1. Overview
In this quick tutorial, we’ll be looking at how to secure a Java EE web application with Spring Security.
2. Maven Dependencies
Let’s start with the required Spring Security dependencies for this tutorial:
<dependency>
<groupId>org.springframework.security</groupId>
<artifactId>spring-security-web</artifactId>
<version>4.2.3.RELEASE</version>
</dependency>
<dependency>
<groupId>org.springframework.security</groupId>
<artifactId>spring-security-config</artifactId>
<version>4.2.3.RELEASE</version>
</dependency>
<dependency>
<groupId>org.springframework.security</groupId>
<artifactId>spring-security-taglibs</artifactId>
<version>4.2.3.RELEASE</version>
</dependency>
The latest Spring Security version (at the time of writing this tutorial) is 4.2.3.RELEASE; as always, we can check Maven Central for newest versions.
3. Security Configuration
Next, we need to set up the security configuration for the existing Java EE application:
@Configuration
@EnableWebSecurity
public class SpringSecurityConfig
extends WebSecurityConfigurerAdapter {
@Override
protected void configure(AuthenticationManagerBuilder auth)
throws Exception {
auth.inMemoryAuthentication()
.withUser("user1").password("user1Pass").roles("USER")
.and()
.withUser("admin").password("adminPass").roles("ADMIN");
}
}
In the configure() method, we setup the AuthenticationManager. For the sake of simplicity, we implement a simple in-memory authentication. User details are hard-coded.
This is meant to be used for rapid prototyping when a full persistence mechanism is not necessary.
Next, let’s integrate security into the existing system by adding the SecurityWebApplicationInitializer class:
public class SecurityWebApplicationInitializer
extends AbstractSecurityWebApplicationInitializer {
public SecurityWebApplicationInitializer() {
super(SpringSecurityConfig.class);
}
}
This class will ensure the SpringSecurityConfig is loaded during application startup. At this stage, we’ve achieved a basic implementation of Spring Security. With this implementation, Spring Security will require authentication for all requests and routes by default.
4. Configuring Security Rules
We can further customize Spring Security by overriding WebSecurityConfigurerAdapter‘s configure(HttpSecurity http) method:
@Override
protected void configure(HttpSecurity http) throws Exception {
http
.csrf().disable()
.authorizeRequests()
.antMatchers("/auth/login*").anonymous()
.anyRequest().authenticated()
.and()
.formLogin()
.loginPage("/auth/login")
.defaultSuccessUrl("/home", true)
.failureUrl("/auth/login?error=true")
.and()
.logout().logoutSuccessUrl("/auth/login");
}
Using the antMatchers() method, we configure Spring Security to allow anonymous access to /auth/login and authenticate any other request.
4.1. Custom Login Page
A custom login page is configured using the formLogin() method:
http.formLogin()
.loginPage("/auth/login")
If this is not specified, Spring Security generates a default login page at /login:
<html>
<head></head>
<body>
<h1>Login</h1>
<form name='f' action="/auth/login" method='POST'>
<table>
<tr>
<td>User:</td>
<td><input type='text' name='username' value=''></td>
</tr>
<tr>
<td>Password:</td>
<td><input type='password' name='password'/></td>
</tr>
<tr>
<td><input name="submit" type="submit"
value="submit"/></td>
</tr>
</table>
</form>
</body>
</html>
4.2. Custom Landing Page
Upon successful login, Spring Security redirects the user to the root of the application. We can override this by specifying a default success URL:
http.formLogin()
.defaultSuccessUrl("/home", true)
By setting the defaultSuccessUrl() method’s alwaysUse parameter to true, a user will always be redirected to the specified page.
If the alwaysUse parameter is not set or is set to false, a user will be redirected to the previous page he tried to access before being prompted for authentication.
Similarly, we can also specify a custom failure landing page:
http.formLogin()
.failureUrl("/auth/login?error=true")
4.3. Authorization
We can restrict access to a resource by role:
http.formLogin()
.antMatchers("/home/admin*").hasRole("ADMIN")
A non-admin user will receive an Access Denied error if he/she tries to access the /home/admin endpoint.
We can also restrict data on a JSP page based on a user’s role. This is done using the <security:authorize> tag:
<security:authorize access="hasRole('ADMIN')">
This text is only visible to an admin
<br/>
<a href="<c:url value="/home/admin" />">Admin Page</a>
<br/>
</security:authorize>
To use this tag, we have to include the Spring Security tags taglib at the top of the page:
<%@ taglib prefix="security" uri="http://www.springframework.org/security/tags" %>
5. Spring Security XML Configuration
So far we have looked at configuring Spring Security in Java. Let’s take a look at an equivalent XML configuration.
First, we need to create a security.xml file in the web/WEB-INF/spring folder that contains our XML configurations. An example of such a security.xml config file is available at the end of the article.
Let’s start by configuring the authentication manager and authentication provider. For the sake of simplicity we use simple hard-coded user credentials:
<authentication-manager>
<authentication-provider>
<user-service>
<user name="user"
password="user123"
authorities="ROLE_USER" />
</user-service>
</authentication-provider>
</authentication-manager>
What we just did is to create a user with a username, password, and a role.
Alternatively, we can configure our authentication provider with a password encoder:
<authentication-manager>
<authentication-provider>
<password-encoder hash="sha"/>
<user-service>
<user name="user"
password="d7e6351eaa13189a5a3641bab846c8e8c69ba39f"
authorities="ROLE_USER" />
</user-service>
</authentication-provider>
</authentication-manager>
We can also specify a custom implementation of Spring’s UserDetailsService or a Datasource as our authentication provider. More details can be found here.
Now that we have configured the authentication manager, let’s setup the security rules and apply access control:
<http auto-config='true' use-expressions="true">
<form-login default-target-url="/secure.jsp" />
<intercept-url pattern="/" access="isAnonymous()" />
<intercept-url pattern="/index.jsp" access="isAnonymous()" />
<intercept-url pattern="/secure.jsp" access="hasRole('ROLE_USER')" />
</http>
In the above snippet, we have configured HttpSecurity to use form login and have set /secure.jsp as the login success URL. We granted anonymous access to /index.jsp and the “/” path. Also, we specified that access to /secure.jsp should require authentication and an authenticated user should have, at least, the ROLE_USER level of authority.
Setting the auto-config attribute of the http tag to true instructs Spring Security to implement default behaviors that we don’t have to override in the configuration. Therefore, /login and /logout will be used for user login and logout respectively. A default login page is provided as well.
We can further customize the form-login tag with custom login and logout pages, URLs to handle both authentication failure and success. The Security Namespace appendix lists all the possible attributes for the form-login (and other) tags. Some IDEs also make inspection possible by clicking on a tag while pressing down the ctrl key.
Finally, for the security.xml config to be loaded during application startup, we need to add the following definitions to our web.xml:
<context-param>
<param-name>contextConfigLocation</param-name>
<param-value>
/WEB-INF/spring/*.xml
</param-value>
</context-param>
<filter>
<filter-name>springSecurityFilterChain</filter-name>
<filter-class>
org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>
<filter-mapping>
<filter-name>springSecurityFilterChain</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
<listener>
<listener-class>
org.springframework.web.context.ContextLoaderListener
</listener-class>
</listener>
Note that trying to use both XML and Java based configurations in the same JEE application may cause errors.
6. Conclusion
In this article, we have seen how to secure a Java EE application with Spring Security and demonstrated both Java-based and XML-based configurations.
We also discussed ways to grant or revoke access to specific resources based on a user’s role.
The complete source code and XML definitions are available over on GitHub.