Authentication & Authorization in Spring Security

import jakarta.persistence.*; import lombok.*; @Entity @Table(name = "user") @Getter @Setter @NoArgsConstructor @AllArgsConstructor public class User { @Id @GeneratedValue(strategy = GenerationType.IDENTITY) private Long id; private String username; private String password; private String role; // e.g., ROLE_ADMIN, ROLE_USER }

import org.springframework.data.jpa.repository.JpaRepository; import org.springframework.data.jpa.repository.JpaSpecificationExecutor; import java.util.Optional; public interface UserRepository extends JpaRepository, JpaSpecificationExecutor { Optional findByUsername(String name); }

import org.springframework.beans.factory.annotation.Autowired; import org.springframework.security.core.userdetails.UserDetails; import org.springframework.security.core.userdetails.UserDetailsService; import org.springframework.security.core.userdetails.UsernameNotFoundException; import org.springframework.stereotype.Service; @Service public class MyUserDetailservice implements UserDetailsService { @Autowired private UserRepository userRepository; @Override public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException { User user = userRepository.findByUsername(username) .orElseThrow(() -> new UsernameNotFoundException("User not found")); return org.springframework.security.core.userdetails.User.withUsername(user.getUsername()) .password(user.getPassword()) .roles(user.getRole()) .build(); } }

import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Configuration; import org.springframework.security.authentication.AuthenticationProvider; import org.springframework.security.authentication.dao.DaoAuthenticationProvider; import org.springframework.security.config.Customizer; import org.springframework.security.config.annotation.web.builders.HttpSecurity; import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity; import org.springframework.security.core.userdetails.UserDetailsService; import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder; import org.springframework.security.web.SecurityFilterChain; @Configuration @EnableWebSecurity // ✅ Explicitly enable security configuration public class SecurityConfig { @Autowired private UserDetailsService userDetailsService; // userDetailsService auto connect MyUserDetailservice because of @Service @Bean public AuthenticationProvider authProvider() { DaoAuthenticationProvider provider = new DaoAuthenticationProvider(); provider.setUserDetailsService(userDetailsService); provider.setPasswordEncoder(new BCryptPasswordEncoder(12)); // Set Password BCrypt Method return provider; } @Bean public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception { http .csrf(customizer -> customizer.disable()) .authorizeHttpRequests(request -> request .requestMatchers("/public/**").permitAll() // Access for all users like /public/data etc .requestMatchers("/admin").hasRole("ADMIN") // This route access for admin role only .requestMatchers("/user").hasAnyRole("USER", "ADMIN") // This route access for user and admin .anyRequest().authenticated()) .httpBasic(Customizer.withDefaults()); return http.build(); } }

import org.springframework.web.bind.annotation.*; @RestController @RequestMapping("") public class UserController { @GetMapping("/public/search") public String searchUsers(){ return "Success"; } @GetMapping("/admin") public String adminUsers(){ return "Admin Success"; } @GetMapping("/user") public String userUsers(){ return "User Success"; } @GetMapping("/auth") public String authUsers(){ return "Auth Success"; } }