Spring Security - JPA implemenation of UserDetailsService For DaoAuthenticationProvider
Spring security provides DaoAuthenticationProvider for username and password authentication.
Spring Security provides DaoAuthenticationProvider which requires a UserDetailsService and a passwordEncoder bean to perform username and password authentication.
Please note — we will use a spring boot project. You can access the maven dependency here to initialize the project.
This tutorial will focus on -
- How to leverage Spring Data JPA to connect to a persistent database such as MySQL
- How to create
UserDetailsEntity using JPA annotations. - How to create custom
UserDetailsManagerimplementation which fetches data using JPA repository.
Configure the dataSource
Add the below configuration in the application.properties file. I have provided a demo config for configuring a MySQL database. you are free to use a database of your choice. Make sure you give the correct url, username and password.
spring.datasource.url=jdbc:mysql://localhost:3306/nauth_db
spring.datasource.username=user
spring.datasource.password=pass
Create an Entity of UserDetail type
Let’s implement UserDetails interface and implement all the methods.
@Entity
public class AuthUserDetails implements UserDetails {
@Id
@GeneratedValue(strategy = GenerationType.IDENTITY)
private Long id;
private String username;
private String password;
private boolean accountNonExpired;
private boolean accountNonLocked;
private boolean credentialsNonExpired;
private boolean enabled;
@OneToMany(mappedBy = "authUserDetails", fetch = FetchType.EAGER)
private Set<AuthGrantedAuthority> authorities;
@Override
public Collection<? extends GrantedAuthority> getAuthorities() {
return this.authorities;
}
@Override
public String getPassword() {
return this.password;
}
@Override
public String getUsername() {
return this.username;
}
@Override
public boolean isAccountNonExpired() {
return this.accountNonExpired;
}
@Override
public boolean isAccountNonLocked() {
return this.accountNonLocked;
}
@Override
public boolean isCredentialsNonExpired() {
return this.credentialsNonExpired;
}
@Override
public boolean isEnabled() {
return this.enabled;
}
//setters
}
Since UserDetails can have a set of authorities. we will also need another entity for GrantedAuthorities to maintain a one-to-many relationship.
@Entity
public class AuthGrantedAuthority implements GrantedAuthority {
@Id
@GeneratedValue(strategy = GenerationType.IDENTITY)
@Column(name = "id", nullable = false)
private Long id;
private String authority;
@ManyToOne
@JoinColumn(name = "auth_user_detail_id")
private AuthUserDetails authUserDetails;
//constructors
//getters and setters
}
Create the Repositories for the above entities.
We will also have to create a repository for both UserDetails and GrantedAuthorities Entities which implements JpaRepository interface.
findByUsername and findByPassword methods are required later when we will create a Custom UserDetailsManager
@Repository
public interface AuthUserDetailsRepository extends JpaRepository<AuthUserDetails, Long> {
Optional<AuthUserDetails> findByUsername(String username);
Optional<AuthUserDetails> findByPassword(String password);
}
The repository interface for GrantedAuthorities does not require any custom methods.
public interface AuthGrantedAuthorityRepository extends JpaRepository<AuthGrantedAuthority, Long> {
}
Create an implementation of UserDetailsManager
UserDetailsManager interface extends to UserDetailsService class. So we are ideally creating an implementation of UserDetailsService with some extra methods.
