SlideShare a Scribd company logo
Spring Security - getting started
Manish Sharma
Agenda
• Getting Started
• Spring Security Architecture
• Basic Auth
• Configuration / Demo / Pros - Cons
• Form Auth
• Configuration / Demo / Pros - Cons
• Custom Auth
• Configuration walkthrough and Demo
Getting Started
• Add Maven or Gradle dependencies.
compile('org.springframework.boot:spring-boot-starter-security')
Getting Started
• Filter Chain in Spring Boot app.
• Filter Chain in Spring Boot App with Spring Security.
Spring Security
Deep inside DelegatingFilterProxy
Spring Security Components• Authentication Filter : e.g :UsernamePasswordAuthenticationFilter or
BasicAuthenticationFilter
• Authentication : to represent the principal in a Spring Security-specific manner.
• Authentication Provider
• Authentication Manager
• UserDetailsService, to create a UserDetails when passed in a String-based username
• UserDetails, to provide the necessary information to build an Authentication object from
your application's DAOs or other source source of security data.
• SecurityContextHolder, to provide access to the SecurityContext, default in
ThreadLocal.
• SecurityContext, to hold the Authentication and possibly request-specific security
information.
• GrantedAuthority, to reflect the application-wide permissions granted to a principal.
Spring Security
Http Basic Authentication
• Something of lowest common denominator.
• Support on practically all servers natively
and out of the box.
• ubiquitous support on the client side in all
languages.
• curl --header "Authorization: Basic dXNlcjp3b3JkcGFzcw=="
http://localhost:8080/admin
• dXNlcjp3b3JkcGFzcw== user:wordpass
Basic Auth Demo and Cons
Preflight request
• https://developer.mozilla.org/en-
US/docs/Glossary/Preflight_request
Form Based Authentication
• CSRF protection
• Form Based Auth Demo
Custom Authentication
• More than one authentication.
• Custom Authentication provider, User,
Grants, UserDetailsService,
AccessDeniedHandler.
• Used of password encoder.
Spring Security
Useful configs out of the box
• BCryptPasswordEncoder.
• Max number of concurrent sessions.
• JDBC Authentication.
• Configure filter.
Spring Security Part -2
• Securing Microservices.
• Token based Authentication
• OAuth
• OpenId
Questions???
Thank You!!

More Related Content

PPTX
Spring Security 3
PPTX
Spring security
PDF
Spring Framework - Spring Security
PDF
Spring Security
PPT
Spring Security Introduction
PPTX
Spring Security
PDF
Fun With Spring Security
PPTX
Spring security
Spring Security 3
Spring security
Spring Framework - Spring Security
Spring Security
Spring Security Introduction
Spring Security
Fun With Spring Security
Spring security

What's hot (20)

PPTX
Spring Security 5
PDF
J2EE Security with Apache SHIRO
PPTX
Building Layers of Defense with Spring Security
PPTX
Learn Apache Shiro
PDF
From 0 to Spring Security 4.0
PDF
Enterprise Security mit Spring Security
PPTX
Octopus framework; Permission based security framework for Java EE
PPTX
ApacheCon 2014: Infinite Session Clustering with Apache Shiro & Cassandra
PPTX
API Security & Federation Patterns - Francois Lascelles, Chief Architect, Lay...
PDF
Javacro 2014 Spring Security 3 Speech
PPTX
Security asp.net application
PDF
Super simple application security with Apache Shiro
PDF
Java EE Application Security With PicketLink
PDF
Peeples authentication authorization_services_with_saml_xacml_with_jboss_eap6
PPTX
Java Security Framework's
PPTX
ASP.NET Web Security
PPTX
Token Authentication in ASP.NET Core
PPTX
REST API Security: OAuth 2.0, JWTs, and More!
PPTX
Intro to Apache Shiro
PPTX
Secure API Services in Node with Basic Auth and OAuth2
Spring Security 5
J2EE Security with Apache SHIRO
Building Layers of Defense with Spring Security
Learn Apache Shiro
From 0 to Spring Security 4.0
Enterprise Security mit Spring Security
Octopus framework; Permission based security framework for Java EE
ApacheCon 2014: Infinite Session Clustering with Apache Shiro & Cassandra
API Security & Federation Patterns - Francois Lascelles, Chief Architect, Lay...
Javacro 2014 Spring Security 3 Speech
Security asp.net application
Super simple application security with Apache Shiro
Java EE Application Security With PicketLink
Peeples authentication authorization_services_with_saml_xacml_with_jboss_eap6
Java Security Framework's
ASP.NET Web Security
Token Authentication in ASP.NET Core
REST API Security: OAuth 2.0, JWTs, and More!
Intro to Apache Shiro
Secure API Services in Node with Basic Auth and OAuth2
Ad

