Understanding Spring Security: Authentication, Authorization, Custom Roles & External Database Integration

Understanding Spring Security: Authentication, Authorization, Custom Roles & External Database Integration

Amr Khaled's photo
Amr Khaled
·

9 min read

Table of contents

Introduction to Spring Security

Spring Security is a powerful and highly customizable authentication and access-control framework for Java-based applications. It is a project under the Spring Framework and provides a comprehensive security solution for both web and non-web applications. With Spring Security, developers can easily secure their applications by defining security rules, implementing authentication and authorization mechanisms, and handling access-control decisions.

In this article, we will discuss the basics of Spring Security and how to set it up in a web application. We will also go over some of the key features and capabilities of the framework, such as authentication and authorization, and how to secure different types of resources in an application.

Setting up Spring Security in a Web Application

To set up Spring Security in a web application, we need to add the Spring Security dependencies to our project. The easiest way to do this is to use the Spring Initializer tool, which can generate a basic project structure with the necessary dependencies.

Once the dependencies are added, we need to configure Spring Security in our application. This can be done by creating a configuration class that extends the WebSecurityConfigurerAdapter class and overrides its methods.

Here is an example of a basic configuration class:

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {
    @Autowired
    private UserDetailsService userDetailsService;

    @Autowired
    private PasswordEncoder passwordEncoder;

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
            .authorizeRequests()
                .antMatchers("/").permitAll()
                .antMatchers("/admin/**").hasRole("ADMIN")
                .anyRequest().authenticated()
                .and()
            .formLogin()
                .loginPage("/login")
                .permitAll()
                .and()
            .logout()
                .permitAll();
    }

    @Autowired
    public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
        auth.userDetailsService(userDetailsService).passwordEncoder(passwordEncoder);
    }
}

In the above example, we are using the http object to define the security rules for our application. We are using the authorizeRequests() method to specify which resources in our application should be protected and which should be publicly accessible. In this case, we are allowing all requests to the root path (/) and only allowing requests from users with the "ADMIN" role to the /admin path. All other requests are required to be authenticated.

We are also configuring the form-based login and logout functionality using the formLogin() and logout() methods. In this case, we are using the default login page provided by Spring Security, but we can also specify a custom login page by providing a URL to the loginPage() method.

Finally, we are configuring the authentication manager to use our custom UserDetailsService and PasswordEncoder implementations.

Authentication and Authorization

One of the key features of Spring Security is its support for authentication and authorization. Authentication is the process of verifying a user's identity, while authorization is the process of determining what actions a user is allowed to perform.

Spring Security provides several built-in authentication mechanisms, such as form-based login, basic authentication, and token-based authentication. It also supports custom authentication providers, which allow developers to implement their authentication methods.

For example, in the configuration class above, we are using form-based login for authentication. However, we could also use basic authentication by configuring the http object as follows:

http
    .authorizeRequests()
        .anyRequest().authenticated()
        .and()
    .httpBasic();

In this case, the user will be prompted to enter their credentials using a basic authentication dialog provided by the browser.

Once a user is authenticated, Spring Security uses the user's roles and authorities to determine what actions they are allowed to perform. Roles and authorities are used to define access-control rules, and they can be assigned to users in a variety of ways, such as using the UserDetailsService interface or by reading them from a database or LDAP server.

For example, in the configuration class above, we are using the hasRole() method to restrict access to the /admin path to users with the "ADMIN" role. We could also use the hasAuthority() method to restrict access based on a specific authority, such as ROLE_ADMIN.

Securing Resources

Spring Security can be used to secure a wide variety of resources, including web pages, RESTful web services, and even individual methods in a Java class.

For example, in the configuration class above, we are using the authorizeRequests() method to define security rules for web pages. However, we can also use the antMatchers() method to define rules for specific web services or methods.

Here is an example of how to secure a RESTful web service:

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {
    // ...

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
            .authorizeRequests()
                .antMatchers("/").permitAll()
                .antMatchers("/admin/**").hasRole("ADMIN")
                .antMatchers(HttpMethod.POST, "/api/**").hasRole("USER")
                .anyRequest().authenticated()
                .and()
            // ...
    }
}

In this case, we are allowing all requests to the root path, allowing only users with the "ADMIN" role to access the /admin path, and allowing only users with the "USER" role to make POST requests to the /api path.

We can also use the @PreAuthorize and @PostAuthorize annotations to secure individual methods in a Java class. For example:

@Service
public class MyService {
    @PreAuthorize("hasRole('ADMIN')")
    public void doAdminTask() {
        // ...
    }

    @PostAuthorize("hasRole('USER')")
    public void doUserTask() {
        // ...
    }
}

In this case, the doAdminTask() method can only be accessed by users with the "ADMIN" role, and the doUserTask() method can only be accessed by users with the "USER" role.

Using Custom Roles in Spring Security

Spring Security supports the use of custom roles in addition to the built-in roles such as "ROLE_USER" and "ROLE_ADMIN". Custom roles can be used to define specific permissions and access controls for your application.

For example, let's say you have a music streaming application and you want to give premium users the ability to download songs. You can create a custom role called "ROLE_PREMIUM" and assign it to users who have a premium subscription. Then, you can use the hasRole() or hasAuthority() method to restrict access to the song download feature to users with the "ROLE_PREMIUM" role.

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {
    // ...

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
            .authorizeRequests()
                .antMatchers("/download/**").hasRole("PREMIUM")
                .anyRequest().permitAll()
                .and()
            // ...
    }
}

In this case, only users with the "ROLE_PREMIUM" role will be able to access the "/download" path.

Connecting Users to an External Database

In most real-world applications, user data is stored in a database such as MySQL, PostgreSQL, or MongoDB. Spring Security provides a UserDetailsService interface that can be used to load user data from an external database.

