Skip to content

Commit e77664e

Browse files
author
kmsoln
committed
Merge branch 'springsecurity/docs'
# Conflicts: # docs/en/springsecurity/lab-work.md # docs/en/springsecurity/practice/add-dummy-users.md # docs/en/springsecurity/practice/authorize-server-authenticated.md # docs/en/springsecurity/practice/authorize-server-authority.md # docs/en/springsecurity/practice/authorize-server-role.md # docs/en/springsecurity/practice/base-implementation-user.md # docs/en/springsecurity/practice/configure-spring-security.md # docs/en/springsecurity/practice/configure-thymeleaf-security.md # docs/en/springsecurity/practice/create-identity-to-users.md # docs/en/springsecurity/practice/custom-login-form.md # docs/en/springsecurity/practice/password-encryption.md # docs/en/springsecurity/practice/setup-server-authorization.md # docs/en/springsecurity/tasks.md # docs/ru/springsecurity/lab-work.md
2 parents 5aa99c8 + 364fa8a commit e77664e

15 files changed

Lines changed: 831 additions & 0 deletions

‎docs/en/springsecurity/lab-work.md‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
# Spring Security Lab Work
2+
3+
Welcome to the Spring Security Lab Work! The goal of this series of tasks is to help you practice and get know to Spring Security, and make an enough startup project. Whether you're a beginner or looking to enhance your skills, these hands-on tasks will guide you through various aspects of security integration in a Spring application.
4+
5+
## Goal of the Lab Work
6+
7+
The primary goal of this lab work is to provide you with practical experience and proficiency in using security within a Spring environment. Spring Security is widely utilized for authentication, authorization and securing your project, and through these tasks, you will gain valuable insights into its configuration, authentication, authorization, and more.
8+
9+
## Practice Tasks <a name="practice-tasks"></a>
10+
11+
1. [Task 1: Configure Spring Security](practice/configure-spring-security.md)
12+
2. [Task 2: Create a Base Implementation for User](practice/base-implementation-user.md)
13+
3. [Task 3: Password Encryption](practice/password-encryption.md)
14+
4. [Task 4: Add a Dummy Users](practice/add-dummy-users.md)
15+
5. [Task 5: Create Identity to Users](practice/create-identity-to-users.md)
16+
6. [Task 6: Create a Base for Authorization in Server](practice/setup-server-authorization.md)
17+
7. [Task 7: Authorize Authenticated Users](practice/authorize-server-authenticated.md)
18+
8. [Task 8: Authorize by Role](practice/authorize-server-role.md)
19+
9. [Task 9: Authorize by Authority](practice/authorize-server-authority.md)
20+
10. [Task 10: Configure Thymeleaf Security](practice/configure-thymeleaf-security.md)
21+
11. [Task 11: Authorize Authenticated Users](practice/authorize-client-authenticated.md)
22+
12. [Task 12: Authorize by Role](practice/authorize-client-role.md)
23+
13. [Task 13: Authorize by Authority](practice/authorize-client-authority.md)
24+
14. [Task 14: Custom Login Form](practice/custom-login-form.md)
25+
26+
## Lab Work Tasks <a name="lab-work-tasks"></a>
27+
28+
![img.png](../../srcs/springsecurity/task.png)
29+
30+
### Task 1: Setup Spring Security
31+
Initialize Spring Security in your project.
32+
33+
### Task 2: Define User Roles and Authorities
34+
Define different user roles (Manager, Teacher, Student) and their respective authorities.
35+
36+
### Task 3: Configure Security in Controllers
37+
Protect endpoints using role-based access control.
38+
39+
#### Implementation Details
40+
**Manager Role**:
41+
- Add New Teacher (`/teachers/new`)
42+
- Modify Teacher Profile (`/teachers/{id}/edit`)
43+
- Modify Student Profile (`/students/{id}/edit`)
44+
- Modify Student Marks (`/students/{id}/marks/edit`)
45+
46+
**Teacher Role**:
47+
- Modify Student Marks (`/students/{id}/marks/edit`)
48+
- Add New Subject (`/subjects/new`)
49+
- Add New Test (`/tests/new`)
50+
51+
**Student Role**:
52+
- Pass Test (`/tests/{id}/take`)
53+
- Read Marks (`/students/{id}/marks`)
54+
55+
### Task 4: Implement Authorization in Thymeleaf Templates
56+
57+
Restrict access to UI elements based on user roles.
58+
59+
60+
### Task 5: Test Role-Based Access Control
61+
Ensure that endpoints and UI elements are correctly protected.

