Implement user authentication

[ranjithkumarravikumar52]

Resources

• Spring boot auto security configuration
• From medium

References

• Baeldung spring security authentication series
• Spring boot security with thymeleaf example
• Spring boot creating custom login form

[ranjithkumarravikumar52]

To-do

• Include spring-boot-starter-security

Persistence Layer

• Add two helper methods
  1. Find User by Email (Assuming we are logging in users by email)
  2. Find Role by Name
• Add active field to User entity

Configuration files

• Implement bCryptPasswordEncoder

Service Layer

• Inject bCryptPasswordEncoder into user service
• Modify save() method in user service to encrypt plain-text password

Application properties

1. datasource
2. usersQuery
3. rolesQuery

Security Configuration

• Create a class that extends WebSecurityConfigurerAdapter
• Inject 4 things
  1. bCryptPasswordEncoder
  2. dataSource (from properties file)
  3. usersQuery (from properties file)
  4. rolesQuery (from properties file)
• Override 3 configure methods with the following arguments
  1. AuthenticationManagerBuilder (jdbc authentication)
  2. HttpSecurity
  3. WebSecurity

Controller layer

• Provide GET mapping for login form ("/login")
• POST mapping for login is provided by spring boot

View layer

• Add login.html with post mapping action to /login
• Provide validation fields to email and password fields

[ranjithkumarravikumar52]

"/login" will be blocking all request to our app, allowing only when user is authenticated. Once authenticated, the rest of app functions as before.