• Java
    • JAXB Tutorial
      • What is JAXB
      • JAXB Marshalling Example
      • JAXB UnMarshalling Example
  • Spring Tutorial
    • Spring Core Tutorial
    • Spring MVC Tutorial
      • Quick Start
        • Flow Diagram
        • Hello World Example
        • Form Handling Example
      • Handler Mapping
        • BeanNameUrlHandlerMapping
        • ControllerClassNameHandlerMapping
        • SimpleUrlHandlerMapping
      • Validation & Exception Handling
        • Validation+Annotations
        • Validation+ResourceBundle
        • @ExceptionHandler
        • @ControllerAdvice
        • Custom Exception Handling
      • Form Tag Library
        • Textbox Example
        • TextArea Example
        • Password Example
        • Dropdown Box Example
        • Checkboxes Example
        • Radiobuttons Example
        • HiddenValue Example
      • Misc
        • Change Config file name
    • Spring Boot Tutorial
  • Hibernate Tutorial
  • REST Tutorial
    • JAX-RS REST @PathParam Example
    • JAX-RS REST @QueryParam Example
    • JAX-RS REST @DefaultValue Example
    • JAX-RS REST @Context Example
    • JAX-RS REST @MatrixParam Example
    • JAX-RS REST @FormParam Example
    • JAX-RS REST @Produces Example
    • JAX-RS REST @Consumes Example
    • JAX-RS REST @Produces both XML and JSON Example
    • JAX-RS REST @Consumes both XML and JSON Example
  • Miscellaneous
    • JSON Parser
      • Read a JSON file
      • Write JSON object to File
      • Read / Write JSON using GSON
      • Java Object to JSON using JAXB
    • CSV Parser
      • Read / Write CSV file
      • Read/Parse/Write CSV File – OpenCSV
      • Export data into a CSV File
      • CsvToBean and BeanToCsv – OpenCSV

JavaInterviewPoint

Java Development Tutorials

Spring Security – InMemoryUserDetailsManager Example | In-Memory Authentication

August 7, 2019 by javainterviewpoint Leave a Comment

Spring In-Memory authentication uses InMemoryUserDetailsManager internally store and retrieve the user-related information which is required for Authentication. In this InMemoryUserDetailsManager Example, we will learn how to create and store the user to the in-memory HashMap, update the user credentials and finally delete the User.

So whenever the user requests for any details, the request is filtered and passed to AuthenticationManager, which tries to authenticate the request by the using UserDetailsService.

The UserDetailsService is responsible for retrieving the correct user details, InMemoryUserDetailsManager indirectly implements UserDetailsService interface. Now the InMemoryUserDetailsManager reads the in-memory hashmap and loads the UserDetails by calling the loadUserByUsername() method.

Once the UserDetails is loaded via InMemoryUserDetailsManager and the authentication is successful, the SecurityContext will be updated and the request will proceed to the DispatcherServlet and so on..

Folder Structure:

InMemoryUserDetailsManager Example Folder Structure

  1. Create a simple Maven Project “SpringInMemoryExample” and create a package for our source files “com.javainterviewpoint.config” and “com.javainterviewpoint.controller” under  src/main/java 
  2. Now add the following dependency in the POM.xml
    <project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    	xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
    
    	<modelVersion>4.0.0</modelVersion>
    
    	<groupId>com.javainterviewpoint</groupId>
    	<artifactId>SpringInMemoryExample</artifactId>
    	<packaging>war</packaging>
    	<version>0.0.1-SNAPSHOT</version>
    	<name>SpringInMemoryExample</name>
    
    	<build>
    		<finalName>SpringInMemoryExample</finalName>
    		<plugins>
    			<plugin>
    				<groupId>org.apache.maven.plugins</groupId>
    				<artifactId>maven-war-plugin</artifactId>
    				<version>2.6</version>
    				<configuration>
    					<failOnMissingWebXml>false</failOnMissingWebXml>
    				</configuration>
    			</plugin>
    		</plugins>
    	</build>
    
