Enabling spring security in your spring application

Enabling spring security in your spring application

In your roo application you will have to run following command which will generate all the security related pages and needed configuration for you.

Roo> Security Setup

The above command will create everything needed for spring security , now go to your “applicationContext-security.xml” file under your project’s  resources/META-INF/spring  folder.

If you want Spring to show login screen whenever your user want’s to access any URL then include following interceptors  in your applicationContext-security.xml  file under http tage

    <http auto-config="true" use-expressions="true">

        <!--

   

            <form-login />

         -->

       

<form-login login-processing-url="/resources/j_spring_security_check" login-page="/login" authentication-failure-url="/login?login_error=t" />

       

       

        <logout logout-url="/resources/j_spring_security_logout" />

        <!-- Configure these elements to secure URIs in your application -->

        <intercept-url pattern="/login**" access="permitAll" />

        <intercept-url pattern="/**" access="isAuthenticated()" />

    </http>

 

Note the  bold lines in above code , the first line will tell spring to allow access to /login URL only , while the second line will restrict all the other URLS in your application and will allow access only if the user is authenticated and has required roles.

Note that if you don’t want to have your own login page and want spring to handle security (login page based) then comment the below line

<form-login login-processing-url="/resources/j_spring_security_check" login-page="/login" authentication-failure-url="/login?login_error=t" />

       

And uncomment below line

        <!--

   

            <form-login />

         -->

Try to run your spring application now and spring will still show you a login page and notice that you don’t need to create a login.jsp page in this case.

Customizing Spring Security

We can even customize the spring security to use our own class where we can put the code to authenticate the user against our database , please follow the steps mentioned below

Writing custom AuthenticationProvider

We will write a custom Authentication provider by extending a classcalled AbstractUserDetailsAuthenticationProvider, which works with username/password like authentication. The classes that extend AbstractUserDetailsAuthenticationProvider have to provide implementation for its two abstract methods:

·         additionalAuthenticationChecks and

·          retrieveUser.

The provider calls the retrieveUser method to authenticate user , this is where you can authenticate the user in your application against your own database , below is the class

package mypackage;

import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;

import org.springframework.security.authentication.dao.AbstractUserDetailsAuthenticationProvider;

import org.springframework.security.core.AuthenticationException;

import org.springframework.security.core.userdetails.UserDetails;

public class DrillingBestPracticesAuthenticationProvider extends

              AbstractUserDetailsAuthenticationProvider {

       @Override

       protected void additionalAuthenticationChecks(UserDetails arg0,

                     UsernamePasswordAuthenticationToken arg1)

                     throws AuthenticationException {

              // TODO Auto-generated method stub

       }

       @Override

       protected UserDetails retrieveUser(String username,

                     UsernamePasswordAuthenticationToken authentication)

                     throws AuthenticationException {

              String password = (String) authentication.getCredentials();

              if (!StringUtils.hasText(password))

              {

                     throw new BadCredentialsException("Please enter password");

             

              }

              List<GrantedAuthority> authorities = new ArrayList<GrantedAuthority>();

              try

              {

                    

                     //TODO here I should be trying to get the database connection using user name and password if connection successfully made then it means user is authenticated to use our system

                    

                    

              }

              catch (EmptyResultDataAccessException e)

              {

                     throw new BadCredentialsException("Invalid username or password");

                    

              } catch (EntityNotFoundException e) {

                     throw new BadCredentialsException("Invalid user");

                    

              } catch (NonUniqueResultException e) {

                     throw new BadCredentialsException("Non-unique user, contact administrator");

                    

              }

              return new User(username, password,

                           true, // enabled

                           true, // account not expired

                           true, // credentials not expired

                           true, // account not locked

                           authorities);       

       }

}

And you will have to add AuthenticationManager in your applicationContext-security.xml file as below

<beans:bean name="drillingBestPracticesAuthenticationProvider" class="mypackage.DrillingBestPracticesAuthenticationProvider">

    

    </beans:bean>

    <authentication-manager alias="authenticationManager">

    <authentication-provider ref="drillingBestPracticesAuthenticationProvider"></authentication-provider>

    </authentication-manager>    

Now once the user has been authenticated and User object being returned by the retrieveUser method , Spring will allow you to get user detail from anywhere in your application using any of the three approaches mentioned in the blogpost at following link

http://www.mkyong.com/spring-security/get-current-logged-in-username-in-spring-security/

I am copy pasting the three methods mentioned in above blog

 three ways to get current logged in username in Spring Security

First Method

      Authentication auth = SecurityContextHolder.getContext().getAuthentication();

      String name = auth.getName(); //get logged in username

Second Method

     User user = (User)SecurityContextHolder.getContext().getAuthentication().getPrincipal();

      String name = user.getUsername(); //get logged in username

Third Method

  @RequestMapping(value="/login", method = RequestMethod.GET)

  public String printWelcome(ModelMap model, Principal principal ) {

      String name = principal.getName(); //get logged in username

      model.addAttribute("username", name);

      return "hello";

  }