-1

I am pretty new in Spring Security and I have some doubts related these 2 different configurations that I found in 2 different projects. I want understand is one is better that the other or if these are equivalent.

PROJECT 1:

spring-security.xml of the project 1:

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xmlns:security="http://www.springframework.org/schema/security"
    xsi:schemaLocation="http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-4.0.xsd
        http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd">

    <security:http>
        <security:intercept-url pattern="/springLogin" access="permitAll"/>
        <security:intercept-url pattern="/doSpringLogin" access="permitAll"/>
        <security:intercept-url pattern="/springHome" access="hasRole('ROLE_USER')"/>
        <security:intercept-url pattern="/springLogout" access="permitAll"/>
        <security:intercept-url pattern="/springLogin?error=true" access="permitAll"/>
        <security:form-login login-page="/springLogin" login-processing-url="/doSpringLogin"
        default-target-url="/springHome" authentication-failure-url="/springLogin?error=true"
        username-parameter="username" password-parameter="password"
        />
        <security:csrf disabled="true"/>
        <security:logout logout-url="/springLogout" logout-success-url="/springLogin"/>
    </security:http>

    <bean id="userDetailsServiceImpl" class="com.demo.security.UserDetailsServiceImpl"></bean>

    <bean id="authenticationProvider" class="org.springframework.security.authentication.dao.DaoAuthenticationProvider">
        <property name="userDetailsService" ref="userDetailsServiceImpl"></property>
    </bean>

    <bean id="authenticationManager" class="org.springframework.security.authentication.ProviderManager">
        <constructor-arg name="providers">
            <list>
                <ref bean="authenticationProvider"/>
            </list>
        </constructor-arg>
    </bean>

    <security:authentication-manager>
        <security:authentication-provider user-service-ref="userDetailsServiceImpl">
            <security:password-encoder hash="plaintext"></security:password-encoder>
        </security:authentication-provider>
    </security:authentication-manager>

</beans>

As you can see in the previous Spring Security configuration file first I declare the secured resource and the access rooles to these resource (what kind of user can access to these resources)

Then there are declared some bean, that are:

1) userDetailsServiceImpl that is an instance of the com.demo.security.UserDetailsServiceImpl class:

public class UserDetailsServiceImpl implements UserDetailsService {

    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        System.out.println(username);

        // Obtain the User object from the User database table using the username as key:
        User user = RegisteryDAO.getUserDAO().getUserByUsername(username);

        if(user == null){
            return null;
        }

        List<GrantedAuthority> authorities = new ArrayList<GrantedAuthority>();

        // Populate the authorites list with a new SimpleGrantedAuthority object created using the user role:
        authorities.add(new SimpleGrantedAuthority(user.getRole()));

        // Create a new UserDetail object using the username and its authorities list:
        UserDetails userDetails = new org.springframework.security.core.userdetails.
                User(user.getUsername(), user.getPassword(), true, true, true, true, authorities);


        return userDetails;
    }

}

As you can see this bean is an implementation of the UserDetailsService interface provided from Spring. So it do the following operation:

  • Obtain the User object from the User database table using the username as key.

  • Populate the authorites list with a new SimpleGrantedAuthority object created using the user role.

  • Create and finnally return a new UserDetail object using the username and its authorities list.

2) The authenticationProvider bean:

<bean id="authenticationProvider" class="org.springframework.security.authentication.dao.DaoAuthenticationProvider">
        <property name="userDetailsService" ref="userDetailsServiceImpl"></property>
</bean>

that take the previous userDetailsServiceImpl bean as reference.

This bean that user details from a UserDetailsService.

3) An authenticationManager that is an instance of the ProviderManager

<bean id="authenticationManager" class="org.springframework.security.authentication.ProviderManager">
    <constructor-arg name="providers">
        <list>
            <ref bean="authenticationProvider"/>
        </list>
    </constructor-arg>
</bean>

thattake a list of ProviderManager objects (in this case only one that is represented by the authenticationProvider bean). This object iterates an Authentication request through a list of AuthenticationProviders and decided if the request toward a specific resource is acceptable using the role declared inside the tag (but I am not sure about this assertion, correct me if it is wrong).

Ok. This is pretty clear for me...now into a second project I have a different configuration.

SECOND PROJECT:

Into the spring-security.xml configuration file I only have:

<?xml version="1.0" encoding="UTF-8"?>
<beans:beans xmlns="http://www.springframework.org/schema/security" 
    xmlns:beans="http://www.springframework.org/schema/beans" 
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
    xsi:schemaLocation="http://www.springframework.org/schema/beans 
                        http://www.springframework.org/schema/beans/spring-beans-4.0.xsd
                        http://www.springframework.org/schema/security 
                        http://www.springframework.org/schema/security/spring-security-4.0.xsd">

      <http pattern="/resources/**" security="none"/>
       <http auto-config="true" use-expressions="true" authentication-manager-ref="authenticationManager">
        <intercept-url pattern="/login" access="permitAll" />
        .............................................................
        SOME ROLES
        .............................................................
        <logout logout-success-url="/login" logout-url="/logout" />
        <form-login  login-page="/login"  
                     authentication-failure-url="/login?error=true"
                    default-target-url="/"
                    username-parameter="nomeUtente"
                    password-parameter="password"
                    login-processing-url="/j_spring_security_check"/>
        <csrf disabled="true"/>
        <!--  <session-management  invalid-session-url="/sessionTimeout" />-->
    </http> 

    <authentication-manager id="authenticationManager" >
        <authentication-provider>
            <jdbc-user-service data-source-ref="datasource" 
                users-by-username-query="select des_usr_par, des_psw_par,true from TID001_ANAGPARTECIPA where des_usr_par =?"
                 authorities-by-username-query="select des_usr_par, prg_par from TID001_ANAGPARTECIPA where des_usr_par = ? "/>

that automatically retrieve the authorities performing a query on the table where the user are stored.

So what is the better way to insert Spring Security into a project? The first one or the more compact second one?

        </authentication-provider>
    </authentication-manager>

</beans:beans>

As you can see in this case it is not declared a service (that use a DAO) that return a UserDetails objet that is used by an authenticationProvider bean used itself by the ProviderManager.

In this case I only have this statment:

<authentication-manager id="authenticationManager" >
    <authentication-provider>
        <jdbc-user-service data-source-ref="datasource" 
            users-by-username-query="select des_usr_par, des_psw_par,true from TID001_ANAGPARTECIPA where des_usr_par =?"
             authorities-by-username-query="select des_usr_par, prg_par from TID001_ANAGPARTECIPA where des_usr_par = ? "/>

    </authentication-provider>
</authentication-manager>

that I think automatically declare an authentication manager bean having id="authenticationManager" (but what is its concrete type?) that use another authentication-provider bean (but what is its concrete type?)

1 Answer 1

1

It totally depends on your need. Spring provides its own classes for authentication and authorization. But if you want to do it at your own, you can use second option. i.e User details service.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.