Ariel's Blog Stuff that I like

Database-backed authentication in Spring Security

This is a short and (hopefully) comprehensive guide to building a way to authenticate and authorize users into a website. This is done using Spring Security. It builds up on the examples provided in the Spring Security latest release which can be downloaded from here .

Starting from the XML files:

Web.xml

<context-param>
        <param-name>contextConfigLocation</param-name>
        <param-value>
        	/WEB-INF/dispatcher-servlet.xml
        	/WEB-INF/applicationContext-security.xml
        </param-value>
  </context-param>

applicationContext-security.xml

<?xml version="1.0" encoding="UTF-8"?>

<!--
  - Sample namespace-based configuration
  -
  -->

<beans:beans xmlns="http://www.springframework.org/schema/security"
    xmlns:beans="http://www.springframework.org/schema/beans"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
                        http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.0.xsd">

    <global-method-security pre-post-annotations="enabled">
        <!-- AspectJ pointcut expression that locates our "post" method and applies security that way
        <protect-pointcut expression="execution(* bigbank.*Service.post*(..))" access="ROLE_TELLER"/>
        -->
    </global-method-security>

    <http use-expressions="true">
        <intercept-url pattern="/secure/extreme/**" access="hasRole('ROLE_SUPERVISOR')"/>
        <intercept-url pattern="/secure/**" access="isAuthenticated()" />
        <!-- Disable web URI authorization, as we're using <global-method-security> and have @Secured the services layer instead
        <intercept-url pattern="/listAccounts.html" access="isRememberMe()" />
        <intercept-url pattern="/post.html" access="hasRole('ROLE_TELLER')" />
        -->
        <intercept-url pattern="/**" access="permitAll" />
        <form-login />
        <logout />
        <remember-me />
<!--
    Uncomment to enable X509 client authentication support
        <x509 />
-->
        <!-- Uncomment to limit the number of sessions a user can have -->
        <session-management invalid-session-url="/timeout.jsp">
            <concurrency-control max-sessions="1" error-if-maximum-exceeded="true" />
        </session-management>

    </http>

    <!-- hibernate DAO for authentication with sessionFactory dependency from dispatcher-servlet.xml defined in the web.xml -->
	<beans:bean id="userDAO" class="com.arielsweb.security.UserLoginDAOImpl">
		<beans:property name="sessionFactory" ref="sesFactory"></beans:property>
	</beans:bean>

	<beans:bean id="userService" class="com.arielsweb.security.UserLoginService">
		<beans:property name="userDAO" ref="userDAO"></beans:property>
    </beans:bean> 
    
    <authentication-manager>
         <authentication-provider user-service-ref="userService">
         	<password-encoder hash="sha" />
         </authentication-provider>    	 
    </authentication-manager>

</beans:beans>

UserLoginDAO.java

package com.arielsweb.security;

import java.util.List;

/**
 * The Interface UserLoginDAO.
 */
public interface UserLoginDAO {

	/**
	 * Load user by name.
	 *
	 * @param name the name
	 * @return the user
	 */
	User loadUserByName(String name);
}

UserLoginDAOImpl.java

package com.arielsweb.security;

import java.util.List;
import java.util.Set;

import org.hibernate.SessionFactory;
import org.springframework.orm.hibernate3.HibernateTemplate;

/**
 * The Class UserLoginDAOImpl
 */
public class UserLoginDAOImpl implements UserLoginDAO {

	/** The hibernate template. */
	private HibernateTemplate hibernateTemplate;

	/**
	 * Sets the session factory.
	 * 
	 * @param sessionFactory
	 *            the new session factory
	 */
	public void setSessionFactory(SessionFactory sessionFactory) {
		this.hibernateTemplate = new HibernateTemplate(sessionFactory);
	}

	@Override
	public User loadUserByName(String name) {
		if (name != null && !name.equals("")) {
			List<User> usr = hibernateTemplate
					.find("from User where username ='" + name + "'");

			if (usr.size() == 1) {
				return usr.get(0);
			} else {
				return null;
			}
		} else {
			return null;
		}
	}
}

UserLoginService.java

package com.arielsweb.security;

import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;

/**
 * The Class UserLoginService
 */
public class UserLoginService implements UserDetailsService {

	/** The user dao. */
	private UserLoginDAO userDao;

	/**
	 * Sets the user dao.
	 *
	 * @param u the new user dao
	 */
	public void setUserDAO(UserLoginDAO u) {
		userDao = u;
	}

	/* (non-Javadoc)
	 * @see org.springframework.security.core.userdetails.UserDetailsService#loadUserByUsername(java.lang.String)
	 */
	public UserDetails loadUserByUsername(String username) {
		if (username != null && !username.equals("")) {
			User user = userDao.loadUserByName(username);
			if (user == null) {
				return null;
			}
	
