Spring Security Basics: Implementing Authentication and Authorization

Hello everyone, this document will guide you through the process of integrating authentication and authorization mechanisms into a Spring Boot web application using Spring Security. The following topics will be covered:.

1. PART 1: Create the base application.

   1. Create the project.
   2. Implement the API end points.
   3. Create user and role entities.
   4. Create user and role repositories.
   5. Configure database connectivity.
   6. Populate database with sample users.
   7. Verify users and roles are created by querying the database.
   8. Run the application.

2. PART 2: Enable Spring Security

   1. Add the Spring Security dependency
   2. Restart the application
   3. Verify Spring Security is enabled

3. PART 3: Configuring security of the API end points

   1. Create the security configuration class
   2. Make all APIs to be accessed only by logged in users
   3. Allow /api/hello to be accessed by anyone
   4. Restrict access to /api/admin to user with ADMIN role only

4. PART 4: Integrate the database with Spring Security.

   1. Add the password encoder bean.
   2. Update the plain text password to encrypted password.
   3. Configure user details service.
   4. Configure the authentication provider.

Before going in let's see what is,

• Authentication

• Authorization

• User details service

• Authentication provider

Authentication

Authentication is the process of proving that someone is who they claim to be. The authentication can be done via certain ways such as Username and password, fingerprint. token etc...

To authenticate against an application, a user must have valid credentials. When these credentials are provided to the application for access, the application verifies them against the database where the credentials are stored. If the credentials match, the authentication is successful and the user can proceed to use the application.

Authorization.

While authentication verifies the identity of a user in an application, authorization determines what actions the user is permitted to perform. This means it addresses the permissions assigned to a user.

In an application, there may be multiple users, each with different levels of operational rights. For example, an ADMIN user may have the right to delete a user, whereas a regular user will not have this capability.

A basic flow of user authentication and authorization

Authentication

1. User submits the credentials to the application.

2. The application verifies the credentials by checking in the database.

3. If the credentials are valid allow access to the application.

Authorization

1. User requests a resource.

2. The authorization module checks if the user has rights to access the resource.

3. If user has rights the resource is given to the user.

4. Else the access to resource is denied.

User details service

This service provides the necessary data, such as username, password, or other details required for authentication. In Spring Security, we configure a UserDetailsService object, which instructs Spring Security on where to load the required data for authentication. For example, when a username is provided as "[e-mail]," Spring Security needs to look up the user data where the username is "[e-mail]." This lookup is typically performed on a database. The database required for this lookup is configured using the user details service.

In essence, the user details service is a service that retrieves user data from the database based on a given key.

Authentication provider

The authentication provider is responsible for authenticating users based on the provided credentials.

The authentication provider requests the user's details from the user details service using the received username. The user details service fetches and returns the user information if a user with the requested name is found. Then, it proceeds to compare the password.

The authentication provider and the user details service collaborate to authenticate a user effectively.

https://blog.gintophilip.com/series/spring-security-authentication-and-authorization

---