Spring MVC security with In-Memory authentication example using XML configuration

STEP 1:- Open Eclipse and Create Dynamic Web Project named SpringSecurityBasicXMLConfig.

STEP 2:- Make sure you use Target Runtime as Apache Tomcat 7.0. 

STEP 3:- copy below jars to WEB-INF/lib folder.

• commons-logging-1.2.jar
• spring-aop-4.1.4.RELEASE.jar
• spring-beans-4.1.4.RELEASE.jar
• spring-context-4.1.4.RELEASE.jar
• spring-core-4.1.4.RELEASE.jar
• spring-expression-4.1.4.RELEASE.jar
• spring-security-config-4.0.2.RELEASE.jar
• spring-security-core-4.0.2.RELEASE.jar
• spring-security-web-4.0.2.RELEASE.jar
• spring-web-4.1.4.RELEASE.jar
• spring-webmvc-4.1.4.RELEASE.jar

STEP 4:- Create Spring Configuration Bean file. /WebContent/WEB-INF/dispatcher-servlet.xml

<beans xmlns="http://www.springframework.org/schema/beans"
 xmlns:mvc="http://www.springframework.org/schema/mvc" 
 xmlns:context="http://www.springframework.org/schema/context"
 xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
 xsi:schemaLocation="
 http://www.springframework.org/schema/beans 
 http://www.springframework.org/schema/beans/spring-beans.xsd
 http://www.springframework.org/schema/mvc 
 http://www.springframework.org/schema/mvc/spring-mvc.xsd
 http://www.springframework.org/schema/context 
 http://www.springframework.org/schema/context/spring-context.xsd">
 
 <context:component-scan base-package="com.tutorialsdesk.controller" />
 
 <bean id="viewResolver"
class="org.springframework.web.servlet.view.UrlBasedViewResolver">
 <property name="viewClass"
value="org.springframework.web.servlet.view.JstlView" />
 <property name="prefix" value="/WEB-INF/views/" />
 <property name="suffix" value=".jsp" />
 </bean>
 
 <mvc:annotation-driven/>
 
</beans>

STEP 5:- Create Spring security configuration file. /WebContent/WEB-INF/spring-security.xml

<beans:beans xmlns="http://www.springframework.org/schema/security"
 xmlns:beans="http://www.springframework.org/schema/beans"
 xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
 xsi:schemaLocation="http://www.springframework.org/schema/beans 
 http://www.springframework.org/schema/beans/spring-beans.xsd
 http://www.springframework.org/schema/security 
 http://www.springframework.org/schema/security/spring-security.xsd">
 
 <http auto-config="true" >
 <intercept-url pattern="/" access="permitAll" />
 <intercept-url pattern="/home" access="permitAll" />
 <intercept-url pattern="/admin**"
access="hasRole('ADMIN')" />
 <intercept-url pattern="/api**" access="hasRole('ADMIN')
or hasRole('API')" />
 <access-denied-handler error-page="/Access_Denied" />
 <form-login />
 </http>
 
 <authentication-manager >
 <authentication-provider>
 <user-service>
 <user name="user" password="123456"
authorities="ROLE_USER" />
 <user name="admin" password="123456"
authorities="ROLE_ADMIN,ROLE_API" />
 <user name="apiuser" password="123456"
authorities="ROLE_API" />
 </user-service>
 </authentication-provider>
 </authentication-manager>
</beans:beans>

STEP 6 :- Map Spring configuration files in /WebContent/WEB-INF/web.xml file as below :-

<?xml version="1.0" encoding="UTF-8"?>
<web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
 xmlns="http://java.sun.com/xml/ns/javaee" 
 xsi:schemaLocation="http://java.sun.com/xml/ns/javaee
http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd" 
 version="3.0">
 
 <display-name>SpringSecurityBasicXMLConfig</display-name>
 
 <servlet>
 <servlet-name>dispatcher</servlet-name>
 <servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
 <load-on-startup>1</load-on-startup>
 </servlet>
 
 <servlet-mapping>
 <servlet-name>dispatcher</servlet-name>
 <url-pattern>/</url-pattern>
 </servlet-mapping>
 
 <context-param>
 <param-name>contextConfigLocation</param-name>
 <param-value>/WEB-INF/spring-security.xml</param-value>
 </context-param>
 
 <listener>
 <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
 </listener>
 
 <filter>
 <filter-name>springSecurityFilterChain</filter-name>
 <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
 </filter>
 
 <filter-mapping>
 <filter-name>springSecurityFilterChain</filter-name>
 <url-pattern>/*</url-pattern>
 </filter-mapping>
 
</web-app>

STEP 7 :- Create Controller Class.

