Java – spring: add custom user details to spring security users

I am currently developing a spring MVC application. I need to add a custom field to my spring security login user when logging in (I insert user name, password and custom value)

I've read a lot about custom user classes and custom services, but I can't really find a solution to the problem

Any help would be great!

Solution

As Avinash said, you can let your user class implement userdetails, or you can implement userdetailsservice and override the corresponding methods to return custom user objects:

@Service("userDetailsService")
public class MyUserDetailsService implements UserDetailsService {

    //get user from the database,via Hibernate
    @Autowired
    private UserDao userDao;

    @Transactional(readOnly=true)
    @Override
    public UserDetails loadUserByUsername(final String username)
        throws UsernameNotFoundException {
//CUSTOM USER HERE vvv
        User user = userDao.findByUserName(username);
        List<GrantedAuthority> authorities =
                                      buildUserAuthority(user.getUserRole());
//if you're implementing UserDetails you wouldn't need to call this method and instead return the User as it is
        //return buildUserForAuthentication(user,authorities);
return user;

    }

    // Converts user to spring.springframework.security.core.userdetails.User
    private User buildUserForAuthentication(user,List<GrantedAuthority> authorities) {
        return new User(user.getUsername(),user.getpassword(),user.isEnabled(),true,authorities);
    }

    private List<GrantedAuthority> buildUserAuthority(Set<UserRole> userRoles) {

        Set<GrantedAuthority> setAuths = new HashSet<GrantedAuthority>();

        // add user's authorities
        for (UserRole userRole : userRoles) {
            setAuths.add(new SimpleGrantedAuthority(userRole.getRole()));
        }

        List<GrantedAuthority> Result = new ArrayList<GrantedAuthority>(setAuths);

        return Result;
    }

}

You only need to configure the webconfigueradapter using the custom userdetailsservice:

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {
@Autowired
@Qualifier("userDetailsService")
UserDetailsService userDetailsService;

@Autowired
public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
    auth.userDetailsService(userDetailsService).passwordEncoder(passwordEncoder());
}

@Override
protected void configure(HttpSecurity http) throws Exception {

    //authorization logic here ...
}

    @Bean
    public PasswordEncoder passwordEncoder(){
        // return preferred PasswordEncoder ...//
    }


}

This is an example of a custom userdetails implementation: Custom userdetails