Spring Security 3.1 - Implement UserDetailsService with Spring Data JPA (Part 3)

Review

In the previous section, we have implemented the Java classes and organized them accordingly: domain, repository, service, and controller. In this section, we will create the necessary configuration files, which are mainly XML files, and discuss them thoroughly.

Table of Contents

Part 1: Introduction and Functional Specs
Part 2: Java classes
Part 3: XML configuration
Part 4: HTML Files
Part 5: Running the Application

Configuration

There are two important configuration files required to secure our application with Spring Security:

• spring-security.xml (arbitrary name)
• web.xml

spring-security.xml

This contains the core Spring Security configuration.


Let's examine further the contents of this file:

the http tag

This means the path /resources should be ignored by Spring Security; therefore it will not be secured. Why do you want to do this? Mainly because these are static images, CSS, and JavaScript files that don't need to be secured.

the second http tag

This contains the core security rules of our application. In previous versions of Spring Security, you're only allowed to have one http element.

• auto-config is a shorthand for the following (see more):
  
  
• use-expressions allows us to use SPEL (Spring EL expressions) support (see more)

intercept urls

Here we declare URL patterns to be protected. Notice the use of SPEL hasRole and permitAll (see more)

form login

This declares our login settings:

• login-page: the URL path of our login page
• authentication-failure-url: the URL where a user will be redirected after a failed login
• default-target-url: the URL where a user will be redirected after a successful login

denied handler

This declares the URL where a user will be redirected after a denied access.

authentication manager

This is similar with the login element.

• logout-success-url: the URL where a user will be redirected after a successful logout
• logout-url: the URL path of our logout page

• authentication-manager: registers an AuthenticationManager that provides authentication services (see more)
• authentication-provider: this is a shorthand for configuring a DaoAuthenticationProvider which loads user information from a UserDetailsService (see more)
• user-service-ref: this allows us to declare a custom UserDetailsService
• password-encoder: this allows us to declare various password encoders such as md5 and sha (see more)

web.xml

Besides the usual servlet declaration, the web.xml is where you declare the Spring Security filter and name of configuration file to read from.

To enable Spring Security, follow these guidelines:

• Add a DelegatingFilterProxy
• Add a springSecurityFilterChain mapping
• Add a contextConfigLocation You must declare your applicationContext.xml and spring-security.xml here

Here's our complete web.xml file:

Datasource

Since we're using JPA and Spring Data JPA to simplify data access, we must also declare the corresponding configuration files. Please read the inline comments for more info.

spring-data.xml
This contains all datasource-related configuration.

Next

In the next section, we will turn our attention towards the view layer which mainly consists of JSP files. Click here to proceed.

---

Share the joy: blogger tutorials Social Bookmarking Blogger Widget I'm reading: Spring Security 3.1 - Implement UserDetailsService with Spring Data JPA (Part 3) ~

Subscribe by reader Subscribe by email Share