‎docs/en/springsecurity/practice/add-dummy-users.md‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
# Add Dummy Users
2+
3+
This task outlines the process of updating the `CustomUserDetailsService` class to include a method for adding dummy users to the in-memory storage to serving as a simple demonstration of user creation.
4+
5+
## Goal
6+
7+
Update the `CustomUserDetailsService` class to include a method for adding dummy users, allowing for the initialization of user data in the in-memory storage.
8+
9+
## Steps
10+
11+
1. **Update CustomUserDetailsService Class:**
12+
13+
First, we need to update the `CustomUserDetailsService` class to include a method for adding dummy users. We'll leverage this method during bean initialization to populate the in-memory storage with dummy user data.
14+
15+
```java
16+
@Service
17+
public class CustomUserDetailsService implements UserDetailsService {
18+
19+
private final UsersRepository usersRepository;
20+
private final PasswordEncoder passwordEncoder;
21+
22+
@Autowired
23+
public CustomUserDetailsService(UsersRepository usersRepository, PasswordEncoder passwordEncoder) {
24+
this.usersRepository = usersRepository;
25+
this.passwordEncoder = passwordEncoder;
26+
27+
// Call the addDummyUsers method to add dummy users during bean initialization
28+
addDummyUsers();
29+
}
30+
31+
@Override
32+
public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
33+
// Retrieve user details from the repository
34+
CustomUserDetails userDetails = usersRepository.findByUsername(username);
35+
if (userDetails == null) {
36+
throw new UsernameNotFoundException("User not found with username: " + username);
37+
}
38+
return userDetails;
39+
}
40+
41+
// Method to add dummy users
42+
private void addDummyUsers() {
43+
// Create dummy users
44+
CustomUserDetails admin = new CustomUserDetails("admin", passwordEncoder.encode("admin"), true, true, true, true);
45+
CustomUserDetails moderator = new CustomUserDetails("moderator", passwordEncoder.encode("moderator"), true, true, true, true);
46+
CustomUserDetails user = new CustomUserDetails("user", passwordEncoder.encode("user"), true, true, true, true);
47+
48+
// Add users to the repository
49+
usersRepository.save(admin);
50+
usersRepository.save(moderator);
51+
usersRepository.save(user);
52+
}
53+
}
54+
```
55+
56+
In this updated class:
57+
- We've added a constructor that accepts `UsersRepository` and `PasswordEncoder` as dependencies.
58+
- During bean initialization, the constructor calls the `addDummyUsers` method to populate the in-memory storage with dummy users.
59+
- The `addDummyUsers` method creates dummy users with hardcoded usernames and passwords.
60+
- Finally, the dummy users are saved to the repository using the `save` method.
61+
62+
---
63+
64+
# [NEXT TASK: Create Identity to Users](create-identity-to-users.md)

‎docs/en/springsecurity/practice/authorize-server-authenticated.md‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
# Authorize Authenticated User
2+
3+
This task outlines the process of authorizing authenticated users in your application. By requiring authentication for specific paths or endpoints, you can ensure that only logged-in users can access certain resources.
4+
5+
## Goal
6+
7+
Authorize access to the `/second` path only for authenticated users while allowing public access to other paths.
8+
9+
## Steps
10+
11+
1. **Update Security Configuration:**
12+
13+
In the `WebSecurityConfig` class, modify the `configure(HttpSecurity http)` method to specify that access to the `/second` path should be restricted to authenticated users.
14+
15+
```java
16+
@Configuration
17+
@EnableWebSecurity
18+
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
19+
20+
@Override
21+
protected void configure(HttpSecurity http) throws Exception {
22+
http
23+
.authorizeHttpRequests((requests) -> requests
24+
// Other endpoints...
25+
.requestMatchers("/second").authenticated()
26+
// Other endpoints...
27+
);
28+
}
29+
}
30+
```
31+
32+
In this configuration:
33+
- We use `.authorizeHttpRequests()` to define authorization rules.
34+
- The `.requestMatchers("/second").authenticated()` statement specifies that access to the `/second` path should be restricted to authenticated users.
35+
36+
---
37+
38+
# [NEXT TASK: Authorize by Role](authorize-server-role.md)

