Spring Security - studiofu/brain GitHub Wiki

Notes

need to add spring-boot-starter-security dependency,
https://www.jianshu.com/p/08cc28921fd0
- in default, spring use AuthenticationManagerConfiguration.configure to build the authorization users and SecurityProperties to generate the default user
  - it is able to override the users information in properties file, [security.user.name=admin security.user.password=admin]
- to use in memory user list, it is required to create a class and extend WebSecurityConfigurerAdapter and then configure using AuthenticationManagerBuilder - protected void configure(AuthenticationManagerBuilder auth) throws Exception
  - and then define the user, such as in memory user
  - auth.inMemoryAuthentication().withUser(“test”).password(“123456”).roles(“USER”);
- and to configure using HttpSecurity to for the access control and authorization
  - control method authoriziation by using PreAuthorize
  - @PreAuthorize(“hasRole('ADMIN')”)
  - to show the username in the front end, the information could be obtained from the SecurityContextHolder
  - Object principal = SecurityContextHolder.getContext().getAuthentication().getPrincipal();
  - String username = ((UserDetails)principal).getUsername();
to use database authentication
- at least design three tables
- User, UserRole, Role
- need to change the configuration by using HttpSecurity to control the authorization, for example,
- allow to access root level “/” and static resources and also the “/login” page
- http.authorizeRequests().antMatchers(“/”).permitAll()
- default success login redirect page
- .defaultSuccessUrl(“/httpapi”).permitAll().and()
- default login redirect page
- http.logout().logoutSuccessUrl(“/”)
- need to configure by using AuthenticationManagerBuilder to apply custom UserDetailsService * for example, create LightSwordUserDetailService and then implement the method loadUserByUsername to return the User Object
- if using jdbcAuthentication , need to set the query for finding the username, password and enable or not and also set the query to find the role of the user
- to configure using WebSecurity to allow static resources to be accessed.
- web.ignoring().antMatchers(“/resourcesDir/”);

Examples

Simple Spring Security - just implement the UserDetailServices

https://github.com/quantificial/spring-security-demo/blob/master/normal-simple-auth/src/main/java/hello/WebSecurityConfig.java

Simple Spring Security with more http custom settings and also configure the AuthenticationManager

https://github.com/quantificial/spring-security-demo/blob/master/normal-with-auth-manager/src/main/java/hello/WebSecurityConfig.java

Implement the UserDetailsService which could be used to call DAO or API to obtain UserDetails for spring security to authentiate

https://github.com/quantificial/spring-security-demo/blob/master/normal-with-custom-user-details-service/src/main/java/hello/WebSecurityConfig.java

Implement CustomAuthenticationProvider and could be able to handle complex authentication

https://github.com/quantificial/spring-security-demo/blob/master/normal-with-custom-auth-provider/src/main/java/hello/CustomAuthenticationProvider.java

Restful API Authentication through HTTP POST, modify the AuthenticationEntryPoint and create custom successHandler and failureHandler

https://github.com/quantificial/spring-security-demo/blob/master/normal-simple-restful/src/main/java/hello/WebSecurityConfig.java

Create custom authentication filter and allow using JSON data object for the authentication, inherited and modified from UsernamePasswordAuthenticationFilter

https://github.com/quantificial/spring-security-demo/blob/master/normal-simple-restful-with-custom-auth-filter/src/main/java/hello/CustomUsernamePasswordAuthenticationFilter.java

Create a completely new custom authentication filter and not depending on the existing filters to handle the JSON object authentication, use the new custom authentication token to process the authentication

https://github.com/quantificial/spring-security-demo/blob/master/normal-simple-restful-with-custom-new-auth-filter/src/main/java/hello/CustomAuthenticationFilter.java

Demo authorization, such as PreAuthorize in method level and also show how to obtain username from Security Context

https://github.com/quantificial/spring-security-demo/blob/master/normal-with-custom-advance-authorization/src/main/java/hello/WebSecurityConfig.java

JWT Authentication and Authorization Sample, authentication for the Token, and then use Token for the authorization

https://github.com/quantificial/spring-security-demo/blob/master/normal-with-json-web-token/src/main/java/hello/authapi/security/JWTAuthenticationFilter.java