			GrantedAuthority grantedAuth = new UserGrantedAuthority(user.getRole());
			CustomUser cu = new CustomUser(user.getId(), user.getUsername(), user.getPassword(),
										   new GrantedAuthority[]{ grantedAuth });
			return cu;
		} else {
			return null;
		}
	}

}

And the classes referenced inside the service:
User.java

package com.arielsweb.security;

import javax.persistence.Entity;
import javax.persistence.GeneratedValue;
import javax.persistence.Id;

@Entity
public class User {

	private Integer id;
	private String username;
	private String password;
	private Boolean enabled;
	private String role;
	private String email;

	public User() {
	}

	public User(String username, String password, Boolean isEnabled, String role, String email) {
		super();
		this.username = username;
		this.password = password;
		this.enabled = isEnabled;
		this.role = role;
		this.email = email;
	}

	@Id
	@GeneratedValue
	/**
	 * @return the id
	 */
	public Integer getId() {
		return id;
	}

	/**
	 * @param id the id to set
	 */
	public void setId(Integer id) {
		this.id = id;
	}

	/**
	 * @return the username
	 */
	public String getUsername() {
		return username;
	}

	/**
	 * @param username the username to set
	 */
	public void setUsername(String username) {
		this.username = username;
	}

	/**
	 * @return the password
	 */
	public String getPassword() {
		return password;
	}

	/**
	 * @param password the password to set
	 */
	public void setPassword(String password) {
		this.password = password;
	}

	/**
	 * @return the isEnabled
	 */
	public Boolean getEnabled() {
		return enabled;
	}

	/**
	 * @param isEnabled the isEnabled to set
	 */
	public void setEnabled(Boolean isEnabled) {
		this.enabled = isEnabled;
	}

	/**
	 * @return the roles
	 */
	public String getRole() {
		return role;
	}

	/**
	 * @param roles the roles to set
	 */
	public void setRole(String roles) {
		this.role = roles;
	}
	
	/**
	 * @return the emailAddress
	 */
	public String getEmail() {
		return email;
	}

	/**
	 * @param emailAddress the emailAddress to set
	 */
	public void setEmail(String emailAddress) {
		this.email = emailAddress;
	}
}

UserGrantedAuthority.java

package com.arielsweb.security;

import org.springframework.security.core.GrantedAuthority;

/**
 * The Class UserGrantedAuthority
 */
public class UserGrantedAuthority implements GrantedAuthority {

	/** The Constant serialVersionUID. */
	private static final long serialVersionUID = -3786297951121082647L;
	
	/** The authority. */
	private String authority = null;

	/**
	 * Instantiates a new user granted authority.
	 *
	 * @param auth the auth
	 */
	public UserGrantedAuthority(String auth) {
		authority = auth;
	}

	/*
	 * (non-Javadoc)
	 * 
	 * @see org.springframework.security.core.GrantedAuthority#getAuthority()
	 */
	@Override
	public String getAuthority() {
		return authority;
	}

}

CustomUser.java

package com.arielsweb.security;

import java.io.Serializable;
import java.util.ArrayList;
import java.util.Collection;

import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.userdetails.UserDetails;

public class CustomUser implements Serializable, UserDetails {

	private static final long serialVersionUID = 1201392234549297485L;
	private long id;
	private String password;
	private String username;
	private GrantedAuthority[] authorities = null;

	/**
	 * Instantiates a new custom user.
	 *
	 * @param id the id
	 * @param username the username
	 * @param password the password
	 * @param authorities the authorities
	 */
	public CustomUser(int id, String username, String password, GrantedAuthority[] authorities) {
		this.id = id;
		this.password = password;
		this.username = username;
		this.authorities = authorities;
	}

	public Collection<GrantedAuthority> getAuthorities() {
		Collection<GrantedAuthority> auth = new ArrayList<GrantedAuthority>();
		for (int i = 0; i < authorities.length; i++) {
			auth.add(authorities[i]);
		}
		return auth;
	}
	
	/**
	 * @return the id
	 */
	public long getId() {
		return id;
	}
	
	/**
	 * @param id the id to set
	 */
	public void setId(long id) {
		this.id = id;
	}
	
	@Override
	public String getPassword() {
		return this.password;
	}

	@Override
	public String getUsername() {
		return this.username;
	}
/**
* For convenience the below methods return all true; In a real application it is not desired, however.
*/
	@Override
	public boolean isAccountNonExpired() {
		return true;
	}

	@Override
	public boolean isAccountNonLocked() {
		return true;
	}

	@Override
	public boolean isCredentialsNonExpired() {
		return true;
	}

	@Override
	public boolean isEnabled() {
		return true;
	}
}

Putting it all together, as well as setting up a database containing a table similar in structure to the User.java entity, should result in a working database-backed login system.