For that let's do the following steps:

1. Add the password encoder bean

2. Update the plain text password to encrypted password

3. Configure user details service

4. Configure the authentication provider

Add the password encoder bean

In the SecurityConfig class add a bean of type PasswordEncoder

package com.gintophilip.springauth.web;

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.Customizer;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.web.SecurityFilterChain;

@Configuration
@EnableWebSecurity
public class SecurityConfig {

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity securityConfig) throws Exception {
        return securityConfig
                .authorizeHttpRequests(auth->
                        auth.requestMatchers("/api/hello")
                                .permitAll()
                                .requestMatchers("/api/admin").hasRole("ADMIN")
                                .anyRequest().authenticated()
                ).formLogin(Customizer.withDefaults())
                .build();
    }
    @Bean
    public PasswordEncoder passwordEncoder(){
        return new BCryptPasswordEncoder();
    }
}

The BCryptPasswordEncoder is the preferred method for encoding passwords.

Update the plain text password to encrypted password.

While creating the sample users, the passwords were stored as plain text. In this step, let's update the passwords to an encrypted form.

1. Drop the user_roles table

2. Drop the roles table

3. Drop the application_user table

4. Add the PasswordEncoder class dependency in DataBaseUtilityRunner

5. Encode the password

Drop theuser_rolestable

spring_access_db=# drop table user_roles;

Drop therolestable

spring_access_db=# drop table roles;

Drop theapplication_usertable

spring_access_db=# drop table application_user;

And also, do the following in DataBaseUtilityRunner class.

update the lines

user1.setPassword("123456");
adminUser.setPassword("12345");

as follows.

 user1.setPassword(passwordEncoder.encode("123456"));
 adminUser.setPassword(passwordEncoder.encode("12345"));

The DataBaseUtilityRunner after modification is as follows,

package com.gintophilip.springauth;

import com.gintophilip.springauth.entities.ApplicationUser;
import com.gintophilip.springauth.entities.Roles;
import com.gintophilip.springauth.repository.RoleRepository;
import com.gintophilip.springauth.repository.UserRepository;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.boot.CommandLineRunner;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.stereotype.Component;

@Component
public class DataBaseUtilityRunner implements CommandLineRunner {
    @Autowired
    PasswordEncoder passwordEncoder;
    @Autowired
    UserRepository usersRepository;
    @Autowired
    RoleRepository rolesRepository;
    @Override
    public void run(String... args) throws Exception {
        try {
            Roles userRole = new Roles();
            userRole.setRoleName("USER");
            Roles adminRole = new Roles();
            adminRole.setRoleName("ADMIN");
            rolesRepository.save(userRole);
            rolesRepository.save(adminRole);
            ApplicationUser user1 = new ApplicationUser();
            user1.setFirstName("John");
            user1.setEmail("john@test.com");
            user1.setPassword(passwordEncoder.encode("123456"));
            user1.setRole(userRole);

            ApplicationUser adminUser = new ApplicationUser();
            adminUser.setFirstName("sam");
            adminUser.setEmail("sam@test.com");
            adminUser.setPassword(passwordEncoder.encode("12345"));

            adminUser.setRole(adminRole);
            usersRepository.save(user1);
            usersRepository.save(adminUser);
        }catch (Exception exception){

        }

    }
}

Run the application and query the application_user table. You will see the passwords are encoded now instead of plain text.

spring_access_db=# select * from application_user;
 id  |     email     | first_name | last_name |            password                           
-----+---------------+------------+-----------+--------------------------------------------------------------
 102 | john@test.com | John       |           | $2a$10$IBP9g8pOvNCvkEc7/EG6TO3j6gh49QMuO6uuw9Dd/P9dPRi5mxbiAsnG
 103 | sam@test.com  | sam        |           | $2a$10$WxM0l4qnjbYn1Vkgmrbte.hgYqPyHLm/y.9IGvEoiRkrL8.h47QKu
(2 rows)

Configure user details service

For making spring security to use the database for authentication and authorization a user details service needs to be implemented. This is nothing but a class which implements the interface UserDetailsService .