    	<properties>
    		<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
    		<maven.compiler.source>1.8</maven.compiler.source>
    		<maven.compiler.target>1.8</maven.compiler.target>
    	</properties>
    	<dependencies>
    		<dependency>
    			<groupId>org.springframework</groupId>
    			<artifactId>spring-webmvc</artifactId>
    			<version>5.1.8.RELEASE</version>
    		</dependency>
    		<dependency>
    			<groupId>org.springframework.security</groupId>
    			<artifactId>spring-security-config</artifactId>
    			<version>5.1.5.RELEASE</version>
    		</dependency>
    		<dependency>
    			<groupId>org.springframework.security</groupId>
    			<artifactId>spring-security-core</artifactId>
    			<version>5.1.5.RELEASE</version>
    		</dependency>
    		<dependency>
    			<groupId>org.springframework.security</groupId>
    			<artifactId>spring-security-web</artifactId>
    			<version>5.1.5.RELEASE</version>
    		</dependency>
    		<dependency>
    			<groupId>org.springframework.security.oauth</groupId>
    			<artifactId>spring-security-oauth2</artifactId>
    			<version>2.3.6.RELEASE</version>
    		</dependency>
    
    		<dependency>
    			<groupId>com.fasterxml.jackson.core</groupId>
    			<artifactId>jackson-databind</artifactId>
    			<version>2.9.9</version>
    		</dependency>
    		<dependency>
    			<groupId>com.fasterxml.jackson.core</groupId>
    			<artifactId>jackson-annotations</artifactId>
    			<version>2.9.9</version>
    		</dependency>
    		<dependency>
    			<groupId>com.fasterxml.jackson.core</groupId>
    			<artifactId>jackson-core</artifactId>
    			<version>2.9.9</version>
    		</dependency>
    		<dependency>
    			<groupId>javax.servlet</groupId>
    			<artifactId>javax.servlet-api</artifactId>
    			<version>4.0.0</version>
    		</dependency>
    		<dependency>
    			<groupId>javax.servlet.jsp</groupId>
    			<artifactId>javax.servlet.jsp-api</artifactId>
    			<version>2.3.1</version>
    		</dependency>
    		<dependency>
    			<groupId>javax.servlet</groupId>
    			<artifactId>jstl</artifactId>
    			<version>1.2</version>
    		</dependency>
    	</dependencies>
    </project>
  3. Create the Java class HelloController.java, ServletInitializer.java, SpringSecurityConfig.java and SecurityInitializer.java under com.javainterviewpoint folder.

Other interesting articles which you may like …

  • Spring Security Tutorial Hello World Example
  • Spring Security Annotation Configuration Example
  • Spring Security Database Authentication Example
  • Spring Security REST Basic Authentication
  • Spring Boot Security Basic Authentication
  • Spring Boot Security Database Authentication Example
  • context:annotation-config vs context:component-scan
  • Spring MVC BeanNameUrlHandlerMapping Example
  • Spring MVC ControllerClassNameHandlerMapping Example
  • Spring MVC SimpleUrlHandlerMapping Example
  • Spring REST Hello World Example – JSON and XML responses
  • ClassNotFoundException: org.springframework.web.context.ContextLoaderListener
  • Fix missing src/main/java folder in Eclipse Maven Project – 2 build path entries are missing
  • Spring MVC CRUD Example with MySql + JdbcTemplate
  • RESTful Java Client With Jersey Client
  • RESTEasy Hello World Example with Apache Tomcat
  • RESTful Java client with RESTEasy client
  • Spring RESTful Web Services Hello World XML Example
  • Springfox Swagger 2 for Spring RESTful Web Services

Spring Security – InMemoryUserDetailsManager Example

InMemoryUserDetailsManager Example

Spring Security Configuration – InMemoryUserDetailsManager

package com.javainterviewpoint.config;

import java.util.ArrayList;
import java.util.List;

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.ComponentScan;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.provisioning.InMemoryUserDetailsManager;
import org.springframework.web.servlet.config.annotation.EnableWebMvc;

@Configuration
@EnableWebMvc
@EnableWebSecurity
@ComponentScan(basePackages = { "com.javainterviewpoint" })
public class SpringSecurityConfig extends WebSecurityConfigurerAdapter
{

