Spring Security 3.1 - Implement UserDetailsService with Spring Data JPA (Part 2)

Review

In the previous section, we have laid down the functional specs of the application. In this section, we will discuss the project's structure, write the Java classes, and organize them in layers.

Table of Contents

Part 1: Introduction and Functional Specs
Part 2: Java classes
Part 3: XML configuration
Part 4: HTML Files
Part 5: Running the Application

Project Structure

Our application is a Maven project and therefore follows Maven structure. As we create the classes, we've organized them in logical layers: domain, repository, service, and controller.

Here's a preview of our project's structure:

The Layers

Domain Layer

This layer contains two domain classes, User and Role. They represent our database tables, user and role respectively. Because we're developing a JPA-based repository, both classes must be annotated with JPA annotations.

	package org.krams.domain;
	import javax.persistence.CascadeType;
	import javax.persistence.Column;
	import javax.persistence.Entity;
	import javax.persistence.Id;
	import javax.persistence.OneToOne;
	@Entity(name="user")
	public class User {
	@Id
	private Long id;
	private String firstName;
	private String lastName;
	@Column(unique=true)
	private String username;
	private String password;
	@OneToOne(mappedBy="user", cascade={CascadeType.ALL})
	private Role role;
	...getters/setters
	}

view raw User.java hosted with ❤ by GitHub

	package org.krams.domain;
	import javax.persistence.Entity;
	import javax.persistence.Id;
	import javax.persistence.OneToOne;
	@Entity(name="role")
	public class Role {
	@Id
	private Long id;
	@OneToOne
	private User user;
	private Integer role;
	...getters/setters
	}

view raw Role.java hosted with ❤ by GitHub

Specifying the entity name inside the @Entity is not required. However, I've encountered instances where the tables are created in lowercase and uppercase, i.e user and USER. For consistency, I've specified them here.

Controller Layer

This layer contains two controllers, AccessController and MediatorController.

• AccessController is responsible for handling access related requests, mainly login and logout requests
• MediatorController is responsible for handling requests to common pages such as user and admin pages

	package org.krams.controller;
	import org.springframework.stereotype.Controller;
	import org.springframework.ui.Model;
	import org.springframework.web.bind.annotation.RequestMapping;
	import org.springframework.web.bind.annotation.RequestParam;
	@Controller
	@RequestMapping
	public class AccessController {
	@RequestMapping("/login")
	public String login(Model model, @RequestParam(required=false) String message) {
	model.addAttribute("message", message);
	return "access/login";
	}
	@RequestMapping(value = "/denied")
	public String denied() {
	return "access/denied";
	}
	@RequestMapping(value = "/login/failure")
	public String loginFailure() {
	String message = "Login Failure!";
	return "redirect:/login?message="+message;
	}
	@RequestMapping(value = "/logout/success")
	public String logoutSuccess() {
	String message = "Logout Success!";
	return "redirect:/login?message="+message;
	}
	}

view raw AccessController.java hosted with ❤ by GitHub

	package org.krams.controller;
	import org.springframework.stereotype.Controller;
	import org.springframework.web.bind.annotation.RequestMapping;
	@Controller
	@RequestMapping("/")
	public class MediatorController {
	@RequestMapping
	public String getHomePage() {
	return "home";
	}
	@RequestMapping(value="/user")
	public String getUserPage() {
	return "user";
	}
	@RequestMapping(value="/admin")
	public String getAdminPage() {
	return "admin";
	}
	}

view raw MediatorController.java hosted with ❤ by GitHub

Service Layer

This layer contains a single service, CustomUserDetailsService. Its main purpose is to retrieve user information from our custom database and translate that user information into a format that Spring Security understands. Take note of the helper methods provided within this class.