Viewers also liked (12)

PPTX
Spring security
PDF
Дикие микросервисы на JUG Екатеринбург
PDF
What's New in spring-security-core 2.0
PDF
Java security in the real world (Ryan Sciampacone)
PDF
Java Security Manager Reloaded - Devoxx 2014
PPTX
Rest with Java EE 6 , Security , Backbone.js
PPTX
Power point aplicacion interactiva-uch
PDF
Náquinas 3léctricas y transf0rmad0res lrving 1. k0sow - 2 ed
PPT
Winning Strategy adopted in Mahabhrata Epic
PPTX
Wed 2
PDF
My Five Minutes Bell!!
PPTX
Security Architecture of the Java Platform (BG OUG, Plovdiv, 13.06.2015)
Spring security
Дикие микросервисы на JUG Екатеринбург
What's New in spring-security-core 2.0
Java security in the real world (Ryan Sciampacone)
Java Security Manager Reloaded - Devoxx 2014
Rest with Java EE 6 , Security , Backbone.js
Power point aplicacion interactiva-uch
Náquinas 3léctricas y transf0rmad0res lrving 1. k0sow - 2 ed
Winning Strategy adopted in Mahabhrata Epic
Wed 2
My Five Minutes Bell!!
Security Architecture of the Java Platform (BG OUG, Plovdiv, 13.06.2015)
Ad

Similar to Spring Security (20)

PDF
Spring security jwt tutorial toptal
PDF
Spring Security
PDF
Getting started with Spring Security
PDF
Spring security4.x
PDF
Building layers of defense for your application
PDF
Spring Security in Action 1st Edition Laurentiu Spilca Spilcă Laurenţiu
PPTX
springb security.pptxdsdsgfdsgsdgsdgsdgdsgdsgds
PPTX
Spring Security: Deep dive into basics. Ihor Polataiko.pptx
PPTX
Spring Security Framework
PDF
Spring Security in Action 1st Edition Laurentiu Spilca
PPTX
Spring security 3
PPTX
Spring Security services for web applications
PDF
Spring4 security
PDF
Spring Security 5.5 From Taxi to Takeoff
PDF
Java Web Application Security with Java EE, Spring Security and Apache Shiro ...
PDF
JavaCro'14 - Securing web applications with Spring Security 3 – Fernando Redo...
PDF
Spring5 hibernate5 security5 lab step by step
PPTX
Iasi code camp 20 april 2013 windows authentication-spring security -kerberos
PPTX
Comprehensive_SpringBoot_Auth.pptx wokring
PDF
Lesson07-UsernamePasswordAuthenticationFilter.pdf
Spring security jwt tutorial toptal
Spring Security
Getting started with Spring Security
Spring security4.x
Building layers of defense for your application
Spring Security in Action 1st Edition Laurentiu Spilca Spilcă Laurenţiu
springb security.pptxdsdsgfdsgsdgsdgsdgdsgdsgds
Spring Security: Deep dive into basics. Ihor Polataiko.pptx
Spring Security Framework
Spring Security in Action 1st Edition Laurentiu Spilca
Spring security 3
Spring Security services for web applications
Spring4 security
Spring Security 5.5 From Taxi to Takeoff
Java Web Application Security with Java EE, Spring Security and Apache Shiro ...
JavaCro'14 - Securing web applications with Spring Security 3 – Fernando Redo...
Spring5 hibernate5 security5 lab step by step
Iasi code camp 20 april 2013 windows authentication-spring security -kerberos
Comprehensive_SpringBoot_Auth.pptx wokring
Lesson07-UsernamePasswordAuthenticationFilter.pdf

Recently uploaded (20)

