Writing custom UserDetailsService for spring security

February 11th, 2009 | Tags: dwr, Java, Spring, spring security, web security

I wish spring security would work on their documentation and tell people how easy it is to implement a custom service for loading user details. You don’t HAVE to use JDBC to do that, you can write your very own hibernate, toplink or whatever DAO to do just that. It’s important to realise that spring-security does not send your password to the database ever. Instead it loads a user’s details and then compares it’s password internally before validating the user and granting it access to internal pages.

In my case I did not want to maintain a list of authorities because there were ever only going to be two kinds of user’s, admins and non-admins. Administrator access was to be determined by a boolean field in the table. So I needed to override the queries that the default UserDetailsService implementation, JdbcDaoImpl uses and also set an extra role for user’s who were admins. It sounds simple and it actually is simple only if you don’t dive into the documentation.

The table structure and some data (in postgresql) :

CREATE TABLE test.users
(
  id integer NOT NULL,
  name character varying(100) NOT NULL,
  email character varying(100) NOT NULL,
  "admin" boolean DEFAULT false,
  "password" character varying(20)
)
WITH (OIDS=FALSE);

INSERT INTO test.users VALUES (1, 'normal user 1', 'normal@email.com', 'f', 'pass1');
INSERT INTO test.users VALUES (2, 'normal user 2', 'normal2@email.com', 'f', 'pass2');
INSERT INTO test.users VALUES (3, 'admin user 1', 'admin@email.com', 't', 'pass3');

Remember that UserDetailsService is only used to lookup the user and not perform any sort of validation etc. Implementation of such a service would be :

package com.codercorp.dwr;

//imports 

public class MyUserDetailsService implements UserDetailsService {

	private DataSource	dataSource;

	@Override
	public UserDetails loadUserByUsername(String username)
			throws UsernameNotFoundException, DataAccessException {
		String sql = "select * from user where email like :username";
		MapSqlParameterSource source = new MapSqlParameterSource();
		source.addValue("username", username);

		SimpleJdbcTemplate sjt = new SimpleJdbcTemplate(getDataSource());
		User user = sjt.queryForObject(sql, new UserMapper(), source);
		return user;
	}

	private GrantedAuthority[] getAuthorities(boolean isAdmin) {
		List<GrantedAuthority> authList = new ArrayList<GrantedAuthority>(2);
		authList.add(new GrantedAuthorityImpl("ROLE_USER"));
		if (isAdmin) {
			authList.add(new GrantedAuthorityImpl("ROLE_ADMIN"));
		}
		return authList.toArray(new GrantedAuthority[] {});
	}

	private class UserMapper implements ParameterizedRowMapper<User> {

		@Override
		public User mapRow(ResultSet rs, int arg1) throws SQLException {
			return new User(rs.getString("email"), rs.getString("password"), true, true, true, true, getAuthorities(rs.getBoolean("admin")));
		}

	}
}

The User object that loadByUsername returns is of the class org.springframework.security.userdetails.User. We don’t really need extra functionality for this tutorial but if you do, you can simply extend this class or alternatively implement org.springframework.security.userdetails.UserDetails. As is evident from the code all we do is add a ROLE_USER to every user who’s details we obtain and another ROLE_ADMIN for every user that is marked as an admin. We also use the email address as the login credential and as the name of the user, nothing wrong with that and you can change that anytime you like by extending the org.springframework.security.userdetails.User class.

Now for the spring security configuration. This is the tricky part and if you haven’t done this before I strongly suggest you read my earlier article on configuring the basics. If you go looking on the web, you’ll see a lot of people talking about authentication providers and what not. Thats only neccessary when you plan to authenticate user’s using some other way instead of their input details. If you just want to use a database then the following two lines in your security-applicationContext.xml are more than enough :

<b:bean id="customUserDetailsService" class="com.codercorp.npdac.security.MyUserDetailsService">
	<b:property name="dataSource" ref="dataSource" />
</b:bean>

<s:authentication-provider user-service-ref="customUserDetailsService" />

Those are the ONLY lines that you need to add to your configuration file. It’s pretty easy to see that all we’re doing is instantiating our user details service and then telling our AuthenticationProvider, DaoAuthenticationProvider by default, to use our service to retrieve user details. I did run into a problem while configuring spring security and recieved a org.springframework.security.providers.ProviderNotFoundException but that was only because I had set auto-config attribute of the http element to false because of which the default authentication provider was not initialized.

Your webapp can now use custom tables to implement it’s security.