Spring Security 4 Authentication Annotation XML Example

This tutorial shows you how to create Spring Security 4 Authentication Annotation XML Example. This example will demonstrate to secure a Spring MVC web application with authentication URL access.

Table of contents:
1. Project structure
2. Maven dependencies
3. Spring Security Configuration
4. Register security filter
5. Create Controller
6. Configure Spring MVC with Java Annotation Configuration
7. Configure the Dispatcher Servlet
8. Create views
9. Deploy Spring Security 4 Authentication Annotation XML Example

Other interesting posts you may like

Now, we are ready to create Spring Security 4 Authentication Annotation XML Example following step by step.

Project structure
Make sure your project looks similar to the following structure

Spring-Security-Annotation-Example-project

Maven dependencies
We are using the latest version of Spring MVC and Spring Security in this example. One more thing, we are configuring our application using Java Annotation Configuration, we don’t use the web.xml anymore. We need to instruct Maven to ignore the web.xml file by setting the failOnMissingWebXml element to false. Below is the pom.xml file for our project.

<groupId>com.javabycode.springsecurity</groupId>
	<artifactId>Spring-Security-Annotation-Example</artifactId>
	<version>1.0.0</version>
	<packaging>war</packaging>

<name>Spring-Security-Annotation-Example</name>

<properties>
		<springframework.version>4.3.0.RELEASE</springframework.version>
		<springsecurity.version>4.1.0.RELEASE</springsecurity.version>
	</properties>

<dependencies>
		
		<dependency>
			<groupId>org.springframework</groupId>
			<artifactId>spring-core</artifactId>
			<version>${springframework.version}</version>
		</dependency>
		<dependency>
			<groupId>org.springframework</groupId>
			<artifactId>spring-web</artifactId>
			<version>${springframework.version}</version>
		</dependency>
		<dependency>
			<groupId>org.springframework</groupId>
			<artifactId>spring-webmvc</artifactId>
			<version>${springframework.version}</version>
		</dependency>

<dependency>
			<groupId>org.springframework.security</groupId>
			<artifactId>spring-security-web</artifactId>
			<version>${springsecurity.version}</version>
		</dependency>
		<dependency>
			<groupId>org.springframework.security</groupId>
			<artifactId>spring-security-config</artifactId>
			<version>${springsecurity.version}</version>
		</dependency>

<dependency>
			<groupId>javax.servlet</groupId>
			<artifactId>javax.servlet-api</artifactId>
			<version>3.1.0</version>
		</dependency>
		<dependency>
			<groupId>javax.servlet.jsp</groupId>
			<artifactId>javax.servlet.jsp-api</artifactId>
			<version>2.3.1</version>
		</dependency>
		<dependency>
			<groupId>javax.servlet</groupId>
			<artifactId>jstl</artifactId>
			<version>1.2</version>
		</dependency>
	</dependencies>

<build>
		<pluginManagement>
			<plugins>
				<plugin>
					<groupId>org.apache.maven.plugins</groupId>
					<artifactId>maven-war-plugin</artifactId>
					<version>2.4</version>
					<configuration>
						<warSourceDirectory>src/main/webapp</warSourceDirectory>
						<warName>spring-security-annotation</warName>
						<failOnMissingWebXml>false</failOnMissingWebXml>
					</configuration>
				</plugin>
			</plugins>
		</pluginManagement>
		<finalName>spring-security-annotation</finalName>
	</build>
</project>

<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"

xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">

<groupId>com.javabycode.springsecurity</groupId>

<artifactId>Spring-Security-Annotation-Example</artifactId>

<name>Spring-Security-Annotation-Example</name>

<springframework.version>4.3.0.RELEASE</springframework.version>

<springsecurity.version>4.1.0.RELEASE</springsecurity.version>

</properties>

<groupId>org.springframework</groupId>

<artifactId>spring-core</artifactId>

<version>${springframework.version}</version>

</dependency>

<groupId>org.springframework</groupId>

<artifactId>spring-web</artifactId>

<version>${springframework.version}</version>

</dependency>

<groupId>org.springframework</groupId>

<artifactId>spring-webmvc</artifactId>

<version>${springframework.version}</version>

</dependency>

<groupId>org.springframework.security</groupId>

<artifactId>spring-security-web</artifactId>

<version>${springsecurity.version}</version>

</dependency>

<groupId>org.springframework.security</groupId>

<artifactId>spring-security-config</artifactId>

<version>${springsecurity.version}</version>

</dependency>

<groupId>javax.servlet</groupId>

<artifactId>javax.servlet-api</artifactId>

</dependency>

<groupId>javax.servlet.jsp</groupId>

<artifactId>javax.servlet.jsp-api</artifactId>

</dependency>

<groupId>javax.servlet</groupId>

</dependency>

</dependencies>

<build>

<groupId>org.apache.maven.plugins</groupId>

<artifactId>maven-war-plugin</artifactId>

<warSourceDirectory>src/main/webapp</warSourceDirectory>

<warName>spring-security-annotation</warName>

<failOnMissingWebXml>false</failOnMissingWebXml>

</configuration>

</plugin>

</plugins>

</pluginManagement>

<finalName>spring-security-annotation</finalName>

</build>

</project>

Spring Security Configuration
We enable spring security in the application by creating Spring Security Java Configuration class. This class is responsible for protecting the URLs, validating username and password, redirecting to the log in form in the application.

package com.javabycode.springsecurity.configuration;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;

@Configuration
@EnableWebSecurity
public class MySecurityConfiguration extends WebSecurityConfigurerAdapter {

@Autowired
	public void configureGlobalSecurity(AuthenticationManagerBuilder auth) throws Exception {
		auth.inMemoryAuthentication().withUser("javabycode").password("123456").roles("USER");
		auth.inMemoryAuthentication().withUser("admin").password("admin123").roles("ADMIN");
		auth.inMemoryAuthentication().withUser("root").password("root123").roles("ADMIN","ROOT");
	}
	
	@Override
	protected void configure(HttpSecurity http) throws Exception {
 
	  http.authorizeRequests()
	  	.antMatchers("/").permitAll() 
		.antMatchers("/admin/**").access("hasRole('ADMIN')")
		.antMatchers("/root/**").access("hasRole('ADMIN') and hasRole('ROOT')")
		.and().formLogin()
		.and().exceptionHandling().accessDeniedPage("/error");
 
	}
}

package com.javabycode.springsecurity.configuration;

import org.springframework.beans.factory.annotation.Autowired;

import org.springframework.context.annotation.Configuration;

import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;

import org.springframework.security.config.annotation.web.builders.HttpSecurity;

import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;

import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;

@Configuration

@EnableWebSecurity

public class MySecurityConfiguration extends WebSecurityConfigurerAdapter {

@Autowired

public void configureGlobalSecurity(AuthenticationManagerBuilder auth) throws Exception {

auth.inMemoryAuthentication().withUser("javabycode").password("123456").roles("USER");

auth.inMemoryAuthentication().withUser("admin").password("admin123").roles("ADMIN");

auth.inMemoryAuthentication().withUser("root").password("root123").roles("ADMIN","ROOT");

}

@Override

protected void configure(HttpSecurity http) throws Exception {

http.authorizeRequests()

.antMatchers("/").permitAll()

.antMatchers("/admin/**").access("hasRole('ADMIN')")

.antMatchers("/root/**").access("hasRole('ADMIN') and hasRole('ROOT')")

.and().formLogin()

.and().exceptionHandling().accessDeniedPage("/error");

}

Let’s dig deeper
The method configureGlobalSecurity(AuthenticationManagerBuilder auth) creates AuthenticationManagerBuilder with user credentials and appropriate roles. There are other authentication ways like JDBC, LDAP or other authentications. But we are using in-memory authentication in this example.

The method Configure makes HttpSecurity configuration for specific http requests. We are using antMathchers to restrict the specific requests here. Otherwise all requests will be applied by default.

