Spring security Authentication and Authorization

 

Spring Security provides authentication and authorization support for Java applications. It allows you to secure your application with minimal code, and it integrates well with the Spring framework.

In this blog, we will look at the steps to implement authentication and authorization in a Spring Security enabled application.

Step 1: Set up the dependencies

To use Spring Security in your application, you need to add the following dependencies in your pom.xml:

<dependency>
    <groupId>org.springframework.security</groupId>
    <artifactId>spring-security-web</artifactId>
    <version>5.4.2</version>
</dependency>
<dependency>
    <groupId>org.springframework.security</groupId>
    <artifactId>spring-security-config</artifactId>
    <version>5.4.2</version>
</dependency>

Step 2: Configure Spring Security

Create a SecurityConfig class and configure Spring Security. In this example, we'll set up basic authentication and authorization, which means that users will need to provide a username and password to access the application.

java

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests()
            .anyRequest().authenticated()
            .and()
            .formLogin().permitAll();
    }

    @Autowired
    public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
        auth.inMemoryAuthentication()
            .withUser("user").password("password").roles("USER");
    }
}

Step 3: Add Security to your controller

Next, you need to add the @PreAuthorize or @PostAuthorize annotations to your controllers to specify who is allowed to access the different pages of your application.

@RestController
public class MyController {
    @GetMapping("/admin")
    @PreAuthorize("hasRole('ROLE_ADMIN')")
    public String admin() {
        return "Admin page";
    }

    @GetMapping("/user")
    @PreAuthorize("hasRole('ROLE_USER')")
    public String user() {
        return "User page";
    }
}

Step 4: Test the application

Now you can run the application and test the authentication and authorization. You should be able to access the /user page by providing the username user and password password. However, you should not be able to access the /admin page, as the user is only assigned the ROLE_USER role.

This is just a basic example of authentication and authorization in Spring Security. You can customize this example to fit your specific needs and security requirements.

I hope this blog post has given you a good starting point for implementing authentication and authorization in your Spring Security enabled application. Happy coding!