	@Override
	protected void configure(AuthenticationManagerBuilder auth) throws Exception
	{
		auth.userDetailsService(inMemoryUserDetailsManager());
	}

	@Override
	protected void configure(HttpSecurity http) throws Exception
	{
		http
			.authorizeRequests()
			.antMatchers("/employee**").hasRole("USER")
			.antMatchers("/manager**").hasRole("MANAGER")
			.anyRequest().authenticated()
			.and()
			.httpBasic()
			.and()
			.csrf().disable();
	}

	@Bean
	public PasswordEncoder passwordEncoder()
	{
		return new BCryptPasswordEncoder();
	}

	@Bean
	public InMemoryUserDetailsManager inMemoryUserDetailsManager()
	{
		List<UserDetails> userDetailsList = new ArrayList<>();
		userDetailsList.add(User.withUsername("employee").password(passwordEncoder().encode("password"))
				.roles("EMPLOYEE", "USER").build());
		userDetailsList.add(User.withUsername("manager").password(passwordEncoder().encode("password"))
				.roles("MANAGER", "USER").build());

		return new InMemoryUserDetailsManager(userDetailsList);
	}
}
  • @EnableWebMvc is equivalent to <mvc:annotation-driven />. It enables support for @Controller, @RestController, etc.. annotated classes
  • @EnableWebSecurity annotation enables spring security configuration which is defined in WebSecurityConfigurerAdapter
  • We have extended WebSecurityConfigurerAdapter, which allows us to override spring’s security default feature. In our example we want all the requests to be authenticated using the custom authentication.
  • configure(HttpSecurity http) method configures the HttpSecurity class which authorizes each HTTP request which has been made. In our example ‘/employee**’ should be allowed for the user with USER role and ‘/manager**’ should be allowed for the user with MANAGER role.
    • authorizeRequests() .antMatchers(“/employee**”).hasRole(“USER”) .antMatchers(“/manager**”).hasRole(“MANAGER”) –> All requests to must be authorized or else they should be rejected.
    • httpBasic() –> enables the Basic Authentication
    • .csrf().disable() –> Disables CSRF protection
        @Override
	protected void configure(HttpSecurity http) throws Exception
	{
		http
			.authorizeRequests()
			.antMatchers("/employee**").hasRole("USER")
			.antMatchers("/manager**").hasRole("MANAGER")
			.anyRequest().authenticated()
			.and()
			.httpBasic()
			.and()
			.csrf().disable();
	}
  • configure(AuthenticationManagerBuilder auth) method configures the AuthenticationManagerBuilder class with the valid credentials and the allowed roles. The AuthenticationManagerBuilder class creates the AuthenticationManger which is responsible for authenticating the credentials. In our example, we have used the InMemoryUserDetailsManager as the UserDetailsService
  • inMemoryUserDetailsManager() methods create all the in-memory UserDetails, to start with we have added two users employee and manager.
        @Bean
	public InMemoryUserDetailsManager inMemoryUserDetailsManager()
	{
		List<UserDetails> userDetailsList = new ArrayList<>();
		userDetailsList.add(User.withUsername("employee").password(passwordEncoder().encode("password"))
				.roles("EMPLOYEE", "USER").build());
		userDetailsList.add(User.withUsername("manager").password(passwordEncoder().encode("password"))
				.roles("MANAGER", "USER").build());

		return new InMemoryUserDetailsManager(userDetailsList);
	}

Registering Spring Security Filter 

Spring Security will be implemented using DelegatingFilterProxy, in order to register it with the Spring container we will be extending AbstractSecurityWebApplicationInitializer. This will enable Spring to register DelegatingFilterProxy and use the springSecurityFilterChain Filter

package com.javainterviewpoint.config;

import org.springframework.security.web.context.AbstractSecurityWebApplicationInitializer;

public class SecurityInitializer extends AbstractSecurityWebApplicationInitializer
{

}

ServletInitializer

From Servlet 3.0 onwards, ServletContext can be programmatically configured and hence web.xml is not required.