	package org.krams.service;
	import java.util.ArrayList;
	import java.util.Collection;
	import java.util.List;
	import org.krams.repository.UserRepository;
	import org.springframework.beans.factory.annotation.Autowired;
	import org.springframework.security.core.GrantedAuthority;
	import org.springframework.security.core.authority.SimpleGrantedAuthority;
	import org.springframework.security.core.userdetails.User;
	import org.springframework.security.core.userdetails.UserDetails;
	import org.springframework.security.core.userdetails.UserDetailsService;
	import org.springframework.security.core.userdetails.UsernameNotFoundException;
	import org.springframework.stereotype.Service;
	import org.springframework.transaction.annotation.Transactional;
	/**
	* A custom {@link UserDetailsService} where user information
	* is retrieved from a JPA repository
	*/
	@Service
	@Transactional(readOnly = true)
	public class CustomUserDetailsService implements UserDetailsService {
	@Autowired
	private UserRepository userRepository;
	/**
	* Returns a populated {@link UserDetails} object.
	* The username is first retrieved from the database and then mapped to
	* a {@link UserDetails} object.
	*/
	public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
	try {
	org.krams.domain.User domainUser = userRepository.findByUsername(username);
	boolean enabled = true;
	boolean accountNonExpired = true;
	boolean credentialsNonExpired = true;
	boolean accountNonLocked = true;
	return new User(
	domainUser.getUsername(),
	domainUser.getPassword().toLowerCase(),
	enabled,
	accountNonExpired,
	credentialsNonExpired,
	accountNonLocked,
	getAuthorities(domainUser.getRole().getRole()));
	} catch (Exception e) {
	throw new RuntimeException(e);
	}
	}
	/**
	* Retrieves a collection of {@link GrantedAuthority} based on a numerical role
	* @param role the numerical role
	* @return a collection of {@link GrantedAuthority
	*/
	public Collection<? extends GrantedAuthority> getAuthorities(Integer role) {
	List<GrantedAuthority> authList = getGrantedAuthorities(getRoles(role));
	return authList;
	}
	/**
	* Converts a numerical role to an equivalent list of roles
	* @param role the numerical role
	* @return list of roles as as a list of {@link String}
	*/
	public List<String> getRoles(Integer role) {
	List<String> roles = new ArrayList<String>();
	if (role.intValue() == 1) {
	roles.add("ROLE_USER");
	roles.add("ROLE_ADMIN");
	} else if (role.intValue() == 2) {
	roles.add("ROLE_USER");
	}
	return roles;
	}
	/**
	* Wraps {@link String} roles to {@link SimpleGrantedAuthority} objects
	* @param roles {@link String} of roles
	* @return list of granted authorities
	*/
	public static List<GrantedAuthority> getGrantedAuthorities(List<String> roles) {
	List<GrantedAuthority> authorities = new ArrayList<GrantedAuthority>();
	for (String role : roles) {
	authorities.add(new SimpleGrantedAuthority(role));
	}
	return authorities;
	}
	}

view raw CustomUserDetailsService.java hosted with ❤ by GitHub

What's the logic here?

1. We must implement UserDetailsService because we have a custom database
2. loadUserByUsername method must return an object that implements the UserDetails interface
3. We must map our domain org.krams.domain.User to org.springframework.security.core.userdetails.User
4. We must map numerical roles as SimpleGrantedAuthority objects
5. We are responsible for interpreting what each numerical role value represents
6. ROLE_USER and ROLE_ADMIN are abitrary values we assigned to numerical values

Repository Layer

This layer contains a single interface, UserRepository. And this is our data access object (DAO). With the help of Spring Data JPA, Spring will automatically provide the actual implementation.

What is Spring Data JPA?
Spring JPA is part of the umbrella Spring Data project that makes it easy to easily implement JPA based repositories.

Implementing a data access layer of an application has been cumbersome for quite a while. Too much boilerplate code has to be written to execute simple queries as well as perform pagination, and auditing. Spring JPA aims to significantly improve the implementation of data access layers by reducing the effort to the amount that's actually needed. As a developer you write your repository interfaces, including custom finder methods, and Spring will provide the implementation automatically.

