Spring Security is a framework for authentication and authorization in Java applications. It provides components for authentication filters, providers, and managers as well as user details services. Basic authentication uses HTTP basic auth with a username and password encoded in the request header. Form authentication displays a login form and uses CSRF protection. Custom authentication allows multiple auth types by implementing custom auth providers, users, grants, and handlers. The documentation covers getting started, architecture, basic auth, form auth, and custom auth configurations and demos.

1. Spring Security - getting started

2. Manish Sharma

3. Agenda
• Getting Started
• Spring Security Architecture
• Basic Auth
• Configuration / Demo / Pros - Cons
• Form Auth
• Configuration / Demo / Pros - Cons
• Custom Auth
• Configuration walkthrough and Demo

4. Getting Started
• Add Maven or Gradle dependencies.
compile('org.springframework.boot:spring-boot-starter-security')

5. Getting Started
• Filter Chain in Spring Boot app.
• Filter Chain in Spring Boot App with Spring Security.

7. Deep inside DelegatingFilterProxy

8. Spring Security Components• Authentication Filter : e.g :UsernamePasswordAuthenticationFilter or
BasicAuthenticationFilter
• Authentication : to represent the principal in a Spring Security-specific manner.
• Authentication Provider
• Authentication Manager
• UserDetailsService, to create a UserDetails when passed in a String-based username
• UserDetails, to provide the necessary information to build an Authentication object from
your application's DAOs or other source source of security data.
• SecurityContextHolder, to provide access to the SecurityContext, default in
ThreadLocal.
• SecurityContext, to hold the Authentication and possibly request-specific security
information.
• GrantedAuthority, to reflect the application-wide permissions granted to a principal.

10. Http Basic Authentication
• Something of lowest common denominator.
• Support on practically all servers natively
and out of the box.
• ubiquitous support on the client side in all
languages.
• curl --header "Authorization: Basic dXNlcjp3b3JkcGFzcw=="
http://localhost:8080/admin
• dXNlcjp3b3JkcGFzcw== user:wordpass

11. Basic Auth Demo and Cons

12. Preflight request
• https://developer.mozilla.org/en-
US/docs/Glossary/Preflight_request

13. Form Based Authentication
• CSRF protection
• Form Based Auth Demo

14. Custom Authentication
• More than one authentication.
• Custom Authentication provider, User,
Grants, UserDetailsService,
AccessDeniedHandler.
• Used of password encoder.

16. Useful configs out of the box
• BCryptPasswordEncoder.
• Max number of concurrent sessions.
• JDBC Authentication.
• Configure filter.

17. Spring Security Part -2
• Securing Microservices.
• Token based Authentication
• OAuth
• OpenId

18. Questions???

19. Thank You!!