This interface has a method named loadUserByUsername which accepts a string parameter and returns a UserDetails object.

package org.springframework.security.core.userdetails;
public interface UserDetailsService {
    UserDetails loadUserByUsername(String username) throws UsernameNotFoundException;
}

Create a class named DatabaseUserDetailsService.java which implements the UserDetailsService interface.

public class DatabaseUserDetailsService  implements UserDetailsService {
    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
       return null;
    }
}

In the overridden method we do the following

1. Fetch the user from database based on the parameter username.

2. Retrieve the roles associated with the user

3. Create an instance of class User with the user details and the associated roles

4. Return the User object

package com.gintophilip.springauth.service;

import com.gintophilip.springauth.entities.ApplicationUser;
import com.gintophilip.springauth.repository.UserRepository;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.authority.SimpleGrantedAuthority;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.core.userdetails.UsernameNotFoundException;
import org.springframework.stereotype.Service;

import java.util.Collections;

@Service
public class DatabaseUserDetailsService  implements UserDetailsService {
    @Autowired
    UserRepository userRepository;
    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        ApplicationUser user = userRepository.findByEmail(username); //fetch user from db
        if(user == null){
            throw  new UsernameNotFoundException("User Not found");
        }
        //Retrieve user roles
        GrantedAuthority authority = new SimpleGrantedAuthority("ROLE_"+user.getRole().getRoleName());
        //create User object
        User applicationUser = new User(user.getEmail(),user.getPassword(), Collections.singleton(authority));
        return applicationUser;
    }
}

Next we need to configure an authentication provider.

Configure the authentication provider

For Spring Security to utilize the DatabaseUserDetailsService for retrieving user details, it must be linked with an authentication provider. For that we will create a bean of type DaoAuthenticationProvider in the SecurityConfig and bind it with DatabaseUserDetailsService within the SecurityConfig.

Bind the DatabaseUserDetailsService

    @Autowired
    DatabaseUserDetailsService databaseUserDetailsService;

Next, create an instance of DaoAuthenticationProvider which is an implementation of AUthenticationProvider given by Spring security. Then,

1. Link the databaseUserDetailsService

2. Link the passwordEncoder

 @Bean
    public DaoAuthenticationProvider daoAuthenticationProvider() {
        DaoAuthenticationProvider authenticationProvider = new DaoAuthenticationProvider();
        //set the user details object        
        authenticationProvider.setUserDetailsService(databaseUserDetailsService);
        //set the password encoder        
        authenticationProvider.setPasswordEncoder(passwordEncoder());
        return authenticationProvider;
    }

After this the SecurityConfig looks like below.

package com.gintophilip.springauth.web;

import com.gintophilip.springauth.service.DatabaseUserDetailsService;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.authentication.dao.DaoAuthenticationProvider;
import org.springframework.security.config.Customizer;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.web.SecurityFilterChain;

@Configuration
@EnableWebSecurity
public class SecurityConfig {
    @Autowired
    DatabaseUserDetailsService databaseUserDetailsService;

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity securityConfig) throws Exception {
        return securityConfig
                .authorizeHttpRequests(auth->
                        auth.requestMatchers("/api/hello")
                                .permitAll()
                                .requestMatchers("/api/admin").hasRole("ADMIN")
                                .anyRequest().authenticated()
                ).formLogin(Customizer.withDefaults())
                .build();
    }
    @Bean
    public PasswordEncoder passwordEncoder(){
        return new BCryptPasswordEncoder();
    }
    @Bean
    public DaoAuthenticationProvider daoAuthenticationProvider() {
        DaoAuthenticationProvider authenticationProvider = new DaoAuthenticationProvider();
        //set the user details object
        authenticationProvider.setUserDetailsService(databaseUserDetailsService);
        //set the password encoder
        authenticationProvider.setPasswordEncoder(passwordEncoder());
        return authenticationProvider;
    }
}

Next, run the application and access the APIs. When the login page appears, use the user details from the application_user table.

1. http://localhost:8080/api/hello

2. http://localhost:8080/api/protected

3. http://localhost:8080/api/admin

You will be successfully authenticated and able to view the response.

The /api/admin is only accessible to the user sam.

1. Create the security configuration class

2. Make all APIs to be accessed only by logged in users

3. Allow /api/hello to be accessed by anyone

4. Restrict access to /api/admin to user with ADMIN role only

Access to the end points will be configured as follows.

Create the security configuration class

To implement a custom security configuration by overriding the default one we need to create a configuration class. This can be done with the help of @Configuration annotation.

package com.gintophilip.springauth.web;

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.Customizer;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.web.SecurityFilterChain;

@Configuration
@EnableWebSecurity
public class SecurityConfig {

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity securityConfig) throws Exception {
        return securityConfig
                .authorizeHttpRequests(auth->
                        auth.anyRequest().authenticated()
                ).formLogin(Customizer.withDefaults())
                .build();

    }
}

This will serve as our initial configuration. Here, we have mandated that every request must be authenticated. In the coming steps, we will configure the security settings as required.