Source: http://www.springsource.org/spring-data/jpa

	package org.krams.repository;
	import org.krams.domain.User;
	import org.springframework.data.jpa.repository.JpaRepository;
	public interface UserRepository extends JpaRepository<User, Long> {
	User findByUsername(String username);
	}

view raw UserRepository.java hosted with ❤ by GitHub

Utility classes

TraceInterceptor class is an AOP-based utility class to help us debug our application. This is a subclass of CustomizableTraceInterceptor (see Spring Data JPA FAQ)

	package org.krams.aop;
	import org.aopalliance.intercept.MethodInvocation;
	import org.apache.commons.logging.Log;
	import org.apache.log4j.Logger;
	import org.springframework.aop.interceptor.CustomizableTraceInterceptor;
	/**
	* Extends {@link CustomizableTraceInterceptor} to provide custom logging levels
	*/
	public class TraceInterceptor extends CustomizableTraceInterceptor {
	private static final long serialVersionUID = 287162721460370957L;
	protected static Logger logger4J = Logger.getLogger("aop");
	@Override
	protected void writeToLog(Log logger, String message, Throwable ex) {
	if (ex != null) {
	logger4J.debug(message, ex);
	} else {
	logger4J.debug(message);
	}
	}
	@Override
	protected boolean isInterceptorEnabled(MethodInvocation invocation, Log logger) {
	return true;
	}
	}

view raw TraceInterceptor.java hosted with ❤ by GitHub

Next

In the next section, we will focus on the configuration files and create them accordingly. Click here to proceed.

---

Share the joy: blogger tutorials Social Bookmarking Blogger Widget I'm reading: Spring Security 3.1 - Implement UserDetailsService with Spring Data JPA (Part 2) ~

Subscribe by reader Subscribe by email Share

Spring Security 3.1 - Implement UserDetailsService with Spring Data JPA (Part 1)

In this tutorial, we will create a simple Spring MVC application and secure it with Spring Security 3.1. We have a custom database schema where we will retrieve our authorized users and respective roles. Consequently, we will implement a custom UserDetailsService with the help of Spring Data JPA for quick implementation of JPA based repositories.

Table of Contents

Part 1: Introduction and Functional Specs
Part 2: Java classes
Part 3: XML configuration
Part 4: HTML Files
Part 5: Running the Application

Dependencies

• Spring core 3.1.0.RELEASE
• Spring Security 3.1.0.RELEASE
• Spring Data JPA 1.1.0.M1
• See pom.xml for details

Github
To access the source code, please visit the project's Github repository (click here)

Functional Specs

Before we start, we define our application's specs as follows:

• Two types of users: admin and regular users
• A login page that's accessible to all types of users, including unauthorized users
• All other pages are visible to registered users only
• A home page
• A user page
• An admin page which is visible only to admins

Database

As mentioned earlier, our application relies on a custom database schema to obtain its users.
The database contains two tables: user and role tables.

user and role table design

User table

The user table contains personal information of each user. Notice the password values are hashed using Md5.

user table

Role table

The role table contains role values of each user. We define a role value of 1 as an admin, while a role value of 2 as a regular user.

role table

Screenshots

Before we start the actual development, let's preview how our application should look like by providing screenshots. This is also a good way to clarify further the application's specs.

Login page
The login page contains two input fields: a username and a password field.

Login

Login failure page
When a user fails to login, the login page is displayed again with an error message Login Failure! at the bottom.

Login failure

User's view
When a regular user logs-in, the user should be redirected to the home page with Home, User, and Logout pages accessible to the user.

User's view

Admin's view
When an admin user logs-in, the user should be redirected to the home page with Home, User, Admin, and Logout pages accessible to the user.

Admin's view

Logout success page
When a user successfully logs out, the login page is displayed again with a success message Logout Success! at the bottom.

Logout success

Next

In the next section, we will discuss the project's structure and start writing the Java classes. Click here to proceed.

---

Share the joy: blogger tutorials Social Bookmarking Blogger Widget I'm reading: Spring Security 3.1 - Implement UserDetailsService with Spring Data JPA (Part 1) ~

Subscribe by reader Subscribe by email Share

Spring Security 3.1 - Implement UserDetailsService with Spring Data JPA (Part 3)

Review

In the previous section, we have implemented the Java classes and organized them accordingly: domain, repository, service, and controller. In this section, we will create the necessary configuration files, which are mainly XML files, and discuss them thoroughly.

Table of Contents

Part 1: Introduction and Functional Specs
Part 2: Java classes
Part 3: XML configuration
Part 4: HTML Files
Part 5: Running the Application

Configuration

There are two important configuration files required to secure our application with Spring Security:

• spring-security.xml (arbitrary name)
• web.xml

spring-security.xml

This contains the core Spring Security configuration.

