Back to Spring Boot Course

Spring Boot Course

Spring Security Basics

What are authentication and authorization? Which must come first?

Authentication

  • Determination of who
  • Technically it is the determination if a principal is who they say they are
  • Principals can be human or machines

In Spring Security, the authentication process consists of the following steps quoted from the Spring Security reference:

  • The username and password are obtained and combined into an instance of UsernamePasswordAuthenticationToken (an instance of the Authentication interface).
  • The token is passed to an instance of AuthenticationManager for validation.
  • The AuthenticationManager returns a fully populated Authentication instance on successful authentication.
  • The security context is established by calling SecurityContextHolder.getContext() .setAuthentication(…), passing in the returned authentication object.

Authorization

  • Determines what the principal can or cannot do
  • Authorization is based on authentication
  • Authorization is often called as access control

Authorization typically involves the following two separate aspects that combine to describe the accessibility of the secured system:

  • The first is the mapping of an authenticated principal to one or more authorities (often called roles);
  • The second is the assignment of authority checks to secured resources of the system.

Which must come first?

Unless there is some type of authorization that specifies what resources and/or functions that can be accessed by anonymous users, authentication must always come before authorization.

screenshot of the app

Application Security Framework

  1. Login and Logout Functionality
  2. Allow/block access to URLs to logged in users
  3. Allow/block access to URLs to logged in users and with certain roles

Handles common vulnerabilities

  1. Session fixation
  2. Clickjacking
  3. Cross-site request forgery (CSRF)

With Spring Security we can do

  1. Username/password Authentication
  2. SSO/Okta/LDAP
  3. App Level Authorization
  4. Intra App Authorization like OAuth
  5. Microservice security(using tokens,JWT)
  6. Method Level Security

5 Core concepts in Spring Security

  1. Authentication(Who is this User?)

    Establishing that a principal's credentials are valid.

  2. Authorization(Are they allowed to do this?)

    Deciding if a principal is allowed to perform an action. Authentication comes first before Authorization because authorization process needs principal object with authority votes to decide user allow to perform a action for secured resource.

  3. Principal (currently logged in user(per request) and each user have multiple ID's)

    The principal is the currently logged in user.

  4. Granted Authority(fine grain permissions of what user can do)

    GrantedAuthority as an individual privilege for example could include READ_AUTHORITY, WRITE_PRIVILEGE, or even CAN_EXECUTE_AS_ROOT. When using a GrantedAuthority directly, such as through the use of an expression like hasAuthority('READ_AUTHORITY'), we are restricting access in a fine-grained manner.

  5. Roles(group of authorities that can be assigned to a user i.e.. coarse grained permissions(i.e.. grouping of permissions ))

    We can think of each Role as a coarse-grained GrantedAuthority that is represented as a String and prefixed with "ROLE". When using a Role directly, such as through an expression like hasRole("ADMIN"), we are restricting access in a coarse-grained manner.

Spring Security Flow

screenshot of the app

  1. AuthenticationFilter : A filter that intercepts and performs authentication of a particular request by delegating it to the authentication manager If authentication is successful, the authentication details is set into SecurityContext.
  2. Authentication : Using the supplied values from the user like username and password, the authentication object will be formed which will be given as an input to the AuthenticationManager interface.
  3. AuthenticationManager : Once received request from filter it delegates the validating of the user details to the authentication provider.
  4. AuthenticationProvider : It has all the logic of validating user details using UserDetailsService and PasswordEncoder.
  5. UserDetailsService : UserDetailsService retrieves UserDetails and implements the User interface using the supplied username.
  6. PasswordEncoder : Service interface for encoding passwords.
  7. SecurityContext : Interface defining the minimum security information associated with the current thread of execution It holds the authentication data post successful authentication.

User Management

screenshot of the app

org.springframework.security.core.userdetails.UserDetails
org.springframework.security.core.userdetails.User
org.springframework.security.core.userdetails.UserDetailsService
org.springframework.security.provisioning.UserDetailsManager
org.springframework.security.provisioning.InMemoryUserDetailsManager
org.springframework.security.provisioning.JdbcUserDetailsManager
org.springframework.security.ldap.userdetails.LdapUserDetailsManager

Let's explore different types of authentication and authorization in Spring Boot Security, using the Employee Management Service that we created in the previous session:

  • Form-Based Authentication
  • Basic Authentication
  • In-Memory Authentication
  • JDBC Authentication
  • JWT Authentication
  • OAuth