Spring Security Hello World Example--reference

In this tutorial, we will see how we can use Spring security to protect specific resources. This Hello World tutorial will give you a quick start to Spring Security.We will use Spring’s Java Config ( Annotation based approach) to configure the properties instead of XML configuration.

Technologies used

Spring 4.0.3 Release
Spring Security 3.2.3 Release
Tomcat 7
Java 1.6

We are going to develop a simple web application using Spring MVC. All the configurations will be done using Java Classes and there won’t be any XML configurations. Let us first start with the project structure.

Project Structure

Maven Dependencies

<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"

xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">

<modelVersion>4.0.0</modelVersion>

<groupId>com.javahash.springsecurity</groupId>

<artifactId>springsecurity</artifactId>

<packaging>war</packaging>

<version>0.0.1-SNAPSHOT</version>

<name>springsecurity Maven Webapp</name>

<url>http://maven.apache.org</url>

<properties>

<jdk.version>1.6</jdk.version>

<spring.version>4.0.3.RELEASE</spring.version>

<spring.security.version>3.2.3.RELEASE</spring.security.version>

<jstl.version>1.2</jstl.version>

</properties>

<dependencies>

<dependency>

<groupId>javax.servlet</groupId>

<artifactId>servlet-api</artifactId>

<version>2.5</version>

</dependency>

<dependency>

<groupId>org.springframework</groupId>

<artifactId>spring-core</artifactId>

<version>${spring.version}</version>

</dependency>

<dependency>

<groupId>org.springframework</groupId>

<artifactId>spring-web</artifactId>

<version>${spring.version}</version>

</dependency>

<dependency>

<groupId>org.springframework</groupId>

<artifactId>spring-webmvc</artifactId>

<version>${spring.version}</version>

</dependency>

<dependency>

<groupId>org.springframework.security</groupId>

<artifactId>spring-security-web</artifactId>

<version>${spring.security.version}</version>

</dependency>

<dependency>

<groupId>org.springframework.security</groupId>

<artifactId>spring-security-config</artifactId>

<version>${spring.security.version}</version>

</dependency>

<dependency>

<groupId>jstl</groupId>

<artifactId>jstl</artifactId>

<version>${jstl.version}</version>

</dependency>

</dependencies>

<build>

<finalName>springsecurity</finalName>

</build>

</project>

Controller

The controller will be having an unprotected URL and two URL path’s that are restricted to admin and super admin roles.

package com.javahash.controller;

import org.springframework.stereotype.Controller;

import org.springframework.web.bind.annotation.RequestMapping;

import org.springframework.web.bind.annotation.RequestMethod;

import org.springframework.web.servlet.ModelAndView;

@Controller

public class AppController {

@RequestMapping(value = { "/", "/helloworld**" }, method = RequestMethod.GET)

public ModelAndView welcomePage() {

ModelAndView model = new ModelAndView();

model.addObject("title", "Spring Security 3.2.3 Hello World Application");

model.addObject("message", "Welcome Page !");

model.setViewName("helloworld");

return model;

}

@RequestMapping(value = "/protected**", method = RequestMethod.GET)

public ModelAndView protectedPage() {

ModelAndView model = new ModelAndView();

model.addObject("title", "Spring Security 3.2.3 Hello World");

model.addObject("message", "This is protected page - Only for Administrators !");

model.setViewName("protected");

return model;

}

@RequestMapping(value = "/confidential**", method = RequestMethod.GET)

public ModelAndView superAdminPage() {

ModelAndView model = new ModelAndView();

model.addObject("title", "Spring Security 3.2.3 Hello World");

model.addObject("message", "This is confidential page - Need Super Admin Role !");

model.setViewName("protected");

return model;

}

/helloworld path is public access and there is no security constraint set on that.
/protected is a restricted area and only user’s having admin role can access that
/confidential is restricted and only user’s having superadmin role is able to access it

Inside each method , we create a Model ( ModelAndView instance) and return it. The view name is also set in the model. How the view name is mapped to a concrete view file ( in this case a JSP file) is the simple. We need to provide a Class having the configuration information. This is explained in the next section

Configuring the Spring MVC ( View + Security)

We need to tell Spring where to find view and how it is mapped. How do we handle security and the configuration for the same also needs to be set in Spring. All these can be accomplished using a Java Class annotated with @Configuration annotation

package com.javahash.config;

import org.springframework.context.annotation.Bean;

import org.springframework.context.annotation.ComponentScan;

import org.springframework.context.annotation.Configuration;

import org.springframework.context.annotation.Import;

import org.springframework.web.servlet.config.annotation.EnableWebMvc;

import org.springframework.web.servlet.view.InternalResourceViewResolver;

import org.springframework.web.servlet.view.JstlView;

@EnableWebMvc

@Configuration

@ComponentScan({ "com.javahash.*" })

@Import({ AppSecurityConfig.class })

public class ViewConfig {

@Bean

public InternalResourceViewResolver viewResolver() {

InternalResourceViewResolver viewResolver

= new InternalResourceViewResolver();

viewResolver.setViewClass(JstlView.class);

viewResolver.setPrefix("/WEB-INF/views/");

viewResolver.setSuffix(".jsp");

return viewResolver;

}

Above class does the following

Declares this class as Configuration ( @Configuration)
Instructs Spring to Scan for Components inside com.javahash.* package
Maps a view name to /WEB-INF/views/ folder
Sets the Suffix to be .jsp
Imports another class that holds the security related configuration (@Import({ AppSecurityConfig.class }) )

Let us see how we configure the security part.

