Understand spring security authentication

Question

In spring security I don't understand how does the authentication work. In documentation they have this code

protected void configure(HttpSecurity http) throws Exception {
    http
        .authorizeRequests()
            .anyRequest().authenticated()
            .and()
        .formLogin()
            .loginPage("/login") 1
            .permitAll();        2
}

@Autowired
public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
    auth
        .inMemoryAuthentication()
            .withUser("user").password("password").roles("USER");
}

In above, how does .anyRequest().authenticated() works? In spring, does it automatically authenticate users?

Is it like, this line .anyRequest().authenticated() call configureGlobal and authenticate with user and password? Usually user and password is saved in database? Then How can I do check authentication for user whose username and password is saved in User table?

check this...authenticate and assign the roles...stackoverflow.com/questions/37397933/… — Prasanna Kumar H A

NatFar NatFar · Accepted Answer · 2019-02-11T21:57:26

In above, how does .anyRequest().authenticated() works? In spring, does it automatically authenticate users?

HttpSecurity creates a security filter chain, and the filters that will be in that chain are added via configurers that are applied to HttpSecurity. When you do

http
    .authorizeRequests()
        .anyRequest().authenticated()
    …

you are adding an ExpressionUrlAuthorizationConfigurer that will be used to create a FilterSecurityInterceptor, which is a filter that will decide if the current user meets the requirements to obtain access to the resource. In your case, the FilterSecurityInterceptor will make sure the user is authenticated (not with an AnonymousAuthenticationToken) for every request.

The FilterSecurityInterceptor’s main job isn’t to authenticate. It expects an Authentication to be in the SecurityContextHolder already. It’ll throw an exception otherwise.

Is it like, this line .anyRequest().authenticated() call configureGlobal and authenticate with user and password? Usually user and password is saved in database? Then How can I do check authentication for user whose username and password is saved in User table?

The authentication is actually going on here:

.formLogin()
    .loginPage("/login") 1
    .permitAll();

The FormLoginConfigurer adds a UsernamePasswordAuthenticationFilter to the chain that will by default responds to "/login". Side note: If you look at WebSecurityConfigurerAdapter, which is the class you’ll usually extend from to get some sensible defaults, you’ll see that certain configurers and thus filters, are applied to HttpSecurity by default.

The AuthenticationManagerBuilder you @Autowired will be used to create an AuthenticationManager that is then shared with several filters including UsernamePasswordAuthenticationFilter to perform authentication. The filter extracts the "username" and "password" parameters from the HttpServletRequest, stores these in a UsernamePasswordAuthenticationToken, and passes it to the AuthenticationManager.

Instead of

auth
    .inMemoryAuthentication()
        .withUser("user").password("password").roles("USER");

you could try:

auth
    .jbdcAuthentication()
        .dataSource(dataSource)
        //.other methods to configure UserDetailsService default

;

Take a look at the JdbcUserDetailsManager (which is the default UserDetailsService) to see what SQL commands are executed and what row names it expects to find in your users table when authenticating.

Understand spring security authentication

1 Answers