spring-security

Multiple roles using @PreAuthorize

You can create a custom annotation to validate many roles and conditions. P.e.: @Retention(RetentionPolicy.RUNTIME) @PreAuthorize(“hasRole(T(com.bs.dmsbox.api.constants.RoleConstants).ROLE_AGENT) ” + “|| hasRole(T(com.bs.dmsbox.api.constants.RoleConstants).ROLE_ADMIN)” + “|| (hasRole(T(com.bs.dmsbox.api.constants.RoleConstants).ROLE_CUSTOMER) && #userId == principal.username)”) public @interface IsAuthenticatedAsAgentOrCustomerIsUserId { } Then, you can use this annotation as below: @IsAuthenticatedAsAgentOrCustomerIsUserId Folder findByUserIdAndType(@Param(“userId”) String userId, @Param(“typeId”) FolderType id); This annotation validate that user logged as role … Read more

How to allow a User only access their own data in Spring Boot / Spring Security?

In any @Controller, @RestController annotated bean you can use Principal directly as a method argument. @RequestMapping(“/users/{user_id}”) public String getUserInfo(@PathVariable(“user_id”) Long userId, Principal principal){ // test if userId is current principal or principal is an ADMIN …. } If you don’t want the security checks in your Controllers you could use Spring EL expressions. You probably … Read more

How do I disable resolving login parameters passed as url parameters / from the url

This makes Spring searching login data in both – parameters and body. I wish to disable searching those parameters in the url. I believe this is not possible since this behaviour is not implemented by Spring rather than JavaEE itself. HttpServletRequest.getParameter doc states: Returns the value of a request parameter as a String, or null … Read more

How to reload authorities on user update with Spring Security

If you need to dynamically update a logged in user’s authorities (when these have changed, for whatever reason), without having to log out and log in of course, you just need to reset the Authentication object (security token) in the Spring SecurityContextHolder. Example: Authentication auth = SecurityContextHolder.getContext().getAuthentication(); List<GrantedAuthority> updatedAuthorities = new ArrayList<>(auth.getAuthorities()); updatedAuthorities.add(…); //add your … Read more

How to test spring-security-oauth2 resource server security?

To test resource server security effectively, both with MockMvc and a RestTemplate it helps to configure an AuthorizationServer under src/test/java: AuthorizationServer @Configuration @EnableAuthorizationServer @SuppressWarnings(“static-method”) class AuthorizationServerConfig extends AuthorizationServerConfigurerAdapter { @Bean public JwtAccessTokenConverter accessTokenConverter() throws Exception { JwtAccessTokenConverter jwt = new JwtAccessTokenConverter(); jwt.setSigningKey(SecurityConfig.key(“rsa”)); jwt.setVerifierKey(SecurityConfig.key(“rsa.pub”)); jwt.afterPropertiesSet(); return jwt; } @Autowired private AuthenticationManager authenticationManager; @Override public void configure(final … Read more

Spring Boot: How to specify the PasswordEncoder?

In spring-security-core:5.0.0.RC1, the default PasswordEncoder is built as a DelegatingPasswordEncoder. When you store the users in memory, you are providing the passwords in plain text and when trying to retrieve the encoder from the DelegatingPasswordEncoder to validate the password it can’t find one that matches the way in which these passwords were stored. Use this … Read more