We would follow a step by step pattern. The steps are as follows:<\/p>\n
- \n
- Create an unsecured web application<\/a><\/li>\n
- Add default Spring Authentication<\/a><\/li>\n
- Test the application<\/a><\/li>\n
- Add login details in the application.propeties file and test the application<\/a><\/li>\n
- Extend the WebsecurityConfigurer<\/a><\/li>\n
- Create a UserDetails object<\/a><\/li>\n
- Test the application<\/a><\/li>\n
- Next Steps (Storing user details in a database)<\/a><\/li>\n<\/ol>\n
Let’s now see the details of what happens in these steps.<\/p>\n
<\/p>\n
1. Create an Unsecured Web Application<\/strong><\/h5>\n
I’m sure by now you know how to create a starter application. So create one. Remember to add the following dependencies:<\/p>\n
- \n
- Thymeleaf<\/li>\n
- spring-web-starter<\/li>\n<\/ul>\n
After creating the application and adding the dependencies, the follow the steps:<\/p>\n
Step 1:<\/strong> In the templates folder, create a html page. Call it index.html.<\/p>\n
Step 2:<\/strong> Write some welcome message in this html file<\/p>\n
Note: the templates folder is found inside the src\/main\/resources folder<\/p>\n
Step 3:<\/strong> Create\u00a0 class and call it HomeController.<\/p>\n
Step 4:<\/strong> Annotate this class with the @Controller annotation<\/p>\n
Step 5:<\/strong> Write a method inside this class to return the index.html page.<\/p>\n
Step 6:<\/strong> Annotate this method with the @RequestMapping of “\/home”<\/p>\n
The HomeController class would now look like this.<\/p>\n
<\/p>\n
<\/p>\n
@Controller<\/span>\npublic<\/span> class<\/span> HomeController<\/span> {<\/span>\n\t\n\t@RequestMapping<\/span>(<\/span>\"\/home\"<\/span>)<\/span>\n\tpublic<\/span> String goHome<\/span>()<\/span> {<\/span>\n\t\treturn<\/span> \"index\"<\/span>;<\/span>\n\t}<\/span>\n\t\n}<\/span>\n<\/pre>\n<\/p>\n
The index.html page would look like as shown below:<\/p>\n
<!DOCTYPE html><\/span>\n<html><\/span>\n<head><\/span>\n<meta<\/span> charset=<\/span>\"ISO-8859-1\"<\/span>><\/span>\n<title><\/span>Spring Security<\/title><\/span>\n<\/head><\/span>\n<body><\/span>\n<br><\/span>\n<h2<\/span> align=<\/span>\"center\"<\/span>><\/span> Welcome to Spring Security<\/h2><\/span>\n<\/body><\/span>\n<\/html><\/span>\n<\/pre>\n<\/p>\n
Now you can launch the application. Visit http:\/\/localhost\/home<\/a>. You will notice that there is no security. You can easily access that page.<\/p>\n
Let’ s now add authentication.<\/p>\n
<\/p>\n
2. Add Default Spring Authentication<\/strong><\/h5>\n
You can add a default authentication. If you do this, then you will have a simple login form created for you. Also you with have a username and password.<\/p>\n
So simply add on dependency. That dependency is\u00a0spring-boot-starter-security<\/p>\n
Go to Maven repository to get this dependency. Or you can just copy it from below.<\/p>\n
Put it in the depencencies section of your pom.xml file.<\/p>\n
<dependency><\/span>\n <groupId><\/span>org.springframework.boot<\/groupId><\/span>\n <artifactId><\/span>spring-boot-starter-security<\/artifactId><\/span>\n <version><\/span>2.1.6.RELEASE<\/version><\/span>\n<\/dependency><\/span>\n<\/pre>\n<\/p>\n
Now, save everything. Then launch the the application. Visit the same home page\u00a0http:\/\/localhost\/home<\/a>.<\/p>\n
You will now notice that you are presented with a login page:<\/p>\n
![\"Login](\"https:\/\/www.kindsonthegenius.com\/wp-content\/uploads\/2020\/09\/Login-Page-for-Spring-Authentication-1024x585.jpg\")
<\/p>\nNow, the default username is “user”. You\u00a0 can find the password in the console output as shown below:<\/p>\n
![\"Generated](\"https:\/\/www.kindsonthegenius.com\/wp-content\/uploads\/2020\/09\/Generated-Password.jpg\")
<\/p>\n<\/p>\n
Next, we would add login information to the application propeties file<\/p>\n
<\/p>\n
4. Add login details in the application.propeties<\/strong><\/h5>\n
Open the application.properties file<\/p>\n
Add the following login details. You can also use username and password of your choice.<\/p>\n
<\/p>\n
spring.<\/span>security<\/span>.<\/span>user<\/span>.<\/span>username<\/span>=<\/span>\"kindson\"<\/span>\nspring.<\/span>security<\/span>.<\/span>user<\/span>.<\/span>password<\/span>=<\/span>\"root\"<\/span>\n<\/pre>\n<\/p>\n
