will be stateless.
No session will be created or maintained.
Very good for rest applications.
Authentication expiry will be handled by the token expiry

Cons

Response time will increase, as each request needs to be authenticated every time.
To maintain state of an authenticated request you need to persist token, if auth token can be used multiple times.

SpringSecurity : Authenticate User with Custom UserDetailsService

Read

Points To Remember

Create class that implement UserDetailsService and override loadUserByUsername() method.
Throw UsernameNotFoundException if no user was found by username.
Register this class as a bean by overriding WebSecurityConfigurerAdapter.

Authenticate User with Custom UserDetailsService

Step 1 : Create Entities for User and Role

Create Entity User

package com.ekiras.ss.domain;

import javax.persistence.*;
import java.util.Set;

/**
 * @author ekiras
 */
 
@Entity
public class User {

    @Id
    @GeneratedValue(strategy = GenerationType.AUTO)
    private long id;

    private String username;

    private String password;

    private boolean enabled;

    @ManyToMany(fetch = FetchType.EAGER,cascade = CascadeType.ALL)
    @JoinTable(joinColumns = @JoinColumn(name = "user_id"),inverseJoinColumns = @JoinColumn(name = "role_id"))
    private Set<role> roles;

    // GETTERS and SETTERS
}

Create Entity Role

package com.ekiras.ss.domain;

import javax.persistence.*;
import java.util.Set;

/**
 * @author ekiras
 */
 
@Entity
public class Role {

    @Id
    @GeneratedValue(strategy = GenerationType.AUTO)
    private long id;

    private String role;

    @ManyToMany(mappedBy = "roles",fetch = FetchType.LAZY)
    private Set<user> users;

    // GETTERS and SETTERS
}

This will create three tables in your database

user
role
user_roles

Step 2 : Create CustomUserDetailsService

Now, create a new class named as SSUserDetailsService that implements UserDetailsService and override the loadUserByUsername() method as follows.

package com.ekiras.ss.config;

import com.ekiras.ss.domain.Role;
import com.ekiras.ss.domain.User;
import com.ekiras.ss.repository.UserRepository;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.authority.SimpleGrantedAuthority;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.core.userdetails.UsernameNotFoundException;

import javax.transaction.Transactional;
import java.util.HashSet;
import java.util.Set;

/**
 * @author ekiras
 */
 
@Transactional
public class SSUserDetailsService implements UserDetailsService {

    private static final Logger LOGGER = LoggerFactory.getLogger(SSUserDetailsService.class);

    private UserRepository userRepository;

    public SSUserDetailsService(UserRepository userRepository){
        this.userRepository=userRepository;
    }

    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        try {
            User user = userRepository.findByUsername(username);
            if (user == null) {
                LOGGER.debug("user not found with the provided username");
                return null;
            }
            LOGGER.debug(" user from username " + user.toString());
            return new org.springframework.security.core.userdetails.User(user.getUsername(), user.getPassword(), getAuthorities(user));
        }
        catch (Exception e){
            throw new UsernameNotFoundException("User not found");
        }
    }

    private Set<grantedauthority> getAuthorities(User user){
        Set<grantedauthority> authorities = new HashSet<grantedauthority>();
        for(Role role : user.getRoles()) {
            GrantedAuthority grantedAuthority = new SimpleGrantedAuthority(role.getRole());
            authorities.add(grantedAuthority);
        }
        LOGGER.debug("user authorities are " + authorities.toString());
        return authorities;
    }


}

This class will load the User from username. When the login form is submitted, spring security will use this class to load the user by the username provided. If the User is not found with that name then the UsernameNotFoundException is thrown.

