### Configuring Spring Security for User Authentication Now that we've set up our database schema, the next step is to configure Spring Security to handle user authentication and authorization. This will ensure that our application is secure and only authorized users can access specific features. #### Understanding Spring Security Basics Spring Security is a powerful framework that provides robust security capabilities for Spring-based applications. Here are the key components we'll be working with: 1. **SecurityFilterChain**: This is the main entry point for Spring Security. It defines the security settings for your application. 2. **UserDetailsService**: This interface is used to load user data from our database and verify user credentials. 3. **PasswordEncoder**: This is used to encode and decode user passwords securely. #### Step-by-Step Configuration 1. **Add Required Dependencies** First, we need to add the Spring Security dependency to our project. Add the following to your `build.gradle` or `pom.xml`: ```gradle // For Maven (pom.xml) org.springframework.boot spring-boot-starter-security // For Gradle (build.gradle) dependencies { implementation 'org.springframework.boot:spring-boot-starter-security' } ``` 2. **Create Security Configuration Class** We'll create a configuration class that extends `WebSecurityConfigurerAdapter` and defines our security settings. ```java import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Configuration; import org.springframework.security.authentication.dao.DaoAuthenticationProvider; import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder; import org.springframework.security.config.annotation.web.builders.HttpSecurity; import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity; import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter; import org.springframework.security.core.userdetails.UserDetailsService; import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder; import org.springframework.security.crypto.password.PasswordEncoder; @Configuration @EnableWebSecurity public class SecurityConfig extends WebSecurityConfigurerAdapter { @Bean public UserDetailsService userDetailsService() { return new CustomUserDetailsService(); } @Bean public PasswordEncoder passwordEncoder() { return new BCryptPasswordEncoder(); } @Bean public DaoAuthenticationProvider authenticationProvider() { DaoAuthenticationProvider authProvider = new DaoAuthenticationProvider(); authProvider.setUserDetailsService(userDetailsService()); authProvider.setPasswordEncoder(passwordEncoder()); return authProvider; } @Override protected void configure(AuthenticationManagerBuilder auth) throws Exception { auth.authenticationProvider(authenticationProvider()); } @Override protected void configure(HttpSecurity http) throws Exception { http .csrf().disable() .sessionManagement() .sessionFixation().none() .and() .authorizeRequests() .antMatchers("/admin/**").hasRole("ADMIN") .antMatchers("/polls/**").hasAnyRole("USER", "ADMIN") .antMatchers("/", "/login", "/register").permitAll() .anyRequest().authenticated() .and() .formLogin() .loginPage("/login") .permitAll() .and() .logout() .logoutUrl("/logout") .clearAuthentication(true) .deleteCookies("JSESSIONID") .permitAll(); } } ``` 3. **Create Custom UserDetailsService** We'll create a custom implementation of `UserDetailsService` to load users from our database. ```java import org.springframework.security.core.GrantedAuthority; import org.springframework.security.core.authority.SimpleGrantedAuthority; import org.springframework.security.core.userdetails.User; import org.springframework.security.core.userdetails.UserDetails; import org.springframework.security.core.userdetails.UserDetailsService; import org.springframework.security.core.userdetails.UsernameNotFoundException; import org.springframework.stereotype.Service; import java.util.List; import java.util.stream.Collectors; @Service public class CustomUserDetailsService implements UserDetailsService { private final UserRepository userRepository; public CustomUserDetailsService(UserRepository userRepository) { this.userRepository = userRepository; } @Override public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException { User user = userRepository.findByUsername(username) .orElseThrow(() -> new UsernameNotFoundException("User not found with username: " + username)); List authorities = user.getRole() .stream() .map(role -> new SimpleGrantedAuthority(role.name())) .collect(Collectors.toList()); return new org.springframework.security.core.userdetails.User( user.getUsername(), user.getPassword(), authorities); } } ``` 4. **Update User Entity** Modify your User entity to implement Spring Security's `UserDetails` interface. ```java import org.springframework.security.core.GrantedAuthority; import org.springframework.security.core.authority.SimpleGrantedAuthority; import org.springframework.security.core.userdetails.UserDetails; import javax.persistence.*; import java.util.Collection; import java.util.List; import java.util.stream.Collectors; @Entity @Table(name = "users") public class User implements Serializable, UserDetails { @Id @GeneratedValue(strategy = GenerationType.IDENTITY) private Long id; @Column(nullable = false, unique = true) private String username; @Column(nullable = false) private String password; @ManyToMany @JoinTable( name = "user_roles", joinColumns = @JoinColumn(name = "user_id"), inverseJoinColumns = @JoinColumn(name = "role_id") ) private List roles; @Override public Collection getAuthorities() { return getRoles().stream() .map(role -> new SimpleGrantedAuthority(role.name())) .collect(Collectors.toList()); } @Override public String getPassword() { return password; } @Override public String getUsername() { return username; } // Other getters and setters } ``` 5. **Create Role Entity** If you haven't already, create a Role entity. ```java @Entity @Table(name = "roles") public class Role { @Id @GeneratedValue(strategy = GenerationType.IDENTITY) private Long id; @Column(nullable = false, unique = true) private String name; // Getters and Setters } ``` 6. **Create UserRepository** Create a repository interface for User. ```java import org.springframework.data.jpa.repository.JpaRepository; import org.springframework.stereotype.Repository; @Repository public interface UserRepository extends JpaRepository { User findByUsername(String username); } ``` #### Key Points in the Security Configuration 1. **Security Configuration Class**: - We've disabled CSRF protection for simplicity. - Defined session management settings. - Configured authorization rules for different endpoints. - Set up form login with a custom login page. - Defined logout functionality. 2. **UserDetailsService**: - This service loads user data from the database. - Converts database roles to Spring Security authorities. 3. **PasswordEncoder**: - We're using BCryptPasswordEncoder to securely hash passwords. - Passwords are hashed before being stored in the database. 4. **Role-Based Access Control**: - `/admin/**` endpoints are restricted to users with the ADMIN role. - `/polls/**` endpoints are accessible to both USER and ADMIN roles. - Public pages like `/` and `/login` are available to all users. #### Next Steps Now that we've configured Spring Security, the next steps are to: 1. Implement user registration functionality with password hashing. 2. Create login and logout pages. 3. Implement role-based access control for admin features. #### What to Read More About - [Spring Security Documentation](https://spring.io/projects/spring-security) - [Role-Based Access Control](https://en.wikipedia.org/wiki/Role-based_access_control) - [Password Storage Best Practices](https://www.owasp.org/index.php/Password_Storage_Cheat_Sheet) - [BCrypt Password Hashing](https://en.wikipedia.org/wiki/Bcrypt) - [Spring Security with JPA and Hibernate](https://www.baeldung.com/spring-security-jpa-hibernate)