Now, launch the application. Notice that there is no password generated.<\/p>\n
Go ahead to test the application using these details.<\/p>\n
Note: for some reason, this did not work when I tested it. So if it does not work for you, just move on to the next part.<\/span><\/p>\n
<\/p>\n
5. Extend the WebSecurityConfigurerAdapter<\/strong><\/h5>\n
We are going to create a class that extends WebSecurityConfigurerAdapter. According to the Spring documentation<\/a>, the WebSecurityConfigurerAdapter works with the @WebSecurity annotation to provide web-based security. It does the following:<\/p>\n
- \n
- requires that the user be authenticated before accessing resources<\/li>\n
- creates a user with default credentials of ‘user’\/’password’ and role of ‘ROLE_USER’<\/li>\n
- enables basic HTTP and form authentication<\/li>\n
- redirects user to login page<\/li>\n<\/ul>\n
Follows the steps below to extend WebSecurityCofigurer:<\/strong><\/p>\n
Step 1:<\/strong> Create a class and give it a name AppSecurityConfig<\/em> (you can use another name if you want)<\/p>\n
Step 2:<\/strong> Make this class extend WebSecurityConfigurerAdapter<\/em> (just add extends WebSecurityConfigurer<\/em> to the class)<\/p>\n
Step 3:<\/strong> Annotate the class with the following annotations:<\/p>\n
- \n
- @EnableWebSecurity<\/li>\n
- @Configuration<\/li>\n<\/ul>\n
Step 4:<\/strong> Write a method that overrides the userDetailsService()<\/em> method (to do this, right-click and choose Source >> Override\/Implement Methods. Choose UserDetailsService and click ok)<\/p>\n
Step 5:<\/strong> Annotate this method with the @Bean<\/em> annotation. (also make sure the @Override annotation is added)<\/p>\n
Step 6:<\/strong> Inside this method,\u00a0 create an empty new ArrayList of UserDetails. I call it users.<\/p>\n
Step 7:<\/strong> Create a few UserDetails objects<\/p>\n
Step 8:<\/strong> Add the objects to the List<\/p>\n
Step 9:<\/strong> Return a new InMemoryUserDetailsManager() giving it the users list.<\/p>\n
The final class would be as shown below:<\/p>\n
<\/p>\n
@Configuration<\/span>\n@EnableWebSecurity<\/span>\npublic<\/span> class<\/span> ApplicationSecurityConfig<\/span> extends<\/span> WebSecurityConfigurerAdapter {<\/span>\n\n\t@Override<\/span>\n\t@Bean<\/span>\n\tprotected<\/span> UserDetailsService userDetailsService<\/span>()<\/span> {<\/span>\n\t\t \n\t\tList<<\/span>UserDetails><\/span> users =<\/span> new<\/span> ArrayList<>();<\/span>\n\t\tusers.<\/span>add<\/span>(<\/span>User.<\/span>withDefaultPasswordEncoder<\/span>().<\/span>username<\/span>(<\/span>\"kindson\"<\/span>).<\/span>password<\/span>(<\/span>\"root\"<\/span>).<\/span>roles<\/span>(<\/span>\"USER\"<\/span>).<\/span>build<\/span>());<\/span>\n\t\tusers.<\/span>add<\/span>(<\/span>User.<\/span>withDefaultPasswordEncoder<\/span>().<\/span>username<\/span>(<\/span>\"jadon\"<\/span>).<\/span>password<\/span>(<\/span>\"pass\"<\/span>).<\/span>roles<\/span>(<\/span>\"USER\"<\/span>).<\/span>build<\/span>());<\/span>\n\t\tusers.<\/span>add<\/span>(<\/span>User.<\/span>withDefaultPasswordEncoder<\/span>().<\/span>username<\/span>(<\/span>\"solace\"<\/span>).<\/span>password<\/span>(<\/span>\"pass\"<\/span>).<\/span>roles<\/span>(<\/span>\"USER\"<\/span>).<\/span>build<\/span>());<\/span>\n\t\t\n\t\treturn<\/span> new<\/span> InMemoryUserDetailsManager<\/span>(<\/span>users);<\/span>\n\t\t\n\t}<\/span>\n<\/pre>\n<\/p>\n
Here, we created three users: kindson, jadon and solace.<\/p>\n
Step 10:<\/strong> Launch the application. Test it using the three users we have created.<\/p>\n
If everything works fine, then you have done well. Congrats! Also feel free to follow the video lesson<\/a> if it is easier for you to follow<\/p>\n
<\/p>\n
8. Next Steps<\/strong><\/h5>\n
In real applications, however, you probably will not create users this way. Normally, user details would be stored in a database. So the question is, how do we achieve this?<\/p>\n
The would be explained in the next tutorial – Getting Username and Password from MySQL Database.<\/a><\/p>\n
Remember to watch the video lessons below:<\/p>\n
<\/p>\n
- Add default Spring Authentication<\/a><\/li>\n