Note

loadUserByUsername() method should return an object of UserDetails. You can user two constructors to return this object

org.springframework.security.core.userdetails.User class

Object of any other class that implements UserDetails interface

Step 3 : Register our Custom UserDetailsService to SpringSecurity as a Bean

Now, we need to register this class as a bean and tell spring security to use this class for loading user from database. So, first we will override the userDetailsBean

    @Autowired private UserRepository userRepository;

    @Override
    public UserDetailsService userDetailsServiceBean() throws Exception {
        return new SSUserDetailsService(userRepository);
    }

Note
We will pass the bean UserRepository to the UserDetailsService because this bean will be loaded before the repository is loaded, so we might get the useeRepository bean as null in out SSUserDetailsService.

Now we will configure spring security to use our UserDetailsService as follows

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.userDetailsService(userDetailsServiceBean());
    }

So, our spring security configurer may look like as shown in code below.

package com.ekiras.ss.config;

import com.ekiras.ss.repository.UserRepository;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.web.util.matcher.AntPathRequestMatcher;

/**
 * @author ekiras
 */
 
@Configuration
@EnableWebSecurity
public class SpringSecurityConfigurer extends WebSecurityConfigurerAdapter{

    @Autowired private UserRepository userRepository;

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.userDetailsService(userDetailsServiceBean());
    }

    @Override
    public UserDetailsService userDetailsServiceBean() throws Exception {
        return new SSUserDetailsService(userRepository);
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
            .authorizeRequests()
                .antMatchers("/admin/**").hasAuthority("ADMIN")
                .antMatchers("/user/**").hasAuthority("USER")
                .anyRequest().authenticated()
            .and()
            .formLogin()
            .and()
            .logout().logoutRequestMatcher(new AntPathRequestMatcher("/logout")).logoutSuccessUrl("/login");
        ;
    }





}

Also Read

Configure Spring Security with Spring boot

Configure JDBC Authetication using MYSQL Query

Authenticate User with Custom UserDetailsService

Implement Role Hierarchy with In-Memory Authentication

How to list the User Authorities in Controller,Filter and Services

Disable Session Creation for Stateless Authentication

    Download from Github

SpringSecurity : Configure JDBC Authetication using MYSQL Query

Read

Create Database Schema and tables

First we will create a Database Schema as shown in the image below.

Sql schema

We have to create 3 Tables in database.

user - to hold the user data.
role - to hold the data of roles that a user can have.
user_roles - to hold the mapping of user and roles.

Configure JDBC Authetication using MYSQL Query.

Step 1 : Add the Dependencies

 compile('org.springframework.boot:spring-boot-starter-data-jpa')
 runtime('mysql:mysql-connector-java')

Step 2 : Add the Datasource properties

spring.jpa.hibernate.ddl-auto=update

spring.datasource.url=jdbc:mysql://localhost/demo_ss
spring.datasource.username=root
spring.datasource.password=root
spring.datasource.driver-class-name=com.mysql.jdbc.Driver
spring.datasource.maxActive=10
spring.datasource.max-idle=4
spring.datasource.min-idle=2
spring.datasource.test-while-idle=true
spring.datasource.test-on-borrow=true
spring.datasource.validation-query=SELECT 1
spring.datasource.time-between-eviction-runs-millis=60000
spring.datasource.min-evictable-idle-time-millis=300000
spring.jpa.properties.hibernate.current_session_context_class=org.springframework.orm.hibernate4.SpringSessionContext

Step 3 : Add the Datasource Bean to SpringSecurity Configurer class

    @Autowired
    private DataSource dataSource;

Add queries to be fired for user authentication

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.jdbcAuthentication()
                .usersByUsernameQuery("select username,password,enabled from user where username=?")
                .authoritiesByUsernameQuery("select u.username,r.role from user u inner join user_roles ur on(u.id=ur.user_id) inner join role r on(ur.role_id=r.id)  where u.username=?")
                .dataSource(dataSource);
        auth.userDetailsService(userDetailsService());
    }

Following code will demonstrate how to configure spring security to authenticate the user using a simple mysql query.

package com.ekiras.ss.config;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;

import javax.sql.DataSource;

/**
 * @author ekiras
 */
@EnableWebSecurity
public class SpringSecurityConfigurer extends WebSecurityConfigurerAdapter{

