spring-security

Spring Security 3 database authentication with Hibernate

by

You have to make your own custom authentication-provider. Example code: Service to load Users from Hibernate: import org.springframework.security.core.userdetails.UserDetails; import org.springframework.security.core.userdetails.UserDetailsService; import org.springframework.security.core.userdetails.UsernameNotFoundException; @Service(“userDetailsService”) public class UserDetailsServiceImpl implements UserDetailsService { @Autowired private UserDao dao; @Autowired private Assembler assembler; @Transactional(readOnly = true) public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException, DataAccessException { UserDetails userDetails = null; UserEntity userEntity = … Read more

What is the use of @Order annotation in Spring?

by

It is used for Advice execution precedence. The highest precedence advice runs first. The lower the number, the higher the precedence. For example, given two pieces of ‘before’ advice, the one with highest precedence will run first. Another way of using it is for ordering Autowired collections @Component @Order(2) class Toyota extends Car { public … Read more

How to test spring-security-oauth2 resource server security?

by

To test resource server security effectively, both with MockMvc and a RestTemplate it helps to configure an AuthorizationServer under src/test/java: AuthorizationServer @Configuration @EnableAuthorizationServer @SuppressWarnings(“static-method”) class AuthorizationServerConfig extends AuthorizationServerConfigurerAdapter { @Bean public JwtAccessTokenConverter accessTokenConverter() throws Exception { JwtAccessTokenConverter jwt = new JwtAccessTokenConverter(); jwt.setSigningKey(SecurityConfig.key(“rsa”)); jwt.setVerifierKey(SecurityConfig.key(“rsa.pub”)); jwt.afterPropertiesSet(); return jwt; } @Autowired private AuthenticationManager authenticationManager; @Override public void configure(final … Read more

Programmatically log-in a user using spring security

by

In my controller i have this, which logs user in as normal : Authentication auth = new UsernamePasswordAuthenticationToken(user, null, user.getAuthorities()); SecurityContextHolder.getContext().setAuthentication(auth); Where user is my custom user object(implementing UserDetails) that is newly created. The getAuthorities() method does this (just because all my users have the same role): public Collection<GrantedAuthority> getAuthorities() { //make everyone ROLE_USER Collection<GrantedAuthority> … Read more

Spring + Web MVC: dispatcher-servlet.xml vs. applicationContext.xml (plus shared security)

by

The dispatcher-servlet.xml file contains all of your configuration for Spring MVC. So in it you will find beans such as ViewHandlerResolvers, ConverterFactories, Interceptors and so forth. All of these beans are part of Spring MVC which is a framework that structures how you handle web requests, providing useful features such as databinding, view resolution and … Read more

What is the default AuthenticationManager in Spring-Security? How does it authenticate?

by

The AuthenticationManager is really just a container for authentication providers, giving a consistent interface to them all. In most cases, the default AuthenticationManager is more than sufficient. When you call .authenticate(new UsernamePasswordAuthenticationToken(username, password))` it is passing the UsernamePasswordAuthenticationToken to the default AuthenticationProvider, which will use the userDetailsService to get the user based on username and … Read more

JSON Web Token (JWT) with Spring based SockJS / STOMP Web Socket

by

Current Situation UPDATE 2016-12-13 : the issue referenced below is now marked fixed, so the hack below is no longer necessary which Spring 4.3.5 or above. See https://github.com/spring-projects/spring-framework/blob/master/src/docs/asciidoc/web/websocket.adoc#token-authentication. Previous Situation Currently (Sep 2016), this is not supported by Spring except via query parameter as answered by @rossen-stoyanchev, who wrote a lot (all?) of the Spring … Read more

How to manually log out a user with spring security?

by

It’s hard for me to say for sure if your code is enough. However standard Spring-security’s implementation of logging out is different. If you took a look at SecurityContextLogoutHandler you would see they do: SecurityContextHolder.clearContext(); Moreover they optionally invalidate the HttpSession: if (invalidateHttpSession) { HttpSession session = request.getSession(false); if (session != null) { session.invalidate(); } … Read more

Spring Security: Upgrading the deprecated WebSecurityConfigurerAdapter in Spring Boot 2.7.0

by

I have managed to update the methods. This is the WebSecurityConfig class, and the methods are modified in the following way: public void configure(AuthenticationManagerBuilder authenticationManagerBuilder) throws Exception { authenticationManagerBuilder.userDetailsService(userDetailsService).passwordEncoder(passwordEncoder()); } has become: @Bean public AuthenticationManager authenticationManager(AuthenticationConfiguration authenticationConfiguration) throws Exception { return authenticationConfiguration.getAuthenticationManager(); } Explanation: In the old version you inject AuthenticationManagerBuilder, set userDetailsService, passwordEncoder and … Read more