We catch all the 403 cases (http access denied) and redirect to our error page by using exceptionHandling().accessDeniedPage()

The above security java configuration is equivalent with the below XML configuration:

<beans:beans xmlns="http://www.springframework.org/schema/security"
    xmlns:beans="http://www.springframework.org/schema/beans"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-4.3.xsd
    http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-4.1.xsd">
      
    <http auto-config="true" >
        <intercept-url pattern="/" access="permitAll" />
        <intercept-url pattern="/admin**" access="hasRole('ADMIN')" />
        <intercept-url pattern="/root**" access="hasRole('ADMIN') and hasRole('ROOT')" />
        <form-login  authentication-failure-url="/error" />
    </http>
  
    <authentication-manager >
        <authentication-provider>
            <user-service>
                <user name="javabycode"  password="123456"  authorities="ROLE_USER" />
                <user name="admin" password="admin123" authorities="ROLE_ADMIN" />
                <user name="root"   password="root123" authorities="ROLE_ADMIN,ROLE_ROOT" />
            </user-service>
        </authentication-provider>
    </authentication-manager>
      
     
</beans:beans>

<beans:beans xmlns="http://www.springframework.org/schema/security"

xmlns:beans="http://www.springframework.org/schema/beans"

xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"

xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-4.3.xsd

http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-4.1.xsd">

<intercept-url pattern="/" access="permitAll" />

<intercept-url pattern="/admin**" access="hasRole('ADMIN')" />

<intercept-url pattern="/root**" access="hasRole('ADMIN') and hasRole('ROOT')" />

<form-login authentication-failure-url="/error" />

</http>

<authentication-manager >

<authentication-provider>

<user-service>

</user-service>

</authentication-provider>

</authentication-manager>

</beans:beans>

Register security filter
We create the class which extends AbstractSecurityWebApplicationInitializer to register spring security filter with the application. AbstractSecurityWebApplicationInitializer includes DelegatingFilterProxy and ContextLoaderListener.

package com.javabycode.springsecurity.configuration;

import org.springframework.security.web.context.AbstractSecurityWebApplicationInitializer;

public class MySecurityWebApplicationInitializer extends AbstractSecurityWebApplicationInitializer {

}

The above security java configuration is equivalent with the below XML configuration:

<filter-name>springSecurityFilterChain</filter-name>

<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>

</filter>

<filter-mapping>

<filter-name>springSecurityFilterChain</filter-name>

<url-pattern>/*</url-pattern>

</filter-mapping>

Create Controller
We create simple controller demonstrates authentication steps with every user roles. Notices that we use the method getPrincipal to get user name from Spring SecurityContext. Our controller should be implemented like below:

package com.javabycode.springsecurity.controller;

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import org.springframework.security.core.Authentication;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.web.authentication.logout.SecurityContextLogoutHandler;
import org.springframework.stereotype.Controller;
import org.springframework.ui.ModelMap;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RequestMethod;

@Controller
public class MyLoginController {

@RequestMapping(value = { "/" }, method = RequestMethod.GET)
	public String welcomeView(ModelMap model) {
		model.addAttribute("message", "Welcome to my site. This is Spring Security Example");
		return "index";
	}

@RequestMapping(value = "/admin", method = RequestMethod.GET)
	public String adminView(ModelMap model) {
		model.addAttribute("userName", getUserName());
		return "admin";
	}

@RequestMapping(value = "/root", method = RequestMethod.GET)
	public String rootView(ModelMap model) {
		model.addAttribute("userName", getUserName());
		return "root";
	}

@RequestMapping(value="/logout", method = RequestMethod.GET)
	   public String logoutView (HttpServletRequest request, HttpServletResponse response) {
	      Authentication auth = SecurityContextHolder.getContext().getAuthentication();
	      if (auth != null){    
	         new SecurityContextLogoutHandler().logout(request, response, auth);
	      }
	      return "index";
	   }

@RequestMapping(value = "/error", method = RequestMethod.GET)
	public String errorView(ModelMap model) {
		model.addAttribute("userName", getUserName());
		return "error";
	}
	
	private String getUserName(){
		String userName = null;
		Object credential = SecurityContextHolder.getContext().getAuthentication().getPrincipal();

if (credential instanceof UserDetails) {
			userName = ((UserDetails)credential).getUsername();
		} else {
			userName = credential.toString();
		}
		return userName;
	}
}

package com.javabycode.springsecurity.controller;

import javax.servlet.http.HttpServletRequest;

import javax.servlet.http.HttpServletResponse;

import org.springframework.security.core.Authentication;

import org.springframework.security.core.context.SecurityContextHolder;

import org.springframework.security.core.userdetails.UserDetails;

import org.springframework.security.web.authentication.logout.SecurityContextLogoutHandler;

import org.springframework.stereotype.Controller;

import org.springframework.ui.ModelMap;

import org.springframework.web.bind.annotation.RequestMapping;

import org.springframework.web.bind.annotation.RequestMethod;