@Service
public class JpaUserDetailsManager implements UserDetailsManager {
@Autowired
private AuthUserDetailsRepository repository;
@Override
public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
repository.findByUsername(username);
.orElseThrow(
() -> new UsernameNotFoundException("No user found with username = " + username));
}
@Override
public void createUser(UserDetails user) {
repository.save((AuthUserDetails) user);
}
@Override
public void updateUser(UserDetails user) {
repository.save((AuthUserDetails) user);
}
@Override
public void deleteUser(String username) {
AuthUserDetails userDetails = repository.findByUsername(username)
.orElseThrow(() -> new UsernameNotFoundException("No User found for username -> " + username));
repository.delete(userDetails);
}
/**
* This method assumes that both oldPassword and the newPassword params
* are encoded with configured passwordEncoder
*
* @param oldPassword the old password of the user
* @param newPassword the new password of the user
*/
@Override
@Transactional
public void changePassword(String oldPassword, String newPassword) {
AuthUserDetails userDetails = repository.findByPassword(oldPassword)
.orElseThrow(() -> new UsernameNotFoundException("Invalid password "));
userDetails.setPassword(newPassword);
repository.save(userDetails);
}
@Override
public boolean userExists(String username) {
return repository.findByUsername(username).isPresent();
}
}
Next , we will create a configuration which will extend to WebSecurityConfigurerAdapter. We will also add JpaUserDetailsManager as a dependency to it.
We will also add passwordEncoder bean to it.
@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {
@Autowired
private JpaUserDetailsManager jpaUserDetailsManager;
@Bean
public BCryptPasswordEncoder passwordEncoder() {
return new BCryptPasswordEncoder(4);
}
}
Create a bean of DaoAuthenticationProvider
@Autowired
private JpaUserDetailsManager jpaUserDetailsManager;
@Bean
public DaoAuthenticationProvider jpaDaoAuthenticationProvider() {
DaoAuthenticationProvider daoAuthenticationProvider = new DaoAuthenticationProvider();
daoAuthenticationProvider.setUserDetailsService(jpaUserDetailsManager);
daoAuthenticationProvider.setPasswordEncoder(passwordEncoder());
return daoAuthenticationProvider;
}
Finally, override the configure(AuthenticationManagerBuilder auth) of the WebSecurityConfigurerAdapter class and add the jpaDaoAuthenticationProvider bean to AuthenticationManagerBuilder.
@Override
protected void configure(AuthenticationManagerBuilder auth) {
auth.authenticationProvider(jpaDaoAuthenticationProvider());
}
Configure multiple AuthenticationProviders
If you have come across a scenario where you would require to search different data stores for user details for authentication. You can create the custom implementations of UserDetailsManager as we did in this post.
After that you can add multiple AuthenticationProviders to AuthenticationManagerBuilder in the configure method.
@Override
protected void configure(AuthenticationManagerBuilder auth) {
auth.authenticationProvider(jpaDaoAuthenticationProvider());
auth.authenticationProvider(inMemoryDaoAuthenticationProvider());
auth.authenticationProvider(firebaseDaoAuthenticationProvider());
}
You can also go through the post about in-memory username and password authentication using spring security and try adding that AuthenticationProvider in the configure method.
Finally - Add the data to Database in Spring boot application
Since we have not created any users for testing.
you can either —
- directly add the
userdetailsin database - or use
data.sqlfile in the resources to provide the initial data. - or use the
commandLineRunnerto add data when the application starts.
Below is an example of commandLineRunner bean.
@Configuration
public class DBInitializerConfig {
@Autowired
private AuthUserDetailsRepository authUserDetailsRepository;
@Autowired
private AuthGrantedAuthorityRepository authGrantedAuthorityRepository;
@Autowired
private PasswordEncoder passwordEncoder;
// initialize the user in DB
@Bean
public CommandLineRunner initializeJpaData() {
return (args)->{
System.out.println("application started");
//uncomment if required
AuthUserDetails user2 = new AuthUserDetails();
user2.setUsername("user2");
user2.setPassword(passwordEncoder.encode("password"));
user2.setEnabled(true);
user2.setCredentialsNonExpired(true);
user2.setAccountNonExpired(true);
user2.setAccountNonLocked(true);
AuthGrantedAuthority grantedAuthority = new AuthGrantedAuthority();
grantedAuthority.setAuthority("USER");
grantedAuthority.setAuthUserDetail(user2);
authUserDetailsRepository.save(user2);
authGrantedAuthorityRepository.save(grantedAuthority);
user2.setAuthorities(Collections.singleton(grantedAuthority));
};
}
}
