Spring Security XML Configuration
The Spring Security we can be implemented by two way :
- Xml Based
- Java Based
Lets see the example of Spring Security with xml based configuration in Spring Project :
And then click on finish button.
Now we have to add some dependency in pom.xml file as below :After adding above dependency save it and make sure you are connected with a stable internet connection.
Now the final project structure is just like below :
As standard, we declare a Spring dispatcher servlet that handles all URLs coming to the application, and a Spring Web Context Loader Listener to loads Spring security configuration (in a Spring security configuration file named hello-security.xml file under /WEB-INF folder).
The DelegatingFilterProxy is a servlet filter that allows passing control to Filter classes that have access to the Spring application context. Spring Security relies on this technique heavily.
In web.xml we need to configure a filter named as DelegatingFilterProxy which looks for a Spring bean by the name of filter (for eg. springSecurityFilterChain) and delegates all works to that bean.
Create a file under the WEB-INF folder and name should beAs you are familiar with Spring MVC, the
The
And an InternalResourceViewResolverbean is declared to tell Spring how to resolve logical view names to physical view pages.
Create a file under the WEB-INF folder and name should be likeIn spring-security-core:5.0.0.RC1, the default PasswordEncoder is built as a DelegatingPasswordEncoder. When you store the users in memory, you are providing the passwords in plain text and when trying to retrieve the encoder from the DelegatingPasswordEncoder to validate the password it can't find one that matches the way in which these passwords were stored. You can also simply prefix {noop} to your passwords in order for the DelegatingPasswordEncoder use the NoOpPasswordEncoder to validate these passwords. Notice that NoOpPasswordEncoder is deprecated though, as it is not a good practice to store passwords in plain text. Here, there are two elements are used for authentication and authorization:
In the
The
When we use
package com.deepsingh44.controller;
import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.PostMapping;
import org.springframework.web.servlet.ModelAndView;
@Controller
public class MyController {
@GetMapping("/")
public String welcome() {
return "welcome";
}
@GetMapping("/admin")
public ModelAndView home() {
ModelAndView model = new ModelAndView("home");
model.addObject("message", "Spring Security.");
return model;
}
@GetMapping("/error")
public String error() {
return "error";
}
}
Create a welcome.jsp file under the WEB-INF/views folder.Create a error.jsp file under the WEB-INF/views folder
Create home.jsp under the WEB-INF/views folder.
The getUserPrincipal() method returns an object of some class derived from the Principal interface, which is an abstraction of the entity that is the "user" responsible for the request. From it you get an actual object that, depending on the implementing class, you can use to get all sorts of information about that user/identity. One of those properties is the string-representation of the name of the user/identity, which you obtain by calling getName().
getRemoteUser() is really just a shortcut to getting that string-representation. You don't have access to any other methods implemented by the implementing class, not do you have access to the object itself, just the string-representation of the name.
Output is :
No comments:
Post a Comment