	<?xml version="1.0" encoding="UTF-8"?>
	<beans:beans xmlns="http://www.springframework.org/schema/security"
	xmlns:beans="http://www.springframework.org/schema/beans"
	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
	xmlns:p="http://www.springframework.org/schema/p"
	xmlns:util="http://www.springframework.org/schema/util"
	xsi:schemaLocation="http://www.springframework.org/schema/beans
	http://www.springframework.org/schema/beans/spring-beans-3.1.xsd
	http://www.springframework.org/schema/security
	http://www.springframework.org/schema/security/spring-security-3.1.xsd
	http://www.springframework.org/schema/util
	http://www.springframework.org/schema/util/spring-util-3.1.xsd">
	<http pattern="/resources" security="none" />
	<http auto-config="true" use-expressions="true">
	<intercept-url pattern="/login" access="permitAll"/>
	<intercept-url pattern="/logout" access="permitAll"/>
	<intercept-url pattern="/denied" access="hasRole('ROLE_USER')"/>
	<intercept-url pattern="/" access="hasRole('ROLE_USER')"/>
	<intercept-url pattern="/user" access="hasRole('ROLE_USER')"/>
	<intercept-url pattern="/admin" access="hasRole('ROLE_ADMIN')"/>
	<form-login login-page="/login"
	authentication-failure-url="/login/failure"
	default-target-url="/"/>
	<access-denied-handler error-page="/denied"/>
	<logout invalidate-session="true"
	logout-success-url="/logout/success"
	logout-url="/logout"/>
	</http>
	<authentication-manager>
	<authentication-provider user-service-ref="customUserDetailsService">
	<password-encoder hash="md5"/>
	</authentication-provider>
	</authentication-manager>
	</beans:beans>

view raw spring-security.xml hosted with ❤ by GitHub

Let's examine further the contents of this file:

the http tag

<http pattern="/resources" security="none" />

view raw spring-security.xml hosted with ❤ by GitHub

This means the path /resources should be ignored by Spring Security; therefore it will not be secured. Why do you want to do this? Mainly because these are static images, CSS, and JavaScript files that don't need to be secured.

the second http tag

	<http auto-config="true" use-expressions="true">
	...
	</http>

view raw spring-security.xml hosted with ❤ by GitHub

This contains the core security rules of our application. In previous versions of Spring Security, you're only allowed to have one http element.

• auto-config is a shorthand for the following (see more):
  

  	<http>
  	<form-login />
  	<http-basic />
  	<logout />
  	</http>

  view raw fragment.xml hosted with ❤ by GitHub
  
  
• use-expressions allows us to use SPEL (Spring EL expressions) support (see more)

intercept urls

	<intercept-url pattern="/login" access="permitAll"/>
	<intercept-url pattern="/logout" access="permitAll"/>
	<intercept-url pattern="/denied" access="hasRole('ROLE_USER')"/>
	<intercept-url pattern="/" access="hasRole('ROLE_USER')"/>
	<intercept-url pattern="/user" access="hasRole('ROLE_USER')"/>
	<intercept-url pattern="/admin" access="hasRole('ROLE_ADMIN')"/>

view raw spring-security.xml hosted with ❤ by GitHub

Here we declare URL patterns to be protected. Notice the use of SPEL hasRole and permitAll (see more)

form login

	<form-login login-page="/login"
	authentication-failure-url="/login/failure"
	default-target-url="/"/>

view raw spring-security.xml hosted with ❤ by GitHub

This declares our login settings:

• login-page: the URL path of our login page
• authentication-failure-url: the URL where a user will be redirected after a failed login
• default-target-url: the URL where a user will be redirected after a successful login

denied handler

<access-denied-handler error-page="/denied"/>

view raw spring-security.xml hosted with ❤ by GitHub

This declares the URL where a user will be redirected after a denied access.

authentication manager

	<logout invalidate-session="true"
	logout-success-url="/logout/success"
	logout-url="/logout"/>

view raw spring-security.xml hosted with ❤ by GitHub

This is similar with the login element.

