Blog

Authentication and Authorization concepts in Spring Boot

Authentication and authorization are critical security concepts in software development, including in Spring Boot applications. Authentication verifies the identity of a user or system, while authorization determines what actions a user or system is allowed to perform. Spring Boot provides several mechanisms to implement authentication and authorization in your applications.

  1. Authentication: Authentication is the process of verifying the identity of a user or system. Spring Boot supports various authentication mechanisms, including:
    • Basic Authentication: This is a simple authentication mechanism where the client sends the username and password as plain text with each request. Spring Boot provides built-in support for basic authentication through spring-boot-starter-security dependency, which allows you to configure basic authentication using configuration properties or annotations.
    • Form-based Authentication: This is a web-based authentication mechanism where users enter their credentials in a login form. Spring Boot supports form-based authentication using Spring Security, which provides a rich set of features for implementing authentication, including support for custom login pages, authentication providers, and authentication success/failure handling.
    • OAuth/OIDC Authentication: OAuth (Open Authorization) and OIDC (OpenID Connect) are widely used authentication protocols for securing web applications and APIs. Spring Boot provides built-in support for OAuth/OIDC authentication using Spring Security, allowing you to configure and integrate with popular OAuth/OIDC providers like Google, Facebook, and GitHub.
    • Custom Authentication: Spring Boot also allows you to implement custom authentication mechanisms by extending the AuthenticationProvider interface provided by Spring Security. This gives you full control over the authentication process, allowing you to integrate with external authentication systems or implement your own authentication logic.
  2. Authorization: Authorization is the process of determining what actions a user or system is allowed to perform. Spring Boot provides several mechanisms for implementing authorization, including:
    • Role-based Authorization: Spring Boot allows you to define roles and associate them with users, and then use these roles to restrict access to certain resources or actions. You can define roles using annotations or configuration properties, and then use them in combination with Spring Security’s @PreAuthorize or @Secured annotations to implement role-based authorization.
    • Permission-based Authorization: Spring Boot also supports fine-grained permission-based authorization, where you can define permissions for specific actions or resources, and then use these permissions to control access. Spring Security provides annotations like @PostAuthorize and @PreFilter that allow you to implement permission-based authorization.
    • Custom Authorization: Spring Boot allows you to implement custom authorization mechanisms by extending the AccessDecisionVoter interface provided by Spring Security. This gives you full control over the authorization process, allowing you to implement your own authorization logic based on custom business rules or requirements.
  3. Security Configuration: Spring Boot allows you to configure security settings using various mechanisms, including:
    • Configuration Properties: Spring Boot provides a rich set of configuration properties that allow you to configure security settings, such as authentication providers, authorization settings, and more, using properties files or YAML files.
    • Java Configuration: Spring Boot also allows you to configure security settings using Java configuration classes, where you can define custom beans and configure security settings using Java code. This gives you more flexibility and customization options for configuring security in your Spring Boot applications.
    • Annotations: Spring Boot provides annotations like @EnableWebSecurity, @EnableGlobalMethodSecurity, and others that allow you to enable security features, configure security settings, and apply security rules at different levels, such as at the application level, method level, or endpoint level.

Overall, Spring Boot provides robust and flexible support for implementing authentication and authorization in your applications, allowing you to secure your application’s resources and control access to different actions or functionalities based on the roles or permissions of the users or systems interacting with your application.

Let’s take an example of implementing authentication and authorization in a Spring Boot application using Spring Security.

1. Authentication Example

First, we need to configure authentication in our Spring Boot application. Let’s assume we want to use form-based authentication where users enter their credentials in a login form.

Step 1: Add Spring Security dependency in your pom.xml file

<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-security</artifactId>
</dependency>

Step 2: Create a login form page (login.html) in your web application’s resources/templates directory

<!DOCTYPE html>
<html>
<head>
    <title>Login</title>
</head>
<body>
    <h1>Login</h1>
    <form action="/login" method="post">
        <label for="username">Username:</label>
        <input type="text" id="username" name="username"><br>
        <label for="password">Password:</label>
        <input type="password" id="password" name="password"><br>
        <input type="submit" value="Login">
    </form>
</body>
</html>

Step 3: Configure security settings in your Spring Boot application by creating a configuration class

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {
    
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
            .authorizeRequests()
                .antMatchers("/login", "/css/**").permitAll() // Allow access to login page and CSS files
                .anyRequest().authenticated() // Require authentication for all other requests
                .and()
            .formLogin()
                .loginPage("/login") // Specify custom login page URL
                .defaultSuccessUrl("/dashboard") // Specify URL after successful login
                .and()
            .logout()
                .logoutSuccessUrl("/login"); // Specify URL after successful logout
    }
}

In the above configuration, we are using HttpSecurity to define the security settings. We are allowing access to the /login URL and CSS files without authentication, and requiring authentication for all other requests. We are also specifying a custom login page URL, a default success URL after successful login, and a success URL after successful logout.

2. Authorization Example

Once authentication is configured, we can implement authorization using roles. Let’s assume we have two roles in our application: “ADMIN” and “USER”. We want to restrict access to certain resources based on these roles.

Step 1: Define roles and associate them with users in your application

public class User {
    private String username;
    private String password;
    private List<String> roles; // List of roles associated with the user

    // Getters and Setters
}

Step 2: Configure role-based authorization in your Spring Boot application by updating the security configuration class

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {
    
    // ...

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
            // ... (same as in the authentication example)
            .and()
            .authorizeRequests()
                .antMatchers("/admin/**").hasRole("ADMIN") // Require "ADMIN" role for /admin/** URL
                .antMatchers("/user/**").hasRole("USER") // Require "USER" role for /user/** URL
                .anyRequest().authenticated() // Require authentication for all other requests
                .and()
            .formLogin()
                .loginPage("/login")
                .defaultSuccessUrl("/dashboard")
                .and()
            .logout()
                .logoutSuccessUrl("/login");
    }

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.inMemoryAuthentication()
            .withUser("admin")
            .password("{noop}admin123") // Password with {noop} prefix for plain text (not recommended for production)
            .roles("ADMIN")
            .and()
            .withUser("user")
            .password("{noop}user123")
            .roles("USER");
    }
}

In the above configuration, we are using authorizeRequests() to specify the URL patterns and their corresponding roles that are required for access. For example, we are requiring the “ADMIN” role for URLs that start with “/admin/” and the “USER” role for URLs that start with “/user/“. We are also specifying that authentication is required for all other requests using anyRequest().authenticated().

In addition, we are using configure(AuthenticationManagerBuilder auth) to define in-memory authentication with two users: “admin” with the “ADMIN” role and “user” with the “USER” role. Note that we are using the {noop} prefix for passwords to indicate that they are in plain text, which is not recommended for production use. In a real-world application, you would use a more secure password storage mechanism like bcrypt.

With the above configuration, any request to URLs that start with “/admin/” will require the “ADMIN” role, and any request to URLs that start with “/user/” will require the “USER” role. If a user tries to access these URLs without the appropriate role, they will be denied access and redirected to the login page.

That’s it! You now have a basic example of how to implement authentication and authorization in a Spring Boot application using Spring Security. Of course, there are many other features and configurations that you can utilize in Spring Security, such as using a database for user authentication, customizing login/logout pages, implementing OAuth, and more. The official Spring Security documentation is a great resource for further learning: https://docs.spring.io/spring-security/site/docs/current/reference/html5/