Security Configuration

package com.javahash.config;

import org.springframework.beans.factory.annotation.Autowired;

import org.springframework.context.annotation.Configuration;

import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;

import org.springframework.security.config.annotation.web.builders.HttpSecurity;

import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;

import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;

@Configuration

@EnableWebSecurity

public class AppSecurityConfig extends WebSecurityConfigurerAdapter {

@Autowired

public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {

auth.inMemoryAuthentication().withUser("tom").password("123456").roles("USER");

auth.inMemoryAuthentication().withUser("bill").password("123456").roles("ADMIN");

auth.inMemoryAuthentication().withUser("james").password("123456").roles("SUPERADMIN");

}

@Override

protected void configure(HttpSecurity http) throws Exception {

http.authorizeRequests()

.antMatchers("/protected/**").access("hasRole('ROLE_ADMIN')")

.antMatchers("/confidential/**").access("hasRole('ROLE_SUPERADMIN')")

.and().formLogin();

}

The most important thing to note is that this class is annotated with

@Configuration
@EnableWebSecurity

and it extends WebSecurityConfigurerAdapter class. The @EnableWebSecurity annotation andWebSecurityConfigurerAdapter work together to provide web based security. Spring security is configured to enable HTTP Basic and Form based authentication. Spring Security will automatically render a login page and logout success page for you. The rest of the code is self explanatory. It just configures the URLs that are restricted to authorized roles and sets the roles for the users. In this example the users and their passwords are hard coded. You can change this to grab the information from database , if required.

We now have the security configuration in AppSecurityConfig.java and the MVC configuration in ViewConfig.java. We need to make sure that the root application context includes our Security configuration. For this, the practice is to create a class that extends AbstractAnnotationConfigDispatcherServletInitializer and override a few methods. What we require is to configure particular URL patterns to pass through our security layer. Traditional approach is to configure a servlet filter and in the filter we check for the security credentials. With the introduction of Servlet 3.x we are no longer required to declare the filter in web.xml and we can manage the entire configuration via Java classes. The AbstractAnnotationConfigDispatcherServletInitializer helps with this.

package com.javahash.config;

import org.springframework.security.web.context.AbstractSecurityWebApplicationInitializer;

public class SecurityInit extends AbstractSecurityWebApplicationInitializer {

}

The above code is equivalent to

<filter>

<filter-name>springSecurityFilterChain</filter-name>

<filter-class>

org.springframework.web.filter.DelegatingFilterProxy

</filter-class>

</filter>

<filter-mapping>

<filter-name>springSecurityFilterChain</filter-name>

<url-pattern>/*</url-pattern>

<dispatcher>ERROR</dispatcher>

<dispatcher>REQUEST</dispatcher>

</filter-mapping>

We have now configured security and other MVC configuration. What is left is to configure the DispatcherSerlvet that is used to initialize the Spring MVC framework and map the URL patterns for Dispatcher Servlet. Tradional approach was to declare the DispatcherServlet in the web.xml and provide URL mappings for it. We can do away with web.xml configuration and instead use a Java Class to do this Job. This is our next step

Configuring the Dispatcher Servlet

package com.javahash.config;

import org.springframework.web.servlet.support.AbstractAnnotationConfigDispatcherServletInitializer;

public class MVCInitializer extends AbstractAnnotationConfigDispatcherServletInitializer {

@Override

protected Class<?>[] getRootConfigClasses() {

return new Class[] { ViewConfig.class };

}

@Override

protected Class<?>[] getServletConfigClasses() {

return null;

}

@Override

protected String[] getServletMappings() {

return new String[] { "/" };

}

Here we have configured the servlet mapping as “/” and so all requests will be intercepted by the Spring Dispatcher Servlet.

Things to Note:

Our class extends AbstractAnnotationConfigDispatcherServletInitializer

getRootConfigClasses method returns our Configuration class ( ViewConfig.class)

The only activity left is to develop the views and test the application.

Developing the View (JSP)

The views are very simple – it just prints the message and the title returned in the model. We use JSTL in the views to print the data.

helloworld.jsp

<%@ page language="java" contentType="text/html; charset=ISO-8859-1"

pageEncoding="ISO-8859-1"%>

<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">

<html>

<head>

<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">

<title>Hello World</title>

</head>

<body>

<h1>Title : ${title}</h1>

<h1>Message : ${message}</h1>

</body>

</html>

protected.jsp

<%@ page isELIgnored="false" %>

<%@ page language="java" contentType="text/html; charset=ISO-8859-1"

pageEncoding="ISO-8859-1"%>

<%@taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core"%>

<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">

<html>

<head>

<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">

<title>Protected page</title>

</head>

<body>

<h1>Title : ${title}</h1>

<h1>Message : ${message}</h1>

<c:if test="${pageContext.request.userPrincipal.name != null}">

<h2>Welcome : ${pageContext.request.userPrincipal.name}

| <a href="<c:url value="/logout" />" > Logout</a></h2>

</c:if>

</body>

</html>

Demonstration

http://localhost:8080/springsecurity-0.0.1-SNAPSHOT/helloworld/

No security for helloworld.

When you change the URL to http://localhost:8080/springsecurity-0.0.1-SNAPSHOT/protected/ Spring Security kicks in and redirect to /login, and a default login form is displayed. If username and password supplied is incorrect, error messages will be displayed, and Spring will redirect to the URL /login?error.

For unauthorized user, Spring will display the 403 access denied page

Recap – Configurations

Declare the Security Configuration (AppSecurityConfig.java)
Declare the View Configuration ( ViewConfig.java)
Declare the Security Filter Configuration (SecurityInit.java)
Declare the Spring Dispatcher Servlet Configuration (MVCInitializer.java)

Download Source Code

Download - Spring Security Source Code ( 7.37 KB)

reference from:http://javahash.com/spring-security-hello-world-example/