• logout-success-url: the URL where a user will be redirected after a successful logout
• logout-url: the URL path of our logout page

	<authentication-manager>
	<authentication-provider user-service-ref="customUserDetailsService">
	<password-encoder hash="md5"/>
	</authentication-provider>
	</authentication-manager>

view raw spring-security.xml hosted with ❤ by GitHub

• authentication-manager: registers an AuthenticationManager that provides authentication services (see more)
• authentication-provider: this is a shorthand for configuring a DaoAuthenticationProvider which loads user information from a UserDetailsService (see more)
• user-service-ref: this allows us to declare a custom UserDetailsService
• password-encoder: this allows us to declare various password encoders such as md5 and sha (see more)

web.xml

Besides the usual servlet declaration, the web.xml is where you declare the Spring Security filter and name of configuration file to read from.

To enable Spring Security, follow these guidelines:

• Add a DelegatingFilterProxy

  	<filter>
  	<filter-name>springSecurityFilterChain</filter-name>
  	<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
  	</filter>

  view raw web.xml hosted with ❤ by GitHub
• Add a springSecurityFilterChain mapping

  	<filter-mapping>
  	<filter-name>springSecurityFilterChain</filter-name>
  	<url-pattern>/*</url-pattern>
  	</filter-mapping>

  view raw web.xml hosted with ❤ by GitHub
• Add a contextConfigLocation

  	<context-param>
  	<param-name>contextConfigLocation</param-name>
  	<param-value>
  	/WEB-INF/spring-security.xml
  	/WEB-INF/applicationContext.xml
  	</param-value>
  	</context-param>

  view raw web.xml hosted with ❤ by GitHub
  You must declare your applicationContext.xml and spring-security.xml here

Here's our complete web.xml file:

	<?xml version="1.0" encoding="UTF-8"?>
	<web-app id="WebApp_ID" version="2.4" xmlns="http://java.sun.com/xml/ns/j2ee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://java.sun.com/xml/ns/j2ee http://java.sun.com/xml/ns/j2ee/web-app_2_4.xsd">
	<display-name>Spring Security Tutorial</display-name>
	<filter>
	<filter-name>springSecurityFilterChain</filter-name>
	<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
	</filter>
	<filter-mapping>
	<filter-name>springSecurityFilterChain</filter-name>
	<url-pattern>/*</url-pattern>
	</filter-mapping>
	<context-param>
	<param-name>contextConfigLocation</param-name>
	<param-value>
	/WEB-INF/spring-security.xml
	/WEB-INF/applicationContext.xml
	</param-value>
	</context-param>
	<listener>
	<listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
	</listener>
	<servlet>
	<servlet-name>spring</servlet-name>
	<servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
	</servlet>
	<servlet-mapping>
	<servlet-name>spring</servlet-name>
	<url-pattern>/</url-pattern>
	</servlet-mapping>
	</web-app>

view raw web.xml hosted with ❤ by GitHub

Datasource

Since we're using JPA and Spring Data JPA to simplify data access, we must also declare the corresponding configuration files. Please read the inline comments for more info.

spring-data.xml
This contains all datasource-related configuration.

