1
1
.
.
3
3
.
.
8
8
M
M
a
a
n
n
u
u
a
a
l
l
l
l
y
y
C
C
r
r
e
e
a
a
t
t
e
e
U
U
s
s
e
e
r
r
O
O
b
b
j
j
e
e
c
c
t
t
I
I
n
n
f
f
o
o
[
[
G
G
]
]
This tutorial shows how to manually create User Object inside MyUserDetailsService.java.
User is created and returned only if entered username matches stored username (otherwise Exception is thrown).
In this simplified example we only have one stored User against which entered Username is checked.
Tutorial Define Users in DB shows how to compare entered Username against Users stored in Database.
Application Schema [Results]
Spring Boot Starters
GROUP
DEPENDENCY
DESCRIPTION
Web
Spring Web
Enables @Controller, @RequestMapping and Tomcat Server
Security
Spring Security
Enables Spring Security
M
M
y
y
U
U
s
s
e
e
r
r
D
D
e
e
t
t
a
a
i
i
l
l
s
s
S
S
e
e
r
r
v
v
i
i
c
c
e
e
.
.
j
j
a
a
v
v
a
a
If you
● declare Class that implements UserDetailsService (it is called Service because it SERVES UserDetails Object)
● and @Override its Method loadUserByUsername(String username)
● then this Method will be called when User enters Username and Password through Login Form
Method
● should return Object of Class that Implements UserDetails Interface (which in our case will be built-in User Class)
● which should contain: Username, Password, Authorities
This User Object
● will contain Stored Password
● which Spring will compare with the Entered Password (from Login Form)
MyController
http://localhost:8080/Hello
Tomcat
Browser
WebSecurityConfig
MyUserDetailsSer...
PasswordEncoder
Return User Object
P
P
r
r
o
o
c
c
e
e
d
d
u
u
r
r
e
e
Create Project: springboot_manuallycreateuserobject (add Spring Boot Starters from the table)
Create Package: controllers (inside main package)
– Create Class: MyController.java (inside package controllers)
Create Package: config (inside main package)
– Create Class: WebSecurityConfig.java (inside package config)
Create Package: services (inside main package)
– Create Class: MyUserDetailsService.java (inside package services)
MyUserDetailsService.java
package com.ivoronline.springboot_manuallycreateuserobject.services;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.authority.SimpleGrantedAuthority;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.core.userdetails.UsernameNotFoundException;
import org.springframework.stereotype.Service;
import java.util.ArrayList;
import java.util.List;
@Service
public class MyUserDetailsService implements UserDetailsService {
@Override
public UserDetails loadUserByUsername(String enteredUsername) throws UsernameNotFoundException {
//HARD CODED USER
String username = "myuser";
String password = "mypassword";
String role = "ROLE_USER";
//CHECK USERNAME
if (!username.equals(enteredUsername)) {
throw new UsernameNotFoundException(enteredUsername);
}
//CREATE AUTHORITIES
List<GrantedAuthority> authorities = new ArrayList<GrantedAuthority>();
authorities.add(new SimpleGrantedAuthority(role));
//CREATE USER OBJECT
User user = new User(username, password, authorities);
//RETURN USER
return user;
}
}
WebSecurityConfig.java
package com.ivoronline.springboot_manuallycreateuserobject.config;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.crypto.password.NoOpPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(securedEnabled = true)
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
@Bean
PasswordEncoder passwordEncoder() {
return NoOpPasswordEncoder.getInstance();
}
@Override
protected void configure(HttpSecurity httpSecurity) throws Exception {
//RESTRICT ACCESS TO EVERYTHING ELSE (BEHIND LOGIN FORM)
httpSecurity
.authorizeRequests().anyRequest().authenticated()
.and().formLogin()
.and().httpBasic();
}
}
MyController.java
package com.ivoronline.springboot_manuallycreateuserobject.controllers;
import org.springframework.security.access.annotation.Secured;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.ResponseBody;
@Controller
public class MyController {
@ResponseBody
@Secured("ROLE_USER")
@RequestMapping("/Hello")
public String hello() {
return "Hello from Controller";
}
}
R
R
e
e
s
s
u
u
l
l
t
t
s
s
http://localhost:8080/Hello
You get redirected to http://localhost:8080/login
– Username: john
– Password: johnpassword
– Sign in
You get redirected back to http://localhost:8080/Hello
http://localhost:8080/login - john - johnpassword
Redirects to http://localhost:8080/Hello
Application Structure
pom.xml
<dependencies>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-web</artifactId>
</dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-security</artifactId>
</dependency>
</dependencies>