Make all APIs to be accessed only by logged in users

There is nothing to do. Because the initial configuration we created satisfied the requirement. Hence we don't need to specify any special configuration for the API endpoint /api/protected

Allow /api/hello to be accessed by anyone

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity securityConfig) throws Exception {
        return securityConfig
                .authorizeHttpRequests(auth->
                        auth.requestMatchers("/api/hello").permitAll().
                        anyRequest().authenticated()
                ).formLogin(Customizer.withDefaults())
                .build();
    }

Now run the application and attempt to access the APIs. The endpoint /api/hello is now accessible to everyone, while all other endpoints still require users to log in.

Restrict access to /api/admin to user with the ADMIN role only.

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity securityConfig) throws Exception {
        return securityConfig
                .authorizeHttpRequests(auth->
                        auth.requestMatchers("/api/hello")
                                .permitAll()
                                .requestMatchers("/api/admin").hasRole("ADMIN")
                                .anyRequest().authenticated()
                ).formLogin(Customizer.withDefaults())
                .build();
    }

At this point, the only API endpoint accessible to users is /api/hello. All other endpoints are restricted by a login screen.

1. Add the Spring Security dependency

2. Restart the application

3. Verify Spring Security is enabled

Add the Spring Security dependency

To Enable spring security the library org.springframework.boot:spring-boot-starter-security must be present in the Classpath. This can be achieved by adding the library as a dependency in the build.gradle file. Note the first item in the dependencies list

dependencies {
    implementation 'org.springframework.boot:spring-boot-starter-security'
    implementation 'org.springframework.boot:spring-boot-starter-data-jpa'
    implementation 'org.springframework.boot:spring-boot-starter-web'
    runtimeOnly 'com.h2database:h2'
    testImplementation 'org.springframework.boot:spring-boot-starter-test'
}

Restart the application

Just restart the application. Then go to the next step.

Verify Spring Security is enabled

Open the browser and attempt to access the API endpoints. If a login page appears for each endpoint you try to access, it confirms that Spring Security is enabled and functioning as expected.

Yeah that's it.

At this point the application is running with the default implementation of Spring Security. You will not able to access the APIs without entering login credentials. In the default implementation, Spring Security provides a default user with username as “user” and a randomly generated password . This generated password can be obtained from the console logs.

Note the line Using generated security password: dd05314d-2856-48b4-9c81-fcc480e0b4bf

The default behavior of Spring Security, unless configured otherwise is as follows:

• All end points are protected by default when the library org.springframework.boot:spring-boot-starter-security is present in the Classpath

• One cannot access the resources without authentication.

• Provides a default user that can be overridden.

In this default setup the APIs can be accessed by entering the username as user and password as the one which is printed in the console. Try accessing the APIs by entering the default credentials.

1. http://localhost:8080/api/hello

2. http://localhost:8080/api/protected

3. http://localhost:8080/api/admin

1. GET /api/hello

2. GET /api/protected

3. GET /api/admin

Also a database software is required. Here the setup uses PostgreSQL database. You are free to choose yours.

Let's go through the following steps to build the foundation.

1. Create the project

2. Implement the API end points

3. Create user and role entities

4. Create user and role repositories

5. Configure database connectivity

6. Populate database with sample users

7. Run the application

8. Verify users and roles are created by querying the database

9. Try accessing the API end points

Create the project

To create the project go to https://start.spring.io/ and create the sample project with the following dependencies.

• Spring Web

• Spring Data JPA

• PostgreSQL Driver

Here I used the Spring initializer and opened the project in IntelliJ IDEA (Community Edition)

1. Add the dependencies

2. Fill up the project metadata

3. Generate the Zip file and extract it.

4. Then open it in your IDE.

Implement the API end points

Create a class named ApiController and implement the APIs there.

• ApiController.java

    package com.gintophilip.springauth.controller;
  
    import org.springframework.http.ResponseEntity;
    import org.springframework.web.bind.annotation.GetMapping;
    import org.springframework.web.bind.annotation.RequestMapping;
    import org.springframework.web.bind.annotation.RestController;
  
    @RestController
    @RequestMapping("/api")
    public class ApiController {
        @GetMapping("/hello")
        public ResponseEntity<String> hello() {
            return ResponseEntity.ok("Hello");
        }
  
        @GetMapping("/protected")
        public ResponseEntity<String> protectedResource() {
            String message = """
                    This is a protected resource <br>
                    You are seeing this because you are an authenticated user
                    """;
            return ResponseEntity.ok(message);
        }
  
        @GetMapping("/admin")
        public ResponseEntity<String> admin() {
            String message = "Hello Admin";
            return ResponseEntity.ok(message);
        }
    }
  

Create user and role entities

Create two classes for modeling the user and role entities.