	<?xml version="1.0" encoding="UTF-8"?>
	<beans xmlns="http://www.springframework.org/schema/beans"
	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
	xmlns:p="http://www.springframework.org/schema/p"
	xmlns:tx="http://www.springframework.org/schema/tx"
	xmlns:context="http://www.springframework.org/schema/context"
	xmlns:jdbc="http://www.springframework.org/schema/jdbc"
	xmlns:jpa="http://www.springframework.org/schema/data/jpa"
	xmlns:util="http://www.springframework.org/schema/util"
	xsi:schemaLocation="
	http://www.springframework.org/schema/beans
	http://www.springframework.org/schema/beans/spring-beans-3.1.xsd
	http://www.springframework.org/schema/tx
	http://www.springframework.org/schema/tx/spring-tx-3.1.xsd
	http://www.springframework.org/schema/context
	http://www.springframework.org/schema/context/spring-context-3.1.xsd
	http://www.springframework.org/schema/jdbc
	http://www.springframework.org/schema/jdbc/spring-jdbc-3.1.xsd
	http://www.springframework.org/schema/data/jpa
	http://www.springframework.org/schema/data/jpa/spring-jpa.xsd
	http://www.springframework.org/schema/util
	http://www.springframework.org/schema/util/spring-util-3.1.xsd">
	<context:property-placeholder properties-ref="deployProperties" />
	<tx:annotation-driven transaction-manager="transactionManager" />
	<!-- Activate Spring Data JPA repository support -->
	<jpa:repositories base-package="org.krams.repository" />
	<!-- Declare a datasource that has pooling capabilities-->
	<bean id="jpaDataSource" class="com.mchange.v2.c3p0.ComboPooledDataSource"
	destroy-method="close"
	p:driverClass="${app.jdbc.driverClassName}"
	p:jdbcUrl="${app.jdbc.url}"
	p:user="${app.jdbc.username}"
	p:password="${app.jdbc.password}"
	p:acquireIncrement="5"
	p:idleConnectionTestPeriod="60"
	p:maxPoolSize="100"
	p:maxStatements="50"
	p:minPoolSize="10" />
	<!-- Declare a JPA entityManagerFactory -->
	<bean id="entityManagerFactory" class="org.springframework.orm.jpa.LocalContainerEntityManagerFactoryBean"
	p:persistenceXmlLocation="classpath*:META-INF/persistence.xml"
	p:persistenceUnitName="hibernatePersistenceUnit"
	p:dataSource-ref="jpaDataSource"
	p:jpaVendorAdapter-ref="hibernateVendor"/>
	<!-- Specify our ORM vendor -->
	<bean id="hibernateVendor" class="org.springframework.orm.jpa.vendor.HibernateJpaVendorAdapter"
	p:showSql="false"/>
	<!-- Declare a transaction manager-->
	<bean id="transactionManager" class="org.springframework.orm.jpa.JpaTransactionManager"
	p:entityManagerFactory-ref="entityManagerFactory"/>
	</beans>

view raw spring-data.xml hosted with ❤ by GitHub

Next

In the next section, we will turn our attention towards the view layer which mainly consists of JSP files. Click here to proceed.

---

Share the joy: blogger tutorials Social Bookmarking Blogger Widget I'm reading: Spring Security 3.1 - Implement UserDetailsService with Spring Data JPA (Part 3) ~

Subscribe by reader Subscribe by email Share

Spring Security 3.1 - Implement UserDetailsService with Spring Data JPA (Part 4)

Review

In the previous section, we have created the configuration files and discussed them accordingly. In this section, we will focus on the view layer, in particular the HTML files.

Table of Contents

Part 1: Introduction and Functional Specs
Part 2: Java classes
Part 3: XML configuration
Part 4: HTML Files
Part 5: Running the Application

HTML Files

After the configuration files, we'll now move to the HTML files. Actually, we'll be editing JSP files instead.

Login Page

The login page can be designed in any way you like. But there areimportant points to remember. Here they are:

• Use POST not GET!

  <form ... method="post" >

  view raw login.jsp hosted with ❤ by GitHub
• Use j_spring_security_check for the action value.

  <form ... action="j_spring_security_check" >

  view raw login.jsp hosted with ❤ by GitHub
  You may have to modify the action value depending on your URL mapping structure, i.e. it could be ../j_spring_security_check or ../../j_spring_security_check in certain cases.
• Use j_username for the username input

  <input id="j_username" name="j_username" type="text"/>

  view raw login.jsp hosted with ❤ by GitHub
• Use j_password for the password input

  <input id="j_password" name="j_password" type="password"/>

  view raw login.jsp hosted with ❤ by GitHub

Here's our complete login.jsp source:

	<%@ taglib uri="http://java.sun.com/jsp/jstl/core" prefix="c" %>
	<%@ taglib uri="http://www.springframework.org/tags/form" prefix="form" %>
	<%@ taglib uri="http://www.springframework.org/tags" prefix="spring" %>
	<html>
	<head>
	<link rel="stylesheet" type="text/css" media="screen" href="resources/css/style.css"/>
	<title>Login</title>
	</head>
	<body>
	<form class="login-form" action="j_spring_security_check" method="post" >
	<fieldset>
	<legend>Login Here</legend>
	<p>
	<label for="j_username">Username</label>:
	<input id="j_username" name="j_username" size="20" maxlength="50" type="text"/>
	</p>
	<p>
	<label for="j_password">Password</label>:
	<input id="j_password" name="j_password" size="20" maxlength="50" type="password"/>
	</p>
	<p><input type="submit" value="Login"/></p>
	</fieldset>
	</form>
	<p class="message">${message}</p>
	</body>
	</html>

view raw login.jsp hosted with ❤ by GitHub

Menu Page

The menu page needs extra configuration because we're required to display all links to admin users but regular users can only see non-admin pages. Particularly, the "Admin" link must be secured.

