Spring Security Series Tutorial 10--Authorization based on a custom database model

Keywords: Java Spring Spring Security


In the last chapter, one brotherExplains how to implement authentication authorization based on the default database model, in which the user's information is stored in the database, but there are many limitations! Because we have to build the database and build tables according to the source code, there is a lack of flexibility. When we really develop, tables such as user roles must be based on their own projects.Requirements are designed separately, so it is necessary to customize the user and role tables.

So in this article, I will take you with me to design a database and tables customized according to your actual project needs, and then authenticate and authorize user information in this customized database.

1.Introduction to Core API Source

1.UserDetailsService Source

In the previous chapter, I introduced you to a JdbcUserDetailsManager class whose structure is as follows:

The JdbcUserDetailsManager class implements authentication based on the default database model, but if we want a more flexible way to implement authentication authorization based on a custom database model, we need to use the UserDetailsService interface.

First follow one to see the source code of the UserDetailsService interface and get a brief understanding of the role of this class.

public interface UserDetailsService {

	 * Locates the user based on the username. 
	UserDetails loadUserByUsername(String username) throws UsernameNotFoundException;

As you can see from the source code, we can use the loadUserByUsername() method to query the corresponding UserDetails information based on the user name, so what is UserDetails?

2.UserDetails Source

public interface UserDetails extends Serializable {
	Collection<? extends GrantedAuthority> getAuthorities();

	String getPassword();

	String getUsername();

	boolean isAccountNonExpired();

	boolean isAccountNonLocked();

	boolean isCredentialsNonExpired();

	boolean isEnabled();

From the source code of UserDetails, we know that UserDetails is actually a class that contains User information, including user name, password, role and account status.

With the above two core API s, we can do authentication and authorization work based on a custom database model, because no matter how the database structure of authentication and authorization changes in our project, as long as we construct a UserDetails class, then use UserDetails Service to load user information.

2.Implementing authorization based on a custom database model

1.Create a database

Before you start today's code, follow one brother to create a database and create a user role table in it. The table building script is as follows:

CREATE TABLE `users` (`id` bigint(20) NOT NULL AUTO_INCREMENT,
						  `username` varchar(50) NOT NULL,
						  `password` varchar(60) NOT NULL,
						  `enable` tinyint(4) NOT NULL DEFAULT `1`,
						  `roles` text character set utf8,
						  PRIMARY KEY (`id`),
						  KEY `username` (`username`)
						  ) ENGINE=InnoDB DEFAULT CHARSET=utf8 COLLATE=utf8_bin;

The table contains information such as user name, password, role, available status, and so on. Then we add some test data to the table, as shown in the following figure:

2.Create Project

Once we have the database ready, we will continue to build on the previous project by creating a new model module with the basic configuration information as before. The creation process is omitted. Please refer to the previous chapter for project creation!

3.Create User Entity Class

In the previous module, we first create a User entity class, which implements the UserDetails interface and the methods in the interface.

 * User Action Entity Class
public class User implements UserDetails {

    private Long id;

    private String username;

    private String password;

    private String roles;

    private boolean enable;

    private List<GrantedAuthority> authorities;

    public String getRoles() {
        return roles;

    public void setRoles(String roles) {
        this.roles = roles;

    public Long getId() {
        return id;

    public void setId(Long id) {
        this.id = id;

    public boolean isEnable() {
        return enable;

    public void setEnable(boolean enable) {
        this.enable = enable;

    public String getUsername() {
        return username;

    public void setUsername(String username) {
        this.username = username;

    public boolean isAccountNonExpired() {
        return true;

    public boolean isAccountNonLocked() {
        return true;

    public boolean isCredentialsNonExpired() {
        return true;

    public boolean isEnabled() {
        return this.enable;

    public void setAuthorities(List<GrantedAuthority> authorities) {
        this.authorities = authorities;

    public Collection<? extends GrantedAuthority> getAuthorities() {
        return this.authorities;

    public String getPassword() {
        return password;

    public void setPassword(String password) {
        this.password = password;

    public boolean equals(Object obj) {

        return obj instanceof User?this.username.equals(((User)obj).username):false;

    public int hashCode() {
        return this.username.hashCode();


Core Methodologies:

  • The four attributes accountNonExpired, accountNonLocked, credentialsNonExpired, enabled are used to describe the status of the user, indicating whether the account has not expired, whether the account has not been locked, whether the password has not expired, and whether the account is available.
  • The roles attribute represents the user's role;
  • The getAuthorities method returns the user's Role information. A user may have more than one Role, so the return value here is a collection type. In this method, we can transform our Role slightly.

4.Define Mapper Interface

Once the data model is ready, let's define a UserMapper interface, where we use Mybatis for specific database queries and just annotate them.

 * @Mapper Notes can be taken or not, since there is a MapperScan scan.
public interface UserMapper {

    @Select("SELECT * FROM users WHERE username=#{username}")
    User findByUserName(@Param("username") String username);


5.Implement UserDetailsService interface

Next at the service level, define a UserDetailsService subclass, implement the UserDetailsService interface, and then implement the loadUserByUsername() method in that interface. The parameters of this method are the user name passed in by the user at the time of login, and then query the user information based on the user name (after it is discovered, the system automatically performs password comparison).

public class MyUserDetailsService implements UserDetailsService {

    private UserMapper userMapper;

    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        // Attempting to read the user from the database
        User user = userMapper.findByUserName(username);
        // User does not exist, throw exception
        if (user == null) {
            throw new UsernameNotFoundException("user does not exist");
        // Resolve roles in the form of databases to the permission set for UserDetails
        // AuthorityUtils.commaSeparatedStringToAuthorityList is Spring Security
        //Provided method for cutting comma-separated permission set strings into a list of available permission objects
        // You can also do this yourself, such as separating them with semicolons, by referring to generateAuthorities
        return user;


In the implementation method, the setAuthorities() method of the user object is used to associate all the role information of the user. Otherwise, the user will have no role in the login authentication and the authentication will fail.

6.Configure SecurityConfig class

After writing the UserDetailsService interface above, let's create the SecurityConfig configuration class, which we associate with a custom UserService object in the configure method.

@EnableWebSecurity(debug = true)
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    protected void configure(HttpSecurity http) throws Exception {

    /***************************************Create users and roles in a database****************************************************************/

    private MyUserDetailsService userDetailsService;

    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        //Associate UserDetailsService Objects
                //Temporarily do not configure passwords for encryption


7.Configure Entry Class

Since we are using Mybatis for database operations, we must use the @MapperScan annotation in the entry class to scan the Mapper components.

public class Demo03Application {

    public static void main(String[] args) {

        SpringApplication.run(Demo03Application.class, args);


8.Add Database Configuration

Next we configure the database connection in the application.yml file, associating the configuration with your own database information.

    url: jdbc:mysql://localhost:3306/db-security?useUnicode=true&characterEncoding=utf-8&useSSL=false&serverTimezone=GMT
    username: root
    password: syc

So far, I've written the core code of this case for you!

9.Code structure

Now the code structure of our entire project is as follows, so you can refer to creating your own project:

3.Start project testing

Once we've written the code, we'll start the project and test it, and the effect will be the same as the authorization implementation based on the memory model, which we won't show anymore.

When accessing interfaces such as / admin/**, /user/**, you will jump to the following login interface. After successful login authentication, you will jump to the corresponding interface access page.

Okay, we've learned how to authenticate and authorize based on a custom database model again today, isn't it easy? If you don't understand something, remember to leave a comment!

Posted by flforlife on Fri, 17 Sep 2021 06:47:52 -0700