ApplicationUser.java

package com.gintophilip.springauth.entities;

import jakarta.persistence.*;

@Entity
public class ApplicationUser {

    @Id
    @GeneratedValue(strategy = GenerationType.AUTO)
    private Long id;
    private String firstName;
    private String lastName;
    @Column(unique = true)
    private String email;
    private String password;
    @ManyToOne
    @JoinTable(name = "user_roles")
    private Roles role;

    public Long getId() {
        return id;
    }

    public void setId(Long id) {
        this.id = id;
    }

    public String getFirstName() {
        return firstName;
    }

    public void setFirstName(String firstName) {
        this.firstName = firstName;
    }

    public String getLastName() {
        return lastName;
    }

    public void setLastName(String lastName) {
        this.lastName = lastName;
    }

    public String getEmail() {
        return email;
    }

    public void setEmail(String email) {
        this.email = email;
    }

    public String getPassword() {
        return password;
    }

    public void setPassword(String password) {
        this.password = password;
    }

    public Roles getRole() {
        return role;
    }

    public void setRole(Roles role) {
        this.role = role;
    }
}

Roles.java

package com.gintophilip.springauth.entities;

import jakarta.persistence.*;

@Entity
public class Roles {
    @Id
    @GeneratedValue(strategy = GenerationType.AUTO)
    private Long id;
    @Column(unique = true)
    private String roleName;

    public Long getId() {
        return id;
    }

    public void setId(Long id) {
        this.id = id;
    }

    public String getRoleName() {
        return roleName;
    }

    public void setRoleName(String roleName) {
        this.roleName = roleName;
    }
}

Create user and role repositories

UserRepository.java

package com.gintophilip.springauth.repository;

import com.gintophilip.springauth.entities.ApplicationUser;
import org.springframework.data.jpa.repository.JpaRepository;

public interface UserRepository  extends JpaRepository<ApplicationUser,Long> {

    ApplicationUser findByEmail(String email);
}

RoleRepository.java

package com.gintophilip.springauth.repository;

import com.gintophilip.springauth.entities.Roles;
import org.springframework.data.jpa.repository.JpaRepository;

public interface RoleRepository extends JpaRepository<Roles,Long> {

}

Configure database connectivity

Let's configure the connection to the database named spring_access_db with the following settings:

username: postgres

password: 12345

For configuring the database connectivity update the application.properties file as follows.

spring.datasource.url=jdbc:postgresql://localhost:5432/spring_access_db
spring.datasource.username=postgres
spring.datasource.password=12345
spring.jpa.properties.hibernate.dialect = org.hibernate.dialect.PostgreSQLDialect
spring.jpa.hibernate.ddl-auto = update

Populate database with sample users

Let's Create a class which implements the CommandLineRunner interface. The method run will be executed once the application is ready.

DatabaseUtilityRunner.java

package com.gintophilip.springauth;

import com.gintophilip.springauth.entities.ApplicationUser;
import com.gintophilip.springauth.entities.Roles;
import com.gintophilip.springauth.repository.RoleRepository;
import com.gintophilip.springauth.repository.UserRepository;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.boot.CommandLineRunner;
import org.springframework.stereotype.Component;

@Component
public class DataBaseUtilityRunner implements CommandLineRunner {
    @Autowired
    UserRepository usersRepository;
    @Autowired
    RoleRepository rolesRepository;
    @Override
    public void run(String... args) throws Exception {
        try {
            Roles userRole = new Roles();
            userRole.setRoleName("USER");
            Roles adminRole = new Roles();
            adminRole.setRoleName("ADMIN");
            rolesRepository.save(userRole);
            rolesRepository.save(adminRole);
            ApplicationUser user1 = new ApplicationUser();
            user1.setFirstName("John");
            user1.setEmail("john@test.com");
            user1.setPassword("123456");
            user1.setRole(userRole);

            ApplicationUser adminUser = new ApplicationUser();
            adminUser.setFirstName("sam");
            adminUser.setEmail("sam@test.com");
            adminUser.setPassword("12345");

            adminUser.setRole(adminRole);
            usersRepository.save(user1);
            usersRepository.save(adminUser);
        }catch (Exception exception){

        }

    }
}

Verify users and roles are created by querying the database

As a result of the previous step three tables will be created with the provided data in the database spring_access_db;

Here I use the psql CLI client to view and query the database.

