In my spring boot application, I have 2 different type of user - user and vendor which are stored in different tables in my SQL DB.
I have only allowed access to /user/login and /vendor/login which returns a JWT.
I am unable to understand how to configure spring security to check only the USERS table when someone requests /user/login and check only VENDORS table when vendor requests /vendor/login. Is this possible? If not could anyone suggest how do I configure spring security to authenticate users from different tables?
Here is my current configuration which only authenticates on USERS -
@Configuration
@EnableWebSecurity
public class SecurityConfigurer extends WebSecurityConfigurerAdapter {
@Autowired
private UserService myUserDetailsService; // this fetches data from the USERS table
@Autowired
private JwtRequestFilter jwtRequestFilter;
// *** How do I configure this to check both VENDORS OR USERS table? ***
@Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
auth.userDetailsService(myUserDetailsService).passwordEncoder(passwordEncoder());
}
@Override
protected void configure(HttpSecurity http) throws Exception {
http.csrf().disable().authorizeRequests()
.antMatchers("/user/auth/login").permitAll()
.antMatchers("/vendor/auth/login").permitAll()
.anyRequest().authenticated()
.and().sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);
http.addFilterBefore(jwtRequestFilter, UsernamePasswordAuthenticationFilter.class);
}
@Override
@Bean
public AuthenticationManager authenticationManagerBean() throws Exception {
return super.authenticationManagerBean();
}
@Bean
public BCryptPasswordEncoder passwordEncoder() {
return new BCryptPasswordEncoder();
}
}
I have implementations of UserDetailsService for both user and vendor. Here is implementation for userService -
@Service
public class UserService implements UserDetailsService {
@Autowired
private UserRepository repository;
@Autowired
private BCryptPasswordEncoder bCryptPasswordEncoder;
public UserService() {
}
public UserService(UserRepository repository) {
this.repository = repository;
}
public Users findOne(String id) {
Optional<Users> user = repository.findById(id);
return user.orElse(null);
}
public List<Users> findAll() {
List<Users> users = new ArrayList<>();
repository.findAll().forEach(users::add);
return users;
}
public Users insert(Users user) throws UnknownError {
// somecode here
}
public Users update(String id, Users user) {
// some code here
}
@Override
public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
final Users user = findByEmail(username);
if (user == null) {
throw new UsernameNotFoundException("No user Found");
}
return new User(user.getEmail(), user.getPassword(), new ArrayList<>());
}
}
Here is the UserController (VendorController is similar to this) -
@RestController
@RequestMapping(path = "/user")
public class AuthController {
@Autowired
UserService service;
@Autowired
AuthenticationManager authenticationManager;
@PostMapping(path = "/login")
public ResponseEntity<?> login(@RequestBody AuthenticationRequest form) throws Exception {
try {
authenticationManager.authenticate(
new UsernamePasswordAuthenticationToken(form.getEmail(), form.getPassword()));
} catch (Exception e) {
throw new Exception("Incorrect Credentials");
}
final UserDetails user = service.loadUserByUsername(form.getEmail());
Users returnedUser = service.insert(user);
ResponseStructure response = new ResponseStructure(true, returnedUser);
return ResponseEntity.ok(response);
}