If you examine carefully the spring-security.xml configuration file, we've already marked the /admin url to be accessible to admins only. But why do we need to secure it again in the menu page? That's because the declaration in spring-security.xml only secures the URL but it doesn't hide the HTML link. To hide and secure the link, we must manually declare it.

User's view

Admin's view

To hide a section of HTML (i.e. a link), follow these steps:

• Add the following line in the top section of your JSP page (Make sure to edit the role accordingly):

  <%@ taglib prefix="sec" uri="http://www.springframework.org/security/tags" %>

  view raw menu.jsp hosted with ❤ by GitHub
• Add the following lines to whatever HTML section you need to secure:

  	<sec:authorize access="hasRole('ROLE_ADMIN')">
  	<!-- HTML CHUNK TO BE SECURED -->
  	</sec:authorize>

  view raw menu.jsp hosted with ❤ by GitHub

Here's our complete menu.jsp source:

	<%@ taglib uri="http://java.sun.com/jsp/jstl/core" prefix="c" %>
	<%@ taglib prefix="sec" uri="http://www.springframework.org/security/tags" %>
	<%@ taglib uri="http://www.springframework.org/tags" prefix="spring" %>
	<%@ page import="org.springframework.security.core.context.SecurityContextHolder" %>
	<c:url value="/" var="homeUrl"/>
	<c:url value="user" var="userUrl"/>
	<c:url value="admin" var="adminUrl"/>
	<c:url value="logout" var="logoutUrl"/>
	<div class="menu">
	<ul>
	<li><a href="${homeUrl}">Home</a></li>
	<li><a href="${userUrl}">User</a></li>
	<sec:authorize access="hasRole('ROLE_ADMIN')">
	<li><a href="${adminUrl}">Admin</a></li>
	</sec:authorize>
	<li><a href="${logoutUrl}">Logout</a></li>
	</ul>
	<span id="menu-username"><%=SecurityContextHolder.getContext().getAuthentication().getName()%></span>
	<br style="clear:left"/>
	</div>

view raw menu.jsp hosted with ❤ by GitHub

Next

In the next section, we will build and run the application using Maven, and show how to import the project in Eclipse. Click here to proceed.

---

Share the joy: blogger tutorials Social Bookmarking Blogger Widget I'm reading: Spring Security 3.1 - Implement UserDetailsService with Spring Data JPA (Part 4) ~

Subscribe by reader Subscribe by email Share

Spring Security 3.1 - Implement UserDetailsService with Spring Data JPA (Part 5)

Review

We have just completed our application! In the previous sections, we have discussed the functional specs, created the Java classes, declared the configuration files, and wrote the HTMl files. In this section, we will build and run the application using Maven, and show how to import the project in Eclipse.

Table of Contents

Part 1: Introduction and Functional Specs
Part 2: Java classes
Part 3: XML configuration
Part 4: HTML Files
Part 5: Running the Application

Running the Application

Access the source code

To download the source code, please visit the project's Github repository (click here)

