A Comprehensive Guide to Implementing Spring Security 6

@Entity
@Data
@FieldDefaults(level = AccessLevel.PRIVATE)
public class Person implements UserDetails {

    @Id
    @GeneratedValue(strategy = GenerationType.IDENTITY)
    Long id;
    String name;
    String contact;
    String password;
    @Column(unique = true)
    String email;

    @ManyToMany(cascade = CascadeType.ALL, fetch = FetchType.EAGER)
    @JoinTable(name = "person_role",
            joinColumns = @JoinColumn(name = "person_id"),
            inverseJoinColumns = @JoinColumn(name = "role_id"))
    List<GrantedAuthorityImpl> grantedAuthorities;

    @Override
    public Collection<? extends GrantedAuthority> getAuthorities() {
        return grantedAuthorities;
    }

    @Override
    public String getPassword() {
        return password;
    }

    @Override
    public String getUsername() {
        return email;
    }
}

Role Entity:

In Spring Security, GrantedAuthority is a fundamental interface that represents an authorization granted to a user. It defines a permission or privilege that a user possesses within the application.

@Entity
@Data
@FieldDefaults(level = AccessLevel.PRIVATE)
public class GrantedAuthorityImpl implements GrantedAuthority {

    @Id
    @GeneratedValue(strategy = GenerationType.IDENTITY)
    Long id;

    String authority;

    @Override
    public String getAuthority() {
        return authority;
    }
}

public interface PersonRepo extends JpaRepository<Person, Long> {
    Optional<Person> findByEmail(String email);
}

Note: I’ll use constructor injection throughout this project

• @RequiredArgsConstructor: Lombok generates a constructor for all final fields.
• Constructor Injection: Spring Boot uses this generated constructor to inject dependencies.
• Automatic Injection: Dependencies are provided by Spring at runtime.

Implementing UserDetailsService

UserDetailsService is an interface used to retrieve user-related data. It is a core interface for authentication, specifically designed to load user information such as username, password, and roles (authorities).

Key Functionality

• Main Purpose: It provides a way to retrieve the user details (like username, password, roles) from a persistent storage (e.g., a database, LDAP, etc.) for authentication.
• Method to Implement: The UserDetailsService interface has only one method

@Service
@RequiredArgsConstructor
@FieldDefaults(level = AccessLevel.PRIVATE)
public class UserDetailServiceImpl implements UserDetailsService {

    final PersonRepo personRepo;

    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        return personRepo.findByEmail(username).orElseThrow(() ->
                new UsernameNotFoundException("User not found with email: " + username));
    }
}

Controller Class

@RestController
@RequestMapping("/person")
@RequiredArgsConstructor
@FieldDefaults(level = AccessLevel.PRIVATE)
public class PersonController {

 final PersonService personService;

 @PostMapping
 public String savePerson(@RequestBody @Valid PersonSaveCO personSaveCO) {
   return personService.savePerson(personSaveCO);
 }

 @GetMapping("/{id}")
 public Person getPerson(@PathVariable Long id) {
   return personService.getPerson(id);
 }

 @GetMapping
 @Secured("ROLE_ADMIN")
 public List<Person> getAllPersons() {
   return personService.getAllPersons();
 }

 @PutMapping
 public String updatePerson(@RequestBody @Valid PersonUpdateCO personUpdateCO) {
   return personService.updatePerson(personUpdateCO);
 }

 @DeleteMapping("/{id}")
 public String deletePerson(@PathVariable Long id) {
   return personService.deletePerson(id);
 }
}

Service Class

@Service
@RequiredArgsConstructor
@FieldDefaults(level = AccessLevel.PRIVATE)
public class PersonService {

 final PersonRepo personRepo;
 final ModelMapper modelMapper;
 final PasswordEncoder passwordEncoder;

 public String savePerson(PersonSaveCO personSaveCO) {
   Person person = personRepo.findByEmail(personSaveCO.getEmail()).orElse(null);
   if (person != null) {
    return "Already Exist";
   }

   person = modelMapper.map(personSaveCO, Person.class);
   GrantedAuthorityImpl grantedAuthority = new GrantedAuthorityImpl();
   grantedAuthority.setAuthority(personSaveCO.getRole());
   person.setGrantedAuthorities(Collections.singletonList(grantedAuthority));