@Controller

public class MyLoginController {

@RequestMapping(value = { "/" }, method = RequestMethod.GET)

public String welcomeView(ModelMap model) {

model.addAttribute("message", "Welcome to my site. This is Spring Security Example");

return "index";

}

@RequestMapping(value = "/admin", method = RequestMethod.GET)

public String adminView(ModelMap model) {

model.addAttribute("userName", getUserName());

return "admin";

}

@RequestMapping(value = "/root", method = RequestMethod.GET)

public String rootView(ModelMap model) {

model.addAttribute("userName", getUserName());

return "root";

}

@RequestMapping(value="/logout", method = RequestMethod.GET)

public String logoutView (HttpServletRequest request, HttpServletResponse response) {

Authentication auth = SecurityContextHolder.getContext().getAuthentication();

if (auth != null){

new SecurityContextLogoutHandler().logout(request, response, auth);

}

return "index";

}

@RequestMapping(value = "/error", method = RequestMethod.GET)

public String errorView(ModelMap model) {

model.addAttribute("userName", getUserName());

return "error";

}

private String getUserName(){

String userName = null;

Object credential = SecurityContextHolder.getContext().getAuthentication().getPrincipal();

if (credential instanceof UserDetails) {

userName = ((UserDetails)credential).getUsername();

} else {

userName = credential.toString();

}

return userName;

}

Configure Spring MVC with Java Annotation Configuration

If you are similar to configure Spring MVC with annotation you can skip over this step. Where as you can study about it by refering to the post Spring MVC Annotation Example or look into attached source code. We will not mention it here.

Configure the Dispatcher Servlet

If you are similar to configure the Dispatcher Servlet you can skip over this step. Where as you can study about it by refering to the post Spring MVC Annotation Example or look into attached source code. We will not mention it here.

Create Views
We need to create views to display messages of authentication results.

index.jsp

<%@ page language="java" contentType="text/html; charset=ISO-8859-1" pageEncoding="ISO-8859-1"%>

<%@ taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core"%>

<html>

<head>

<title>Welcome page</title>

</head>

<body>

${message}

<br>

<a href="<c:url value="/admin" />">Login as Admin</a>

</body>

</html>

admin.jsp

<%@ page language="java" contentType="text/html; charset=ISO-8859-1" pageEncoding="ISO-8859-1"%>

<%@ taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core"%>

<html>

<head>

<title>Admin page</title>

</head>

<body>

Welcome <strong>${userName}</strong>, You are authorized to access the Admin page.

<br>

<a href="<c:url value="/root" />">Login as Root</a>

<br>

<a href="<c:url value="/logout" />">Logout</a>

</body>

</html>

root.jsp

<%@ page language="java" contentType="text/html; charset=ISO-8859-1" pageEncoding="ISO-8859-1"%>

<%@ taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core"%>

<html>

<head>

</head>

<body>

Welcome <strong>${userName}</strong>, You are authorized to access the Root page.

<a href="<c:url value="/logout" />">Logout</a>

</body>

</html>

error.jsp

<%@ page language="java" contentType="text/html; charset=ISO-8859-1" pageEncoding="ISO-8859-1"%>

<%@ taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core"%>

<html>

<head>

<title>Error page</title>

</head>

<body>

Sorry <strong>${userName}</strong>, You are not authorized to access this page.

<a href="<c:url value="/logout" />">Logout</a>

</body>

</html>

Deploy Spring Security 4 Authentication Annotation XML Example

After building the project by maven we deploy the file war on application server (Tomcat 8 for example). Run the URL http://localhost:8080/spring-security-annotation/ and the screen looks like this

Spring Security 4 Authentication Annotation XML Example welcome