Spring 4 MVC and Spring Security 100% java annotation based configuration

This post would be the continuation of my previous hello-world series for Spring 4. So far we have made a Spring 4 MVC webapp ready without using XML. In this tutorial we shall enable the spring security for the same webapp. I hope it will be easier for you to follow me.

My Earier posts  on the same series

• Get started with Spring 4 MVC
• Spring 4 dev environment
• Spring 4 MVC – 100% annotation based configuration

This post will not talk about how to setup spring MVC. Please check my earlier post Spring 4 MVC – 100% annotation based configuration. I assume, the mvc webapp is ready with you before you work on this.

WebSecurityConfigurerAdapter

Specify your webapp security behaviour here. The below config ensures, there is no restriction to access /home requests. Other unauthenticated requests will be forwarded to /login page

[code language=”java”]
package org.grassfield.conf;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.config.annotation.web.servlet.configuration.EnableWebMvcSecurity;

@SuppressWarnings("deprecation")
@Configuration
@EnableWebMvcSecurity
@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.csrf().disable();
        http
            .authorizeRequests()
                .antMatchers("/", "/home").permitAll()
                .anyRequest().authenticated()
                .and()
            .formLogin()
                .loginPage("/login")
                .permitAll()
                .and()
            .logout()
                .permitAll();
    }

    @Autowired
    public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
        auth
            .inMemoryAuthentication()
                .withUser("user").password("password").roles("USER");
    }
}

[/code]

Changes to HomeController

Added two more request mappings /login and /protect

[code language=”java”]
package org.grassfield.conf;

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.servlet.ModelAndView;

@Controller
public class HomeController {

    @RequestMapping("/")
    public ModelAndView handleRequest(HttpServletRequest arg0,
            HttpServletResponse arg1) throws Exception {
        return new ModelAndView("home");
    }

    @RequestMapping("/login")
    public ModelAndView handleLoginRequest(HttpServletRequest arg0,
            HttpServletResponse arg1) throws Exception {
        return new ModelAndView("login");
    }

    @RequestMapping("/protect")
    public ModelAndView handleProtectedRequest(HttpServletRequest arg0,
            HttpServletResponse arg1) throws Exception {
        return new ModelAndView("protect");
    }
}
[/code]

Pls note, we added /protect url!

AbstractSecurityWebApplicationInitializer

Register your security with the web application.

[code language=”java”]
package org.grassfield.conf;

import org.springframework.security.web.context.AbstractSecurityWebApplicationInitializer;

public class SecurityWebApplicationInitializer extends
AbstractSecurityWebApplicationInitializer {

public SecurityWebApplicationInitializer() {
super(WebSecurityConfig.class);
}

}
[/code]

Home page has the links for the protected pages. Click and see the behaviour!

Hope it helped you!