PDF
Microsoft Solutions Partner Drive Digital Transformation with D365.pdf
PDF
A comparative study of natural language inference in Swahili using monolingua...
PDF
A Late Bloomer's Guide to GenAI: Ethics, Bias, and Effective Prompting - Boha...
PDF
CloudStack 4.21: First Look Webinar slides
DOCX
search engine optimization ppt fir known well about this
PDF
Unlock new opportunities with location data.pdf
PDF
How ambidextrous entrepreneurial leaders react to the artificial intelligence...
PDF
Hybrid horned lizard optimization algorithm-aquila optimizer for DC motor
PDF
Taming the Chaos: How to Turn Unstructured Data into Decisions
PPTX
Modernising the Digital Integration Hub
PDF
1 - Historical Antecedents, Social Consideration.pdf
PDF
Architecture types and enterprise applications.pdf
PDF
DP Operators-handbook-extract for the Mautical Institute
PPTX
Web Crawler for Trend Tracking Gen Z Insights.pptx
PDF
Enhancing emotion recognition model for a student engagement use case through...
PDF
Assigned Numbers - 2025 - Bluetooth® Document
PDF
Univ-Connecticut-ChatGPT-Presentaion.pdf
PDF
August Patch Tuesday
PDF
Developing a website for English-speaking practice to English as a foreign la...
PPT
What is a Computer? Input Devices /output devices
Microsoft Solutions Partner Drive Digital Transformation with D365.pdf
A comparative study of natural language inference in Swahili using monolingua...
A Late Bloomer's Guide to GenAI: Ethics, Bias, and Effective Prompting - Boha...
CloudStack 4.21: First Look Webinar slides
search engine optimization ppt fir known well about this
Unlock new opportunities with location data.pdf
How ambidextrous entrepreneurial leaders react to the artificial intelligence...
Hybrid horned lizard optimization algorithm-aquila optimizer for DC motor
Taming the Chaos: How to Turn Unstructured Data into Decisions
Modernising the Digital Integration Hub
1 - Historical Antecedents, Social Consideration.pdf
Architecture types and enterprise applications.pdf
DP Operators-handbook-extract for the Mautical Institute
Web Crawler for Trend Tracking Gen Z Insights.pptx
Enhancing emotion recognition model for a student engagement use case through...
Assigned Numbers - 2025 - Bluetooth® Document
Univ-Connecticut-ChatGPT-Presentaion.pdf
August Patch Tuesday
Developing a website for English-speaking practice to English as a foreign la...
What is a Computer? Input Devices /output devices

Spring Security

  • 1. Spring Security - getting started
  • 3. Agenda • Getting Started • Spring Security Architecture • Basic Auth • Configuration / Demo / Pros - Cons • Form Auth • Configuration / Demo / Pros - Cons • Custom Auth • Configuration walkthrough and Demo
  • 4. Getting Started • Add Maven or Gradle dependencies. compile('org.springframework.boot:spring-boot-starter-security')
  • 5. Getting Started • Filter Chain in Spring Boot app. • Filter Chain in Spring Boot App with Spring Security.
  • 8. Spring Security Components• Authentication Filter : e.g :UsernamePasswordAuthenticationFilter or BasicAuthenticationFilter • Authentication : to represent the principal in a Spring Security-specific manner. • Authentication Provider • Authentication Manager • UserDetailsService, to create a UserDetails when passed in a String-based username • UserDetails, to provide the necessary information to build an Authentication object from your application's DAOs or other source source of security data. • SecurityContextHolder, to provide access to the SecurityContext, default in ThreadLocal. • SecurityContext, to hold the Authentication and possibly request-specific security information. • GrantedAuthority, to reflect the application-wide permissions granted to a principal.
  • 10. Http Basic Authentication • Something of lowest common denominator. • Support on practically all servers natively and out of the box. • ubiquitous support on the client side in all languages. • curl --header "Authorization: Basic dXNlcjp3b3JkcGFzcw==" http://localhost:8080/admin • dXNlcjp3b3JkcGFzcw== user:wordpass
  • 11. Basic Auth Demo and Cons
  • 13. Form Based Authentication • CSRF protection • Form Based Auth Demo
  • 14. Custom Authentication • More than one authentication. • Custom Authentication provider, User, Grants, UserDetailsService, AccessDeniedHandler. • Used of password encoder.
  • 16. Useful configs out of the box • BCryptPasswordEncoder. • Max number of concurrent sessions. • JDBC Authentication. • Configure filter.
  • 17. Spring Security Part -2 • Securing Microservices. • Token based Authentication • OAuth • OpenId

Editor's Notes

  • #12: Always send password with request. Not secure. No standard logout mechanism.