 // Encrypt password
   person.setPassword(passwordEncoder.encode(personSaveCO.getPassword()));
   personRepo.save(person);
   return "Person Saved";
 }

 public Person getPerson(Long id) {
    return personRepo.findById(id).orElse(null);
 }

 public List<Person> getAllPersons() {
    return personRepo.findAll();
 }

 public String updatePerson(PersonUpdateCO personUpdateCO) {
    Person person = personRepo.findById(personUpdateCO.getId()).orElse(null);
    if (person == null) {
     return "Person does not exist";
    }

   if (personUpdateCO.getPassword() != null) {
    personUpdateCO.setPassword(passwordEncoder.encode(personUpdateCO.getPassword()));
   }

   modelMapper.map(personUpdateCO, person);
   personRepo.save(person);
   return "Person Updated";
}

 public String deletePerson(Long id) {
    personRepo.deleteById(id);
    return "Person Deleted Successfully";
 }
}

Here in Controller and Service we have used SaveCO classes to request the body,  model mapper to map the object to desired class / destination, you can use the simple operation here to test the Spring security.
Also you can see @Secured(“ROLE_ADMIN”) we will discuss this in next section.

Security Configuration class

• In previous versions of Spring Security, you had to extend the WebSecurityConfigurerAdapter class to configure security settings. This class has been deprecated and removed in Spring Security 6. Instead, you should now take a more component-based approach and create a bean of type SecurityFilterChain.
• Instead of using authorizeRequests, which has been deprecated, you should now use authorizeHttpRequests. This method is part of the HttpSecurity configuration and allows you to configure fine-grained request matching for access control.
• In Spring Security 6, AntMatcher, MvcMatcher, and RegexMatcher have been deprecated and replaced by requestMatchers for path-based access control. This allows you to match requests based on patterns or other criteria without relying on specific matchers.
• In Spring Security 6, the @EnableWebSecurity annotation is no longer required to configure security. This is because Spring Boot automatically provides default configurations for security. You can directly create a SecurityFilterChain bean to define your custom security configuration, and Spring Boot will apply it without needing @EnableWebSecurity.

@EnableMethodSecurity(securedEnabled = true, jsr250Enabled = true):

• It allows you to define access control restrictions directly on your methods using annotations.
• The specific options used in this case activate support for two main method security annotation types:
  • @Secured: This Spring Security annotation lets you specify required roles for a method. Only users with those roles will be authorized to access the method.
  • @RolesAllowed: This annotation from the JSR-250 standard (Java Security API) serves the same purpose as @Secured. With jsr250Enabled=true, Spring Security recognizes and processes both annotations interchangeably.

Authentication Provider and Authentication Manager

• The DaoAuthenticationProvider bean provides the implementation for user authentication based on a UserDetailsService. The DaoAuthenticationProvider defines the specific authentication logic and password comparison
• The AuthenticationManager bean orchestrates the authentication process by delegating tasks to the AuthenticationProvider. The AuthenticationManager acts as the central point for authentication requests, ultimately relying on the AuthenticationProvider to perform the actual work.

@Configuration
@RequiredArgsConstructor
@EnableMethodSecurity(securedEnabled = true, jsr250Enabled = true)
@FieldDefaults(level = AccessLevel.PRIVATE)
public class WebSecurity {

    final UserDetailsService userDetailsService;

    @Bean
    SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
                .csrf(AbstractHttpConfigurer::disable)
                .authorizeHttpRequests((requests) -> requests
                         .requestMatchers(HttpMethod.POST, "/person").anonymous() 
                         .requestMatchers(HttpMethod.PUT, "/person").permitAll()
                         .requestMatchers(HttpMethod.DELETE, "/person/{id}").hasRole("ADMIN") 
                        .anyRequest().authenticated()
                )
                .exceptionHandling(exceptionHandling ->
                        exceptionHandling.authenticationEntryPoint(new AppAuthenticationEntryPoint())
                                .accessDeniedHandler(new CustomAccessDeniedHandler()
                                )
                )
                .httpBasic(Customizer.withDefaults());
        return http.build();
    }

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }

    @Bean
    public AuthenticationProvider authenticationProvider() {
        DaoAuthenticationProvider authenticationProvider = new DaoAuthenticationProvider();
        authenticationProvider.setUserDetailsService(userDetailsService);
        authenticationProvider.setPasswordEncoder(passwordEncoder());
        return authenticationProvider;
    }

    @Bean
    public AuthenticationManager authenticationManager(AuthenticationConfiguration config) throws Exception {
        return config.getAuthenticationManager();
    }
}