SPRING in ACTION 4th Edition notes-Nineth chapter securing Web applications-002-The user data in memory (Authenticationmanagerbuilder, Userdetailsmanagerconfigurer.userdetailsbuilder)

Spring Security is extremely flexible and is capable of authenticating users against virtually any data store. Several Common User store Situations-such as in-memory, relational database, and Ldap-are provided out of the BO X. But can also create and plug in custom user store implementations. Spring Security ' s Java configuration makes it easy to configure one or more data store options.

Working with an in-memory user store

1.Since Your Security Configuration class extends Websecurityconfigureradapter, the easiest Configure a user store is to override the Configure () method, takes an authenticationmanagerbuilder as a par Ameter. Authenticationmanagerbuilder has several methods so can be used to configure Spring Security ' s authentication

Support. With the Inmemoryauthentication () method, you can enable and configure and optionally populate an In-memory user store.

1  PackageSpitter.config;2 Importorg.springframework.beans.factory.annotation.Autowired;3 Importorg.springframework.context.annotation.Configuration;4 ImportOrg.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;5 ImportOrg.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;6 Importorg.springframework.security.config.annotation.web.servlet.configuration.EnableWebMvcSecurity;7 8 @Configuration9 @EnableWebMvcSecurityTen  Public classSecurityconfigextendsWebsecurityconfigureradapter { One @Override A     protected voidConfigure (Authenticationmanagerbuilder auth) -     throwsException { - Auth the. Inmemoryauthentication ()//Enable an in-memory user store. -. Withuser ("user"). Password ("password"). Roles ("User").). and () -. Withuser ("admin"). Password ("password"). Roles ("USER", "admin"); -     } +}

calling inmemoryauthentication () would enable an In-memory user store. But you'll also need some users in there, or else it's as if you had no user store at all. Therefore, need to call the Withuser () method to add a new user to the in-
Memory User store. The parameter given is the username. Withuser () returns a UserDetailsmanagerconfigurer.userdetailsbuilder, which have several methods for fur ther configuration of the user, including password () to set the user ' s password and roles () to give the user one or more role authorities.

2. All operation of Userdetailsmanagerconfigurer.userdetailsbuilder branch

It is worth noting that role () is implemented by calling Authrities (), which is equivalent to the following code:

1 Auth 2     . Inmemoryauthentication ()3     . Withuser ("user"). Password ("password")4 .     authorities ("Role_user"). and ()5     . Withuser ("admin"). Password ("password"). )6     . Authorities ("Role_user", "role_admin");

SPRING in ACTION 4th Note-Chapter Nineth Securing Web Applications-002-The presence of user data in memory (Authenticationmanagerbuilder, Userdetailsmanagerconfigurer.userdetailsbuilder)