Back to Spring Boot Course

How to configure InMemory authentication in spring security?

Steps

1. Get Hold of AuthenticationManagerBuilder
2. Set the configuration on it.

How to get hold of AuthenticationManagerBuilder?

There is a class called WebSecurityConfigurerAdapter.java which we need to extend and override the configure(AuthenticationManagerBuilder auth).

Now i will remove the default user id and password which i provided in my earlier step so that i can multiple user,password and role for the same.

As this is a sample, i am using NoOpPasswordEncoder for encoding the password.

@Configuration
@EnableWebSecurity
public class ApplicationSecurityConfig {

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }

    @Bean
    public UserDetailsService userDetailsService() {
        return new InMemoryUserDetailsManager(
                User.withUsername("praveen")
                        .password(passwordEncoder().encode("praveen@2024"))
                        .roles("ADMIN")
                        .build(),
                User.withUsername("prasad")
                        .password(passwordEncoder().encode("prasad@2024"))
                        .roles("USER")
                        .build()
        );
    }
}

How to configure InMemory authorization in spring security?

Let's use the InMemoryUserDetailsManager for authentication and also lets restrict the DELETE endpoint to ADMIN alone as a part of authorization.

package com.praveen.employee.config;

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.http.HttpMethod;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.provisioning.InMemoryUserDetailsManager;
import org.springframework.security.web.SecurityFilterChain;

import static org.springframework.security.config.Customizer.withDefaults;

@Configuration
@EnableWebSecurity
public class SecurityConfig {

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }

    @Bean
    public UserDetailsService userDetailsService() {
        return new InMemoryUserDetailsManager(
                User.withUsername("praveen")
                        .password(passwordEncoder().encode("praveen@2024"))
                        .roles("ADMIN")
                        .build(),
                User.withUsername("prasad")
                        .password(passwordEncoder().encode("prasad@2024"))
                        .roles("USER")
                        .build()
        );
    }

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
                .authorizeHttpRequests(authorizeRequests ->
                        authorizeRequests
                                .requestMatchers(HttpMethod.DELETE, "/api/v1/employees/{id}").hasRole("ADMIN")
                                .requestMatchers("/api/v1/employees").hasAnyRole("USER", "ADMIN")
                                .requestMatchers("/").permitAll()
                )
                .httpBasic(withDefaults());
        return http.build();
    }
}

How does spring authentication works internally?

This is done using filters which does the magic here.

In general for Authentication the inputs will be creditionals and output will be principle.

AuthenticationProvider authenticate(Authentication authentication) method does the above.