    @Autowired
    private DataSource dataSource;

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.jdbcAuthentication()
                .usersByUsernameQuery("select username,password,enabled from user where username=?")
                .authoritiesByUsernameQuery("select u.username,r.role from user u inner join user_roles ur on(u.id=ur.user_id) inner join role r on(ur.role_id=r.id)  where u.username=?")
                .dataSource(dataSource);
        auth.userDetailsService(userDetailsService());
    }


    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
            .authorizeRequests()
                .antMatchers("/admin/**").hasAuthority("ADMIN")
                .antMatchers("/user/**").hasAuthority("USER")
                .anyRequest().fullyAuthenticated()
                .and()
            .formLogin()
            .and()
            .logout()
        ;
    }
}

Also Read

Configure Spring Security with Spring boot

Configure JDBC Authetication using MYSQL Query

Authenticate User with Custom UserDetailsService

Implement Role Hierarchy with In-Memory Authentication

How to list the User Authorities in Controller,Filter and Services

Disable Session Creation for Stateless Authentication

    Download from Github

SpringSecurity : Implement Role Hierarchy with In-Memory Authentication

Read

Implement Role Hierarchy with In-Memory Authentication

In order to configure role hierarchy, you need to

make a bean RoleHierarchy
define a expressionhandler to read role hierarchy

package com.ekiras.ss.config;

import org.springframework.context.annotation.Bean;
import org.springframework.security.access.expression.SecurityExpressionHandler;
import org.springframework.security.access.hierarchicalroles.RoleHierarchy;
import org.springframework.security.access.hierarchicalroles.RoleHierarchyImpl;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.web.FilterInvocation;
import org.springframework.security.web.access.expression.DefaultWebSecurityExpressionHandler;

/**
 * @author ekiras
 */
@EnableWebSecurity
public class SpringSecurityConfigurer extends WebSecurityConfigurerAdapter{

    private SecurityExpressionHandler<filterinvocation> webExpressionHandler() {
        DefaultWebSecurityExpressionHandler defaultWebSecurityExpressionHandler = new DefaultWebSecurityExpressionHandler();
        defaultWebSecurityExpressionHandler.setRoleHierarchy(roleHierarchy());
        return defaultWebSecurityExpressionHandler;
    }

    @Bean
    public RoleHierarchy roleHierarchy(){
        RoleHierarchyImpl roleHierarchy = new RoleHierarchyImpl();
        roleHierarchy.setHierarchy("ADMIN > USER");
        return roleHierarchy;
    }

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.inMemoryAuthentication()
                .withUser("ekansh")
                .password("password")
                .authorities("USER", "ROLE");
        auth.inMemoryAuthentication()
                .withUser("admin")
                .password("admin")
                .authorities("ADMIN");
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
            .authorizeRequests()
                .expressionHandler(webExpressionHandler())
                .antMatchers("/admin/**").hasAuthority("ADMIN")
                .antMatchers("/user/**").hasAuthority("USER")
                .anyRequest().authenticated()
            .and()
            .formLogin()
            .and()
            .logout()
        ;
    }
    
}

In the example above, we have made a role hierarchy where

ADMIN can access MODERATOR and USER roles,
MODERATOR can access USER roles.
USER can neither access MODERATOR nor ADMIN roles.

    @Bean
    public RoleHierarchy roleHierarchy(){
        RoleHierarchyImpl roleHierarchy = new RoleHierarchyImpl();
        roleHierarchy.setHierarchy("ADMIN > MODERATOR > USER");
        return roleHierarchy;
    }

This is an easy way to configure and manage roles and role permissions for making security groups.

Also Read

Configure Spring Security with Spring boot

Configure JDBC Authetication using MYSQL Query

Authenticate User with Custom UserDetailsService

Implement Role Hierarchy with In-Memory Authentication

How to list the User Authorities in Controller,Filter and Services

Disable Session Creation for Stateless Authentication

    Download from Github