‎docs/en/springsecurity/practice/authorize-server-authority.md‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
# Authorize by Authority
2+
3+
This task outlines the process of authorizing users based on their authorities in your application. By assigning different authorities to users, you can control access to specific functionalities or actions.
4+
5+
## Goal
6+
7+
Authorize access to the `/addStudent` path for users with the `WRITE` authority and the `/removeStudent` path for users with the `DELETE` authority.
8+
9+
## Steps
10+
11+
1. **Update Security Configuration:**
12+
13+
In the `WebSecurityConfig` class, modify the `configure(HttpSecurity http)` method to specify authority-based access control for the `/addStudent` and `/removeStudent` paths.
14+
15+
```java
16+
@Configuration
17+
@EnableWebSecurity
18+
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
19+
20+
@Override
21+
protected void configure(HttpSecurity http) throws Exception {
22+
http
23+
.authorizeHttpRequests((requests) -> requests
24+
// Other Endpoints...
25+
.requestMatchers("/addStudent").hasAuthority("WRITE")
26+
.requestMatchers("/removeStudent").hasAuthority("DELETE")
27+
// Other Endpoints...
28+
);
29+
}
30+
}
31+
```
32+
33+
In this configuration:
34+
- The `.requestMatchers("/addStudent").hasAuthority("WRITE")` statement specifies that access to the `/addStudent` path should be restricted to users with the `WRITE` authority.
35+
- Similarly, `.requestMatchers("/removeStudent").hasAuthority("DELETE")` restricts access to the `/removeStudent` path to users with the `DELETE` authority.
36+
37+
---
38+
39+
# [NEXT TASK: Custom Login Form](custom-login-form.md)

‎docs/en/springsecurity/practice/authorize-server-role.md‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
# Authorize by Role
2+
3+
This task outlines the process of authorizing users based on their roles in your application. By assigning different roles to users, you can control access to specific resources or functionalities.
4+
5+
## Goal
6+
7+
Authorize access to the `/third` path for users with the `ROLE_MODERATOR` role and the `/fourth` path for users with the `ROLE_ADMIN` role.
8+
9+
## Steps
10+
11+
1. **Update Security Configuration:**
12+
13+
In the `WebSecurityConfig` class, modify the `configure(HttpSecurity http)` method to specify role-based access control for the `/third` and `/fourth` paths.
14+
15+
```java
16+
@Configuration
17+
@EnableWebSecurity
18+
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
19+
20+
@Override
21+
protected void configure(HttpSecurity http) throws Exception {
22+
http
23+
.authorizeHttpRequests((requests) -> requests
24+
// Other Endpoints...
25+
.requestMatchers("/third").hasAuthority("ROLE_MODERATOR")
26+
.requestMatchers("/fourth").hasAuthority("ROLE_ADMIN")
27+
// Other Endpoints...
28+
);
29+
}
30+
}
31+
```
32+
33+
In this configuration:
34+
- The `.requestMatchers("/third").hasAuthority("ROLE_MODERATOR")` statement specifies that access to the `/third` path should be restricted to users with the `ROLE_MODERATOR` authority.
35+
- Similarly, `.requestMatchers("/fourth").hasAuthority("ROLE_ADMIN")` restricts access to the `/fourth` path to users with the `ROLE_ADMIN` authority.
36+
37+
---
38+
39+
# [NEXT TASK: Authorize by Authority](authorize-server-authority.md)

0 commit comments

Comments
 (0)