We have extended AbstractAnnotationConfigDispatcherServletInitializer class which in turn implements WebApplicationInitializer, the WebApplicationInitializer configures the ServletContext

package com.javainterviewpoint.config;

import org.springframework.web.servlet.support.AbstractAnnotationConfigDispatcherServletInitializer;

public class ServletInitializer extends AbstractAnnotationConfigDispatcherServletInitializer
{
	@Override
	protected Class<?>[] getRootConfigClasses()
	{
		return null;
	}

	@Override
	protected Class<?>[] getServletConfigClasses()
	{
		return new Class[] {SpringSecurityConfig.class};
	}

	@Override
	protected String[] getServletMappings()
	{
		return new String[] {"/"};
	}
}

HelloController

package com.javainterviewpoint.controller;

import java.util.ArrayList;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.authority.SimpleGrantedAuthority;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.provisioning.InMemoryUserDetailsManager;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.PathVariable;
import org.springframework.web.bind.annotation.RestController;

@RestController
public class HelloController
{
	@Autowired
	public InMemoryUserDetailsManager inMemoryUserDetailsManager;
	
	@Autowired
	public PasswordEncoder passwordEncoder;
	
	@GetMapping("/employee")
	public String welcomeEmployee()
	{
		return "Welcome Employee";
	}

	@GetMapping("/manager")
	public String welcomeManager()
	{
		return "Welcome Manager";
	}

	@GetMapping("/employee/{username}")
	public String checkIfUserExists(@PathVariable("username") String username)
	{
		boolean flag = inMemoryUserDetailsManager.userExists(username);
		if (flag)
			return "\""+username + "\" exist in InMemoryUserDetailsManager";
		else
			return "\""+username + "\" does not exist in InMemoryUserDetailsManager";
	}

	@GetMapping("/employee/create/{username}/{password}/{role}")
	public String createUser(@PathVariable("username") String username, @PathVariable("password") String password,
			@PathVariable("role") String role)
	{
		
		ArrayList<GrantedAuthority> grantedAuthoritiesList= new ArrayList<>();
		grantedAuthoritiesList.add(new SimpleGrantedAuthority(role));
		
		inMemoryUserDetailsManager.createUser(new User(username, passwordEncoder.encode(password), grantedAuthoritiesList));
		
		return checkIfUserExists(username);
	}
	
	@GetMapping("/employee/update/{username}/{password}/{role}")
	public String updateUser(@PathVariable("username") String username, @PathVariable("password") String password,
			@PathVariable("role") String role)
	{
		ArrayList<GrantedAuthority> grantedAuthoritiesList= new ArrayList<>();
		grantedAuthoritiesList.add(new SimpleGrantedAuthority(role));
		
		inMemoryUserDetailsManager.updateUser(new User(username, passwordEncoder.encode(password), grantedAuthoritiesList));
		
		return checkIfUserExists(username);
	}
	
	@GetMapping("/employee/delete/{username}")
	public String deleteUser(@PathVariable("username") String username)
	{
		
		inMemoryUserDetailsManager.deleteUser(username);
		
		return checkIfUserExists(username);
	}
}

We have autowired InMemoryUserDetailsManager and PasswordEncoder classes, InMemoryUserDetailsManager enables us to create, retrieve, modify and delete the UserDetails and PasswordEncoder is an implementation of BCryptPasswordEncoder used to encode the password.

All the request which start with /employee requires USER role and the request which start with /manager requires MANAGER role. checkIfUserExists(), createUser(), updateUser(), deleteUser() methods will help us to make changes to the in-memory UserDetails

Output:

Check if the User Exist or Not

In POSTMAN,  select GET method and hit the URL “http://localhost:8080/SpringInMemoryExample/employee/employee”

In the Authorization, tab select the Type as “Basic Auth” and key in the valid username /password [employee/password (or) manager/password]. You should get a response like“employee” exist in InMemoryUserDetailsManager

InMemoryUserDetailsManager User Check

Now hit “http://localhost:8080/SpringInMemoryExample/employee/employee111” and the response will be “employee111” does not exist in InMemoryUserDetailsManager

User Not Exist

Create User

GET request on the URL “http://localhost:8080/SpringInMemoryExample/employee/create/john/pass/ROLE_USER”

In the Authorization, tab select the Type as “Basic Auth” and key in the valid credentials (employee/password)

This adds the User john to the In-Memory UserDetails

InMemoryUserDetailsManager Create User

Update User

Now let’s update the password for the user john.

