MyEclipse Logo

MyEclipse for Spring 8.6: Spring Security Scaffolding

Add Spring Security to a Spring web application in minutes

Niel Eyde

Copyright © 2010 Skyway Software

Abstract

This tutorial details the steps required to add Spring Security to a Spring MVC web application using MyEclipse for Spring.

Table of Contents

1. Introduction
2. Goal
3. Prerequisites
4. Scaffold Spring Security
5. Review scaffolding
6. Deploy the App
7. Conclusion
8. Additional Developer Resources

1. Introduction

Spring Security provides a set of security services that integrate with Spring-based applications, and MyEclipse for Spring makes it easy to bootstrap an application with Spring Security support. The Scaffold Spring Security wizard is designed to guide you through the bootstrapping process. In addition to selecting a security realm, you can also specify which services and URLs need to be secured.

Spring Security scaffolding options:

  1. Database - using a DB security realm configured to use a scaffolded set of database tables (users and authorities)

  2. LDAP - using LDAP security realm

  3. In-Memory - using an in-memory security realm

The goal of the scaffolding wizard is to get you setup and running on the most commonly used security realms. However Spring Security has support for many more security realms and security options than are supported by the Spring Security wizard. If your application requires one of the supported security realms, then the wizard will do most (if not all) of the bootstrapping and configuration work. If your application requires a security realm this isn't supported by the scaffolding wizard, then the wizard can still help you with basic Spring Security bootstrapping, and the detailed configuration will be left to you to complete.

Scaffolding Note

If the scaffolding wizard doesn't support your desired security realm, select a similar realm that is supported. Once the scaffolding is complete, you can modify the boostrapped configuration (see the security context file) with other configurations. For example, let's say you want to use Open-ID, which isn't supported by scaffolding wizard. Select the In-Memory option from scaffolding wizard, and then you can tweak the security context file with Open-ID support.

2. Goal

This tutorial is going to walk you through using the Scaffold Spring Security wizard to add Spring Security to an existing web application. As a starting point this tutorial will use a previously scaffolded application (see Spring MVC scaffolding tutorial in Tutorials). For this tutorial we're going to use the In-Memory security realm. While it's uncommon to use the in-memory security realm in production applications, it's a great security realm to use during development, because it doesn't require integration with an LDAP system or database system. The in-memory security realm is the quickest way to introduce authentication and authorization, and it can be replaced with a more robust security realm at a later time (i.e. during testing or for production).

3. Prerequisites

The prerequisites needed to complete this tutorial are

4. Scaffold Spring Security

Let's use the Scaffold Spring Security wizard to bootstrap and configure the CustomersApp project

  1. Right-click on the CustomersApp project, and choose MyEclipse > Scaffold Spring Security...

    Scaffold Spring Security Menu

    Figure 1. Scaffold Spring Security Menu


  2. The first wizard panel is an introduction to wizard. Note that the sidebar of all MyEclipse for Spring wizards will have links to relevant online resources. Click the Next button.

    Overview

    Figure 2. Overview


  3. The next step is to select the security type for bootstrapping. As explained earlier the goal is to setup the project to use an in-memory security realm, so select the In Memory option. Click the Next button.

    Select Security Options

    Figure 3. Select Security Options


  4. Next the wizard will scan the project for Spring services (@Service) and DAOs (@Repository), and they will be listed in the Secure Services panel. By default all discovered Spring services and DAOs will be secured upon completion of the wizard, but you have the option of unchecking the items that don't need to be secured and/or changing the access attribute for the service. For this tutorial just stick with the defaults. Click the Next button.

    Secure Services

    Figure 4. Secure Services


  5. The next step is to specify the URLs that should be secured. For this tutorial we're going to just stick with the defaults. Click the Next button.

    Secure URLs

    Figure 5. Secure URLs


  6. The next panel will let you specify the views for Spring Security. This panel is configured by default to use some custom views that will also be generated as part of the wizard. There's nothing that needs to be changed on this panel. Just click the Next button.

    Configured Views

    Figure 6. Configured Views


  7. The last step is to specify the target folders for any generated files. By default the Spring context files will be generated to the /resources folder, and the JSP pages will generated to the web root folder. There's nothing that needs to be changed on this panel. Just click the Next button.

    Select Target Folders

    Figure 7. Select Target Folders


  8. The final wizard panel will summarize the configuration so that you can review it prior to the wizard actually implementing it. Click the Finish button to bootstrap the project according to the information you provided in the wizard.

    Select Web Client

    Figure 8. Select Web Client


That's it. Once the wizard is complete the project project has been bootstrapped and configured with Spring Security.

5. Review scaffolding

  1. If you expand the project, you will see that some new files were added to the project. Two Spring security context files were generated. The first one (CustomerApp-generated-security-context.xml) has the bulk of the Spring Security configuration. Several JSP pages were also generated into the WebRoot folder. The JSP pages contain custom login and logout implementations, which can be customized or rebranded.

    Review

    Figure 9. Review


6. Deploy the App

  1. To deploy the application, right-click on the CustomersApp project and select Run As --> MyEclipse Server Application.

    Run As --> MyEclipse Server Application

    Figure 10. Run As --> MyEclipse Server Application


  2. The first thing you'll notice is that the dashboard page has a Login button, to proactively login into the application. However the application has been configured to automatically direct the end-user to the login when a secured resource is accessed by the end-user. To see how this functions, click on the View Customers button.

    Dashboard

    Figure 11. Dashboard


  3. Since te View Customers page uses a Spring service and DAO that is secured, the end-user is directed to the login page. While Spring Security has a default login page, the application is using a custom login page that was generated by the scaffolding wizard to match the look-and-feel of the scaffolded application. Login in using admin for the user and admin for the password.

    Login

    Figure 12. Login


    Since we're using the in-memory security realm, the user accounts (including username and password) are configured in the security context file (CustomerApp-generated-security-context.xml). You change accounts and their associated roles by editing the context file.

  4. After a successfully login the end-user will be automatically redirected to the original page (protected resource) that they tried to access. You will notice that the header shows a welcome message with the user id and a Logout button.

    Mange

    Figure 13. Mange


7. Conclusion

That's the end of the Spring Security scaffolding tutorial.

What was your experience with this tutorial? Share your experience with us by completing a very brief survey.

8. Additional Developer Resources

Thank you for you interest in MyEclipse for Spring. If you are interested in learning more, the following developer resources are available:

Developer Resources