1
1
.
.
6
6
.
.
2
2
S
S
i
i
n
n
g
g
l
l
e
e
T
T
i
i
m
m
e
e
(
(
S
S
e
e
s
s
s
s
i
i
o
o
n
n
B
B
a
a
s
s
e
e
d
d
)
)
-
-
R
R
e
e
q
q
u
u
e
e
s
s
t
t
P
P
a
a
r
r
a
a
m
m
e
e
t
t
e
e
r
r
s
s
I
I
n
n
f
f
o
o
[
[
G
G
]
]
This tutorial shows how to use Session to Implement Manual Authentication by
● calling http://localhost:8080/Authenticate?enteredUsername=myuser&enteredPassword=mypassword
● providing Credentials as HTTP Request Parameters
● storing Authentication Object into Context/Session
● from where it will be used/accessed for every subsequent HTTP Request
Application Schema [Results]
Spring Boot Starters
GROUP
DEPENDENCY
DESCRIPTION
Web
Spring Web
Enables Controller Annotations and Tomcat Server
Security
Spring Security
Enables Spring Security
WebSecurityConfig
http://localhost:8080/Authenticate?enteredUsername=myuser&enteredPassword=mypassword
Tomcat
hello()
Browser
MyController
MyAuthentication
Manager
authenticate()
http://localhost:8080/Hello
P
P
r
r
o
o
c
c
e
e
d
d
u
u
r
r
e
e
Create Project: springboot_authentication_manual (add Spring Boot Starters from the table)
Create Package: config (inside main package)
– Create Class: MyAuthenticationManager.java (inside config package)
– Create Class: WebSecurityConfig.java (inside config package)
Create Package: controllers (inside main package)
– Create Class: MyController.java (inside controllers package)
MyAuthenticationManager.java
package com.ivoronline.springboot_authentication_manual.config;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.authority.SimpleGrantedAuthority;
import org.springframework.stereotype.Component;
import java.util.ArrayList;
import java.util.List;
@Component
public class MyAuthenticationManager implements AuthenticationManager {
@Override
public Authentication authenticate(Authentication enteredAuthentication) {
//HARD CODED USER
String username = "myuser";
String password = "mypassword";
String role = "ROLE_USER";
//GET ENTERED CREDENTIALS
String enteredUsername = (String) enteredAuthentication.getPrincipal(); //USERNAME
String enteredPassword = (String) enteredAuthentication.getCredentials(); //PASSWORD
//AUTHENTICATE USER
if (!enteredUsername.equals(username)) { System.out.println("Username not found"); return null; }
if (!enteredPassword.equals(password)) { System.out.println("Incorrect Password"); return null; }
//CREATE AUTHORITIES
List<GrantedAuthority> authorities = new ArrayList<GrantedAuthority>();
authorities.add(new SimpleGrantedAuthority(role));
//CREATE VALIDATED AUTHENTICATION
Authentication validatedAuth = new UsernamePasswordAuthenticationToken(username,password,authorities);
//RETURN VALIDATES AUTHENTICATION
return validatedAuth;
}
}
WebSecurityConfig.java
package com.ivoronline.springboot_authentication_manual.config;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
@Configuration
@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
//====================================================================
// CONFIGURE
//====================================================================
@Override
protected void configure(HttpSecurity httpSecurity) throws Exception {
//SPECIFY ACCESS TO ENDPOINTS
httpSecurity.authorizeRequests().antMatchers("/Authenticate").permitAll(); //Anonymous Access
httpSecurity.authorizeRequests().anyRequest().authenticated(); //Authenticated Access
}
}
MyController.java
package com.ivoronline.springboot_authentication_manual.controllers;
import com.ivoronline.springboot_authentication_manual.config.MyAuthenticationManager;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.RequestParam;
import org.springframework.web.bind.annotation.ResponseBody;
@Controller
public class MyController {
@Autowired MyAuthenticationManager myAuthenticationManager;
//==================================================================
// AUTHENTICATE
//==================================================================
@ResponseBody
@RequestMapping("/Authenticate")
public String authenticate(@RequestParam String enteredUsername, @RequestParam String enteredPassword) {
//AUTHENTICATE
Authentication enteredAuth = new UsernamePasswordAuthenticationToken(enteredUsername, enteredPassword);
Authentication returnedAuth = myAuthenticationManager.authenticate(enteredAuth);
//STORE AUTHENTICATION INTO CONTEXT (SESSION)
SecurityContextHolder.getContext().setAuthentication(returnedAuth);
//RETURN SOMETHING
if(returnedAuth == null) { return "User is NOT Authenticated"; }
else { return "User is Authenticated"; }
}
//==================================================================
// HELLO
//==================================================================
@ResponseBody
@RequestMapping("/Hello")
public String hello() {
return "Hello from Controller";
}
}
pom.xml
<dependencies>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-web</artifactId>
</dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-security</artifactId>
</dependency>
</dependencies>