Place a GET request on the URL “http://localhost:8080/SpringInMemoryExample/employee/update/john/password/ROLE_USER”

In the Authorization, tab select the Type as “Basic Auth” and key in the valid credentials (employee/password)

Spring Security Update UserDetails

Let’s now try to login with the user john and validate whether we are able to access the /employee service as it needs the USER role

Hit on the URL “http://localhost:8080/SpringInMemoryExample/employee” with credentials (john/password)

Spring Security Update UserDetails Check

Try accessing the /manager service, it should be 403 Forbidden as it requires MANAGER role

Spring Security 403 Forbidden

Delete User

Let’s delete the user john

Hit on the URL “http://localhost:8080/SpringInMemoryExample/employee/delete/john”

Delete User

    Download Source Code

Filed Under: Java, Spring, Spring Security, Spring Tutorial Tagged With: In-Memory Authentication, InMemoryUserDetailsManager, InMemoryUserDetailsManager Example, Spring Security

Leave a Reply Cancel reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Java Basics

  • JVM Architecture
  • Object in Java
  • Class in Java
  • How to Set Classpath for Java in Windows
  • Components of JDK
  • Decompiling a class file
  • Use of Class.forName in java
  • Use Class.forName in SQL JDBC

Oops Concepts

  • Inheritance in Java
  • Types of Inheritance in Java
  • Single Inheritance in Java
  • Multiple Inheritance in Java
  • Multilevel Inheritance in Java
  • Hierarchical Inheritance in Java
  • Hybrid Inheritance in Java
  • Polymorphism in Java – Method Overloading and Overriding
  • Types of Polymorphism in java
  • Method Overriding in Java
  • Can we Overload static methods in Java
  • Can we Override static methods in Java
  • Java Constructor Overloading
  • Java Method Overloading Example
  • Encapsulation in Java with Example
  • Constructor in Java
  • Constructor in an Interface?
  • Parameterized Constructor in Java
  • Constructor Chaining with example
  • What is the use of a Private Constructors in Java
  • Interface in Java
  • What is Marker Interface
  • Abstract Class in Java

Java Keywords

  • Java this keyword
  • Java super keyword
  • Final Keyword in Java
  • static Keyword in Java
  • Static Import
  • Transient Keyword

Miscellaneous

  • newInstance() method
  • How does Hashmap works internally in Java
  • Java Ternary operator
  • How System.out.println() really work?
  • Autoboxing and Unboxing Examples
  • Serialization and Deserialization in Java with Example
  • Generate SerialVersionUID in Java
  • How to make a class Immutable in Java
  • Differences betwen HashMap and Hashtable
  • Difference between Enumeration and Iterator ?
  • Difference between fail-fast and fail-safe Iterator
  • Difference Between Interface and Abstract Class in Java
  • Difference between equals() and ==
  • Sort Objects in a ArrayList using Java Comparable Interface
  • Sort Objects in a ArrayList using Java Comparator

Follow

  • Coding Utils

Useful Links

  • Spring 4.1.x Documentation
  • Spring 3.2.x Documentation
  • Spring 2.5.x Documentation
  • Java 6 API
  • Java 7 API
  • Java 8 API
  • Java EE 5 Tutorial
  • Java EE 6 Tutorial
  • Java EE 7 Tutorial
  • Maven Repository
  • Hibernate ORM

About JavaInterviewPoint

javainterviewpoint.com is a tech blog dedicated to all Java/J2EE developers and Web Developers. We publish useful tutorials on Java, J2EE and all latest frameworks.

All examples and tutorials posted here are very well tested in our development environment.

Connect with us on Facebook | Privacy Policy | Sitemap

Copyright ©2023 · Java Interview Point - All Rights Are Reserved ·