Hey there! I am sure that everyone is familiar with using Spring Security. I want to make a quick overview on it to give some high level perspective.
Spring Security is a framework that helps you protect your application and its data. It includes several components that work together to provide authentication and authorization to requests.
Let's start by talking about the Authentication filter. This component delegates the authentication request to the authentication manager and configures the security context based on the response.
What is the authentication manager? The Authentication manager is responsible for using the Authentication provider to process authentication. The Authentication provider implements the authentication logic.
The Authentication interface is responsible for representing the authentication request event and storing details about the entity requesting access to the application. The information related to the authentication request event can be utilized both during and after the authentication process. The user requesting access to the application is commonly referred to as the principal. It is worth noting that in the Java Security API, an interface called Principal represents the same concept as the principal in Spring Security.
Now, let's talk about the user details interfaces. The UserDetails interface describes the user as seen by Spring Security. The UserDetailsService interface is used to retrieve user details by username, and the UserDetailsManager interface extends UserDetailsService and adds behavior related to creating, changing, or deleting a user.
Spring Security provides a few implementations of the UserDetailsManager contract, such as InMemoryUserDetailsManager, JdbcUserDetailsManager, and LdapUserDetailsManager. The JdbcUserDetailsManager has the advantage of directly using JDBC and does not lock the application into other frameworks.
And what is the password encoder? The password encoder helps manage passwords, which the authentication provider uses in the authentication logic.
The security context keeps the authentication data after the authentication process. Think of it like a security officer who keeps track of who is authorized to enter a high-security government facility.
You can use three strategies to manage the security context:
MODE _THREADLOCAL, MODE_INHERITABLETHREADLOCAL, and MODE_GLOBAL.
Access from different threads to the security context details works differently depending on the mode you choose.
Imagine you are trying to enter a high-security government facility. As you approach the gate, you are stopped by a security officer. The security officer is the authentication filter in this scenario, as they are the first line of defense and are responsible for checking your credentials.
The security officer will ask you for your identification, which is the first step in the authentication process. Your identification is checked against a list of authorized personnel, which is similar to the user details service. If your identification matches an authorized person on the list, you will be allowed to proceed to the next stage of the authentication process.
At this stage, you will be asked to provide a password or some other form of authentication, similar to the second stage of the Spring Security authentication process. Once you provide your password, it is hashed and compared to the hashed password stored in the database. The process of hashing and comparing the passwords is similar to the password encoder in Spring Security.
If your password matches the hashed password in the database, you will be granted access to the facility. The security officer will record your identity and keep track of your movements while you are inside the facility. This is similar to the security context in Spring Security, which keeps track of the user's identity and authentication status while they are using the application.
Throughout the entire process, there is an authentication manager overseeing everything and making sure that each stage of the process is completed correctly. The authentication manager is similar to a supervisor in this scenario, ensuring that everything is working smoothly and that security is maintained.
I hope this has provided you with a better overall understanding of Spring Security.