การใช้งาน UserDetailsService แบบกำหนดเอง

In previous lessons, you might have used in-memory users for simple authentication. This means usernames and passwords are hardcoded directly in your application's configuration.

While easy for testing, real-world applications need to load user data from a persistent source like a database, LDAP, or another service. This is where a custom UserDetailsService comes in!

Spring Security uses the UserDetailsService interface to retrieve user-specific data during authentication. It has just one method you need to implement:

• UserDetails loadUserByUsername(String username)

This method is crucial. When a user tries to log in, Spring Security calls this method, passing the username provided by the user.

The loadUserByUsername method must return a UserDetails object. This interface represents the authenticated user's information, including:

• Username
• Password
• Authorities (roles/permissions)
• Account status (e.g., enabled, locked, expired)

Spring Security provides a default implementation called org.springframework.security.core.userdetails.User that you'll often use.

To create a custom user service, you simply create a class that implements UserDetailsService. Inside, you'll override the loadUserByUsername method.

This method is where you'll write the logic to fetch user data from your chosen data store. For now, we'll use some hardcoded examples.

Inside loadUserByUsername, you'll perform these steps:

1. Receive the username.
2. Look up the user in your data source.
3. If found, create a UserDetails object with their details (username, password, roles).
4. If not found, throw a UsernameNotFoundException.

Remember, password encoding is vital for security, but we'll cover that in a later lesson. For now, we'll use a plain text password prefix: {noop}.

Let's see a simple implementation. This example hardcodes users, simulating fetching from a data source. Run it to see how it works!

Notice in the example, we used .roles("USER") and .roles("ADMIN", "USER").

• Roles are high-level permissions, like 'ADMIN' or 'USER'.
• These roles are converted into GrantedAuthority objects by Spring Security.
• When building the UserDetails object, you specify the roles/authorities the user possesses.

These authorities are later used by Spring Security for authorization (determining what a user can access).

Once you've created your custom UserDetailsService, Spring Security needs to know about it. In a Spring Boot application, you typically register it as a Spring bean.

By simply defining your custom service as a @Bean, Spring Security's auto-configuration will usually pick it up and use it for authentication.

Here's how custom authentication typically works with your service:

1. User submits login credentials (username, password).
2. Spring Security receives the request.
3. It calls your custom UserDetailsService's loadUserByUsername() method with the provided username.
4. Your method fetches user data and returns a UserDetails object.
5. Spring Security then compares the provided password with the password from UserDetails (after encoding/decoding).
6. If they match, authentication succeeds!

Consider the core purpose and components of implementing a custom UserDetailsService.

You've learned how to implement a custom UserDetailsService, a fundamental component for advanced user authentication in Spring Security:

• It allows loading user data from any source.
• You implement the loadUserByUsername method.
• This method returns a UserDetails object, containing user credentials and authorities.
• It's essential for moving beyond in-memory user management.

Next, we'll dive into securing those passwords with proper encoding!