Spring boot login page with org_name, username and password

user_15291706 0
Viewed 168

I am trying to create a login mechanism where in the login page I accept these 3 fields- org_name, username, password.

While I have successfully been able to login using just the username and password combination, I need to check the combination of org_name & username, which is like a unique key in the users table.

I have explored Spring-boot's JDBC authentication, JPA authentication but just couldn't get it right.

For JDBC authentication based custom query, I am not able to fetch the 'org_name' parameter to be passed in the custom query.

P.S.: I am new to Springboot framework, so excuse me if the question is too noob. But I kinda need urget help on this.

spring-boot spring-security java
2 Answers

Add the following dependency to the pom.xml

<dependency>
  <groupId>org.springframework.boot</groupId>
  <artifactId>spring-boot-starter-security</artifactId>
</dependency>
<dependency>
  <groupId>org.springframework.security</groupId>
  <artifactId>spring-security-test</artifactId>
  <scope>test</scope>
</dependency>

Then set up a WebSecurityConfig.java class

package com.example.securingweb;

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.provisioning.InMemoryUserDetailsManager;

@Configuration
@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
            .authorizeRequests()
                .antMatchers("/", "/home").permitAll()
                .anyRequest().authenticated()
                .and()
            .formLogin()
                .loginPage("/login")
                .permitAll()
                .and()
            .logout()
                .permitAll();
    }

    @Bean
    @Override
    public UserDetailsService userDetailsService() {
        UserDetails user =
             User.withDefaultPasswordEncoder()
                .username("user")
                .password("password")
                .roles("USER")
                .build();

        return new InMemoryUserDetailsManager(user);
    }
}

This was the general code I used while learning the spring security. Thank you

user_135060010

I guess you need to do a little more work here. for username/password based authentication spring security use UsernamePasswordAuthenticationFilter. so you have to extend this filter and override the attemptAuthentication method where you will have access to the http request object.here you will have access to your extra 'org_name' parameter. then you need to implement the 'Authentication' interface where you will put your extra parameter. then from attemptAuthentication method you need to return an instance of your custom authentication object. you also need to provide your own authentication provider which will use this authentication object to authenticate the user.

user_24194990
Related