UserDetailsService is an interface with a single method, loadUserByUsername(String username), that takes a username as an argument and returns a UserDetails object. UserDetails is a Spring Security interface that represents a user and their roles and authorities.

Here is an example of how to implement a UserDetailsService that loads user data from a MySQL database:

@Service
public class MyUserDetailsService implements UserDetailsService {

    @Autowired
    private UserRepository userRepository;

    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        User user = userRepository.findByUsername(username);
        if (user == null) {
            throw new UsernameNotFoundException(username);
        }
        return new MyUserPrincipal(user);
    }
}

In this example, we are using a UserRepository to load user data from a MySQL database. The UserRepository is an interface that extends CrudRepository, which is a Spring Data interface for working with databases.

Once you have implemented a UserDetailsService, you need to configure Spring Security to use it. You can do this by overriding the configure(AuthenticationManagerBuilder auth) method in the configuration class, like so:

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {
    // ...

    @Autowired
    private MyUserDetailsService userDetailsService;

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.userDetailsService(userDetailsService);
    }
}

With this configuration, Spring Security will use the MyUserDetailsService to load user data from the MySQL database.

It's important to note that when using an external database, you should also take care of security measures such as password encryption and securely storing the password. Spring Security provides built-in support for password encoding and provides several password encoders such as BCryptPasswordEncoder, SHA-256PasswordEncoder, etc.

Here is an example of how to configure Spring Security to use the BCryptPasswordEncoder:

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {
    // ...

    @Autowired
    private MyUserDetailsService userDetailsService;

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth
            .userDetailsService(userDetailsService)
            .passwordEncoder(passwordEncoder());
    }
}

In this example, we have defined a passwordEncoder() bean that returns a new BCryptPasswordEncoder and we have passed this password encoder to the AuthenticationManagerBuilder. This will ensure that all passwords are encoded using the BCryptPasswordEncoder before being compared with the stored passwords.

It's also worth mentioning that when working with an external database, you should also handle user's roles and authorities. It can be done by creating tables in the database to store roles and authorities of each user and then mapping them to UserDetails object.

Managing Roles and Authorities in Spring Security with JPA and Hibernate

When working with an external database, it's important to handle user's roles and authorities. Instead of writing raw SQL queries, we can use the power of JPA and Hibernate to handle the database operations. In this section, we will see how to implement this with JPA and Hibernate.

First, we need to create the entities that will represent the tables in the database. These entities will be used to map the tables in the database to Java objects. Here are examples of the entities that will represent the users, authorities, roles, and user_roles tables:

@Entity
@Table(name = "users")
public class UserEntity {

    @Id
    @GeneratedValue(strategy = GenerationType.AUTO)
    private Long id;

    @Column(unique = true, nullable = false)
    private String username;

    @Column(nullable = false)
    private String password;

    @Column(nullable = false)
    private boolean enabled;

    @OneToMany(fetch = FetchType.LAZY, mappedBy = "user")
    private Set<AuthorityEntity> authorities;

    @ManyToMany(fetch = FetchType.LAZY, cascade = CascadeType.ALL)
    @JoinTable(name = "user_roles", joinColumns = {
            @JoinColumn(name = "username", nullable = false, updatable = false) },
            inverseJoinColumns = { @JoinColumn(name = "role_id",
                    nullable = false, updatable = false) })
    private Set<RoleEntity> roles;
}

@Entity
@Table(name = "authorities")
public class AuthorityEntity {

    @Id
    @GeneratedValue(strategy = GenerationType.AUTO)
    private Long id;

    @ManyToOne(fetch = FetchType.LAZY)
    @JoinColumn(name = "username", nullable = false)
    private UserEntity user;

    @Column(nullable = false)
    private String authority;
}

@Entity
@Table(name = "roles")
public class RoleEntity {

    @Id
    @GeneratedValue(strategy = GenerationType.AUTO)
    private Long id;

    @Column(unique = true, nullable = false)
    private String name;

    @ManyToMany(fetch = FetchType.LAZY, mappedBy = "roles")
    private Set<UserEntity> users;
}

Once the entities are created, we need to create a UserDetailsService implementation that loads the user data from the database and maps it to the UserDetails object. Here is an example of a UserDetailsService implementation that loads the user data from the database using JPA and Hibernate:

@Service
public class MyUserDetailsService implements UserDetailsService {

    @Autowired
    private UserRepository userRepository;

    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        UserEntity userEntity = userRepository.findByUsername(username);
        if(userEntity == null) {
            throw new UsernameNotFoundException("Invalid username or password.");
        }
        return new org.springframework.security.core.userdetails.User(userEntity.getUsername(), userEntity.getPassword(), getAuthority(userEntity));
    }

    private List<SimpleGrantedAuthority> getAuthority(UserEntity user) {
        return user.getRoles().stream().map(role -> new SimpleGrantedAuthority(role.getName())).collect(Collectors.toList());
    }
}

As you can see, we are using a UserRepository interface that extends the JpaRepository interface. This interface will handle all the database operations related to the UserEntity class. The findByUsername method is used to find a user by its username, and the getAuthority method is used to map the user's roles to a SimpleGrantedAuthority object.

Conclusion

In conclusion, Spring Security is a powerful framework that provides a lot of features out of the box. In this article, we have covered some of the most important features of Spring Security and how to use them in a real-world application. We have discussed how to secure web applications with Spring Security and how to use authentication and authorization in Spring Security. We have also covered how to use custom roles and authorities in Spring Security and how to connect the users to an external database using JPA and Hibernate. With the help of these examples and explanations, you should now have a good understanding of how to use Spring Security in your web applications.

SpringbootSpringSpring frameworkJavaspring security