List of tables

spring_access_db-# \dt
              List of relations
 Schema |       Name       | Type  |  Owner   
--------+------------------+-------+----------
 public | application_user | table | postgres
 public | roles            | table | postgres
 public | user_roles       | table | postgres
(3 rows)

Table: application_user

Query: select * from application_user;

spring_access_db=# select * from application_user;
 id |     email     | first_name | last_name | password 
----+---------------+------------+-----------+----------
  1 | john@test.com | John       |           | 123456
  2 | sam@test.com  | sam        |           | 12345
(2 rows)

In this example, the password is stored in clear text. In a real-world scenario, it is essential to store passwords in an encrypted form rather than as plain text. We'll do this later.

Table: roles

Query:select * from roles;

spring_access_db=# select * from roles;
 id  | role_name 
-----+-----------
 802 | USER
 803 | ADMIN
(2 rows)

Table: user_roles

Query:select * from user_roles;

spring_access_db=# select * from user_roles;
 role_id | id 
---------+----
     802 |  1
     803 |  2
(2 rows)

Run the application

Now run the application. Once it is up and running, open the browser and try to access the API endpoints.

1. http://localhost:8080/api/hello

2. http://localhost:8080/api/protected

3. http://localhost:8080/api/admin

You will be able to access all the APIs without any restrictions. This completes the setup of base application.

In the comings steps we'll see how to protect these end points by integrating authentication and authorization mechanisms using Spring Security.

1. PART 1: Create the base application.

   1. Create the project.

   2. Implement the API end points.

   3. Create user and role entities.

   4. Create user and role repositories.

   5. Configure database connectivity.

   6. Populate database with sample users.

   7. Verify users and roles are created by querying the database.

   8. Run the application.

2. PART 2: Enable Spring Security

   1. Add the Spring Security dependency

   2. Restart the application

   3. Verify Spring Security is enabled

3. PART 3: Configuring security of the API end points

   1. Create the security configuration class

   2. Make all APIs to be accessed only by logged in users

   3. Allow /api/hello to be accessed by anyone

   4. Restrict access to /api/admin to user with ADMIN role only

4. PART 4: Integrate the database with Spring Security.

   1. Add the password encoder bean.

   2. Update the plain text password to encrypted password.

   3. Configure user details service.

   4. Configure the authentication provider.

Before going in let's see what is,

• Authentication

• Authorization

• User details service

• Authentication provider

Authentication

Authentication is the process of proving that someone is who they claim to be. The authentication can be done via certain ways such as Username and password, fingerprint. token etc...

To authenticate against an application, a user must have valid credentials. When these credentials are provided to the application for access, the application verifies them against the database where the credentials are stored. If the credentials match, the authentication is successful and the user can proceed to use the application.

Authorization.

While authentication verifies the identity of a user in an application, authorization determines what actions the user is permitted to perform. This means it addresses the permissions assigned to a user.

In an application, there may be multiple users, each with different levels of operational rights. For example, an ADMIN user may have the right to delete a user, whereas a regular user will not have this capability.

A basic flow of user authentication and authorization

Authentication

1. User submits the credentials to the application.

2. The application verifies the credentials by checking in the database.

3. If the credentials are valid allow access to the application.

Authorization

1. User requests a resource.

2. The authorization module checks if the user has rights to access the resource.

3. If user has rights the resource is given to the user.

4. Else the access to resource is denied.

User details service

This service provides the necessary data, such as username, password, or other details required for authentication. In Spring Security, we configure a UserDetailsService object, which instructs Spring Security on where to load the required data for authentication. For example, when a username is provided as "test@test.com," Spring Security needs to look up the user data where the username is "test@test.com." This lookup is typically performed on a database. The database required for this lookup is configured using the user details service.

In essence, the user details service is a service that retrieves user data from the database based on a given key.

Authentication provider

The authentication provider is responsible for authenticating users based on the provided credentials.

The authentication provider requests the user's details from the user details service using the received username. The user details service fetches and returns the user information if a user with the requested name is found. Then, it proceeds to compare the password.

The authentication provider and the user details service collaborate to authenticate a user effectively.