• Package: com.tutorialsdesk.controller
• Filename: HelloWorldController.java

package com.tutorialsdesk.controller;

import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.stereotype.Controller;
import org.springframework.ui.ModelMap;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RequestMethod;

@Controller
public class HelloWorldController {

 @RequestMapping(value = { "/", "/home" }, method =
RequestMethod.GET)
 public String homePage(ModelMap model) {
 model.addAttribute("greeting", "Hi, Welcome to mysite. ");
 return "welcome";
 }
 
 @RequestMapping(value = "/admin", method = RequestMethod.GET)
 public String adminPage(ModelMap model) {
 model.addAttribute("user", getPrincipal());
 return "admin";
 }
 
 @RequestMapping(value = "/api", method = RequestMethod.GET)
 public String dbaPage(ModelMap model) {
 model.addAttribute("user", getPrincipal());
 return "api";
 }
 
 @RequestMapping(value = "/Access_Denied", method = RequestMethod.GET)
 public String accessDeniedPage(ModelMap model) {
 model.addAttribute("user", getPrincipal());
 return "accessDenied";
 }
 
 private String getPrincipal(){
 String userName = null;
 Object principal =
SecurityContextHolder.getContext().getAuthentication().getPrincipal(); 
 
 if (principal instanceof UserDetails) {
 userName = ((UserDetails)principal).getUsername();
 } else {
 userName = principal.toString();
 
 }
 return userName;
 }
}

STEP 8 :- Create jsp files in /WebContent/WEB-INF/views folder

• Filename: welcome.jsp

<%@ page language="java" contentType="text/html;
charset=ISO-8859-1" pageEncoding="ISO-8859-1"%>
<%@ taglib prefix="c"
uri="http://java.sun.com/jsp/jstl/core"%>
<html>
<head>
 <meta http-equiv="Content-Type" content="text/html;
charset=ISO-8859-1">
 <title>HelloWorld page</title>
</head>
<body>
 Greeting : ${greeting}
 This is a welcome page.
 <br/>
 <br/>
 <br/>
<a href="<c:url value="/admin" />">Admin
Page</a> ( Only Admin user can access this )
<br/>
<br/>
<a href="<c:url value="/api" />">API Page</a>
( Admin or API user can access this )

</body>
</html>

• Filename: admin.jsp

<%@ page language="java" contentType="text/html;
charset=ISO-8859-1" pageEncoding="ISO-8859-1"%>
<%@ taglib prefix="c"
uri="http://java.sun.com/jsp/jstl/core"%>
<html>
<head>
 <meta http-equiv="Content-Type" content="text/html;
charset=ISO-8859-1">
 <title>HelloWorld Admin page</title>
</head>
<body>
 Dear <strong>${user}</strong>, Welcome to Admin Page.
 
 
<form action="logout" method="post">
 <input type="submit" value="Logout" />
 <input type="hidden" name="${_csrf.parameterName}"
value="${_csrf.token}"/>
</form>
</body>
</html>

• Filename: api.jsp

<%@ page language="java" contentType="text/html;
charset=ISO-8859-1" pageEncoding="ISO-8859-1"%>
<%@ taglib prefix="c"
uri="http://java.sun.com/jsp/jstl/core"%>
<html>
<head>
 <meta http-equiv="Content-Type" content="text/html;
charset=ISO-8859-1">
 <title>DBA page</title>
</head>
<body>
 Dear <strong>${user}</strong>, Welcome to API Page.
 
 <form action="logout" method="post">
 <input type="submit" value="Logout" />
 <input type="hidden" name="${_csrf.parameterName}"
value="${_csrf.token}"/>
</form>
</body>
</html>

• Filename: accessDenied.jsp

<%@ page language="java" contentType="text/html;
charset=ISO-8859-1" pageEncoding="ISO-8859-1"%>
<%@ taglib prefix="c"
uri="http://java.sun.com/jsp/jstl/core"%>
<html>
<head>
 <meta http-equiv="Content-Type" content="text/html;
charset=ISO-8859-1">
 <title>AccessDenied page</title>
</head>
<body>
 Dear <strong>${user}</strong>, You are not authorized to access this page
 <form action="logout" method="post">
 <input type="submit" value="Logout" />
 <input type="hidden" name="${_csrf.parameterName}"
value="${_csrf.token}"/>
</form>
 
</body>
</html>

STEP 9 :- Run your project enter below URL in your browser

http://localhost:8080/SpringSecurityBasicXMLConfig/

Keep visiting TutorialsDesk for more tutorials and practical programming examples on Spring MVC.

Hope we are able to explain you Spring MVC security with In-Memory authentication example using XML configuration Example, if you have any questions or suggestions please write to us using contact us form. 

Please share us on social media if you like the tutorial.

SHARE