Preparing the data source

1. Run MySQL (install one if you don't have one yet)
2. Create a new database:
   

   spring_security_tutorial

3. Import the following file which is included in the source code under the src/main/resources folder:
   

   spring_security_tutorial.sql

Building with Maven

1. Ensure Maven is installed
2. Open a command window (Windows) or a terminal (Linux/Mac)
3. Run the following command:
   

   mvn tomcat:run

4. You should see the following output:
   

   [INFO] Scanning for projects...
   [INFO] Searching repository for plugin with prefix: 'tomcat'.
   [INFO] artifact org.codehaus.mojo:tomcat-maven-plugin: checking for updates from central
   [INFO] artifact org.codehaus.mojo:tomcat-maven-plugin: checking for updates from snapshots
   [INFO] ------------------------------------------
   [INFO] Building spring-security Maven Webapp
   [INFO]    task-segment: [tomcat:run]
   [INFO] ------------------------------------------
   [INFO] Preparing tomcat:run
   [INFO] [apt:process {execution: default}]
   [INFO] [resources:resources {execution: default-resources}]
   [INFO] [tomcat:run {execution: default-cli}]
   [INFO] Running war on http://localhost:8080/spring-security-tutorial
   Jan 14, 2012 11:52:54 PM org.apache.catalina.startup.Embedded start
   INFO: Starting tomcat server
   Jan 14, 2012 11:52:54 PM org.apache.catalina.core.StandardEngine start
   INFO: Starting Servlet Engine: Apache Tomcat/6.0.29
   Jan 14, 2012 11:52:54 PM org.apache.catalina.core.ApplicationContext log
   INFO: Initializing Spring root WebApplicationContext
   Jan 14, 2012 11:52:58 PM org.apache.coyote.http11.Http11Protocol init
   INFO: Initializing Coyote HTTP/1.1 on http-8080
   Jan 14, 2012 11:52:58 PM org.apache.coyote.http11.Http11Protocol start
   INFO: Starting Coyote HTTP/1.1 on http-8080
   

Note: If the project will not build due to missing repositories, please enable the repositories section in the pom.xml!

Access the Login page

1. Follow the steps with Building with Maven
2. Open a browser
3. Enter the following URL (8080 is the default port for Tomcat):
   

   http://localhost:8080/spring-security-tutorial/

4. Currently there are two accounts included in the sample database. Here are the credentials:
   

   username	password	role
   john	admin	administrator
   jane	user	regular user

Import the project in Eclipse

1. Ensure Maven is installed
2. Open a command window (Windows) or a terminal (Linux/Mac)
3. Run the following command:
   

   mvn eclipse:eclipse -Dwtpversion=2.0

4. You should see the following output:
   

   [INFO] Scanning for projects...
   [INFO] Searching repository for plugin with prefix: 'eclipse'.
   [INFO] org.apache.maven.plugins: checking for updates from central
   [INFO] org.apache.maven.plugins: checking for updates from snapshots
   [INFO] org.codehaus.mojo: checking for updates from central
   [INFO] org.codehaus.mojo: checking for updates from snapshots
   [INFO] artifact org.apache.maven.plugins:maven-eclipse-plugin: checking for updates from central
   [INFO] artifact org.apache.maven.plugins:maven-eclipse-plugin: checking for updates from snapshots
   [INFO] -----------------------------------------
   [INFO] Building spring-security Maven Webapp
   [INFO]    task-segment: [eclipse:eclipse]
   [INFO] -----------------------------------------
   [INFO] Preparing eclipse:eclipse
   [INFO] [apt:process {execution: default}]
   [INFO] [eclipse:eclipse {execution: default-cli}]
   [INFO] Adding support for WTP version 2.0.
   [INFO] -----------------------------------------
   [INFO] BUILD SUCCESSFUL
   [INFO] -----------------------------------------
   

   This command will add the following files to your project:
   

   .classpath
   .project
   .settings
   target

   You may have to enable "show hidden files" in your file explorer to view them
   
5. Open Eclipse and import the project

Conclusion

That's it! We've have successfully completed our Spring Security 3.1 tutorial. We've learned how to secure a Spring MVC application with Spring Security and integrate with a custom user database schema. Furthermore, we have simplified data access with the help of Spring Data JPA.

I hope you've enjoyed this tutorial. Don't forget to check my other tutorials at the Tutorials section.

Revision History

---

Revision	Date	Description
1	Jan 13 2012	Uploaded tutorial and Github repository
2	Jan 14 2012	Added revision history
3	Jan 15 2012	Added sample Maven output
4	Jan 19 2012	Added dependencies section
5	Jan 20 2012	Rephrased the logic behind CustomUserDetailsService, Rephrased Part 2
6	Jan 21 2012	Fixed Evgeny Goldin repository location

---

Share the joy: blogger tutorials Social Bookmarking Blogger Widget I'm reading: Spring Security 3.1 - Implement UserDetailsService with Spring Data JPA (Part 5) ~

Subscribe by reader Subscribe by email Share