In this part, we would add Spring Security to our application. You can find Part 1 and 2 below.<\/p>\n
Part 1 – Getting Started and Setting up the Pages<\/a><\/p>\n Part 2 – Showing Images and Thumbnails<\/a><\/p>\n <\/p>\n With Spring security we would allows users to login to the application using their username and password. As usual, we would take it step by step. I also recommend you follow the video lessons as well.<\/p>\n To add Spring Security, we would follow these 7 steps:<\/p>\n <\/p>\n You need to add the following two dependencies to enable spring security.<\/p>\n <\/p>\n In the ApplicationController file, write a method to return the login page. The url mapping would be “\/login”.<\/p>\n Do the same for \/logout<\/p>\n <\/p>\n For now, we would just manually add some records to MySQL database. So open MySQL command prompt and add two some records to the user table.<\/p>\n (See the video for the procedure)<\/p>\n <\/p>\n Check the the user model has the fields: id, username and password.<\/p>\n In the repository write a method to find user by username<\/p>\n <\/p>\n Create a class in the Services package and call it MyUserDetailsService. This class should implement UserDetailsService.<\/p>\n Add the @Service annotation to this class.<\/p>\n In the loadUserByUsername method, create a new user using the repository’s findByUsername method.<\/p>\n Then instantiate an return a new UserPrincipal object using the user as an argument (watch the video)<\/p>\n <\/p>\n In the models package, create a class UserPrincipal that implements UserDetails interface.<\/p>\n In this class create a private member variable of type User. Then generate the constructor.<\/p>\n The modify the getUsername and getPassword to return user.getUsername and user.getPassword<\/p>\n Also set the methods in this class to return true.<\/p>\n Modify the getAuthorities method (see the video)<\/p>\n <\/p>\n Create the AppSecurityConfig file to extend the WebSecurityConfigurerAdapter class.<\/p>\n Add the @Configuration and @EnableWebSecurity to this class<\/p>\n Then override the configure method.<\/p>\n Create the PasswordEncoder bean and other methods.<\/p>\n Autowire the UserDetailsService<\/p>\n Then create a bean to return a DaoAuthenticationProvider<\/p>\n The final content of this file is given below:<\/p>\n <\/p>\n I recommend you watch the video for clarification. See video below<\/p>\n\n
Step 1 – Add the dependencies<\/strong><\/h5>\n
<dependency><\/span>\r\n <groupId><\/span>org.thymeleaf.extras<\/groupId><\/span>\r\n <artifactId><\/span>thymeleaf-extras-springsecurity5<\/artifactId><\/span>\r\n<\/dependency><\/span>\r\n<dependency><\/span>\r\n <groupId><\/span>org.springframework.boot<\/groupId><\/span>\r\n <artifactId><\/span>spring-boot-starter-security<\/artifactId><\/span>\r\n<\/dependency><\/span>\r\n<\/pre>\nStep 2 – Write the method for \/login and \/logout<\/strong><\/h5>\n
Step 3 – Add test records<\/strong><\/h5>\n
Step 4 – Setup the User Model and Repository<\/strong><\/h5>\n
Step 5 – Implement the UserDetailsService<\/strong><\/h5>\n
Step 6 – Implement the UserDetails Interfaces<\/strong><\/h5>\n
Step 7: Extend the WebSecurityConfiurerAdapter<\/strong><\/h5>\n
@Configuration<\/span>\r\n@EnableWebSecurity<\/span>\r\npublic<\/span> class<\/span> ApplicationSecurityConfig<\/span> \r\nextends<\/span> WebSecurityConfigurerAdapter {<\/span>\r\n\t\r\n\t@Override<\/span>\r\n\tprotected<\/span> void<\/span> configure<\/span>(<\/span>HttpSecurity http)<\/span> \r\n\t\t\tthrows<\/span> Exception {<\/span>\r\n\t\thttp\r\n\t\t.<\/span>csrf<\/span>().<\/span>disable<\/span>()<\/span>\r\n\t\t.<\/span>authorizeRequests<\/span>()<\/span>\r\n\t\t.<\/span>antMatchers<\/span>(<\/span>\r\n\t\t\t\t\"\/login\"<\/span>,<\/span> \r\n\t\t\t\t\"\/resources\/**\"<\/span>,<\/span> \r\n\t\t\t\t\"\/css\/**\"<\/span>,<\/span> \r\n\t\t\t\t\"\/fonts\/**\"<\/span>,<\/span> \r\n\t\t\t\t\"\/img\/**\"<\/span>).<\/span>permitAll<\/span>()<\/span>\r\n\t\t.<\/span>anyRequest<\/span>().<\/span>authenticated<\/span>()<\/span>\r\n\t\t.<\/span>and<\/span>()<\/span>\r\n\t\t.<\/span>formLogin<\/span>()<\/span>\r\n\t\t.<\/span>loginPage<\/span>(<\/span>\"\/login\"<\/span>).<\/span>permitAll<\/span>()<\/span>\r\n\t\t.<\/span>and<\/span>()<\/span>\r\n\t\t.<\/span>logout<\/span>().<\/span>invalidateHttpSession<\/span>(<\/span>true<\/span>)<\/span>\r\n\t\t.<\/span>clearAuthentication<\/span>(<\/span>true<\/span>)<\/span>\r\n\t\t.<\/span>logoutRequestMatcher<\/span>(<\/span>new<\/span> AntPathRequestMatcher(<\/span>\"\/logout\"<\/span>))<\/span>\r\n\t\t.<\/span>logoutSuccessUrl<\/span>(<\/span>\"\/login\"<\/span>).<\/span>permitAll<\/span>();<\/span>\r\n\t}<\/span>\r\n\t\r\n\t@Bean<\/span>\r\n\tpublic<\/span> PasswordEncoder passwordEncoder<\/span>()<\/span> {<\/span>\r\n\t\treturn<\/span> NoOpPasswordEncoder.<\/span>getInstance<\/span>();<\/span>\r\n\t}<\/span>\t\r\n\t\r\n\t@Autowired<\/span>\r\n\tprivate<\/span> UserDetailsService userDetailsService;<\/span>\r\n\t\r\n\t@Bean<\/span>\r\n\tpublic<\/span> AuthenticationProvider authenticationProvider<\/span>()<\/span> {<\/span>\r\n\t\tDaoAuthenticationProvider provider =<\/span> new<\/span> DaoAuthenticationProvider();<\/span>\t\t\r\n\t\tprovider.<\/span>setUserDetailsService<\/span>(<\/span>userDetailsService);<\/span>\t\r\n\t\tprovider.<\/span>setPasswordEncoder<\/span>(<\/span>passwordEncoder());<\/span>\r\n\t\treturn<\/span> provider;<\/span>\r\n\t}<\/span>\r\n}<\/span>\r\n<\/pre>\n