Role based in memory authentication without password in Spring Boot Security - spring-security

Question

I am trying to authorize URLs to users with authority like ADMIN/LEAD/AGENT.
UsernamePasswordAuthenticationToken takes two arguments but I would like to pass 3 args userid , password as null and role of userid.
I have application-users.txt
{
"users": ["userid1","userid2","userid3","userid4"],
"agents": ["userid1"],
"leads": ["userid2"],
"admins": ["userid4"]
}
#Configuration
#EnableGlobalMethodSecurity(securedEnabled = true)
#EnableWebSecurity
#ConditionalOnWebApplication
#ConfigurationPropertiesScan("com.spectrum.sci.config")
#EnableConfigurationProperties(ApplicationClients.class)
#RequiredArgsConstructor
public class SecurityConfiguration extends WebSecurityConfigurerAdapter{
private static final Logger log = LoggerFactory.getLogger(SecurityConfiguration.class);
#Autowired
OrderDetailsUsers orderDetailsUsers;
public void configure(HttpSecurity httpSecurity) throws Exception {
httpSecurity
.authorizeRequests()
.antMatchers("/order/greet").hasAnyAuthority("admins","leads")
.antMatchers("/order").hasRole("agents")
.anyRequest()
.authenticated()
.and()
.httpBasic();
}
#Bean
public InMemoryUserDetailsManager inMemoryUserDetailsManager() {
final InMemoryUserDetailsManager manager = new InMemoryUserDetailsManager();
log.info("Importing {} clients: " , applicationClients.getClients().toString());
AuthenticationManager authenticationManager = null;
KeyValues kvAgents = orderDetailsUsers.applicatonUsers.getAgents();
String keyAgent = kvAgents.getKey();
String[] valueAgents = kvAgents.getValues();
for (int i = 0; i < valueAgents.length ; i++) {
Authentication authentication =
new UsernamePasswordAuthenticationToken(keyAgent, null, valueAgents[i]);
SecurityContextHolder.getContext().setAuthentication(authentication);
authenticationManager.authenticate(authentication);
manager.setAuthenticationManager(authenticationManager);
}
return manager;
}
}
#Component
public class OrderDetailsUsers {
private static final Logger log = LoggerFactory.getLogger(OrderDetailsUsers.class);
private ResourceLoader resourceLoader;
//#Autowired
ApplicationUsers applicatonUsers = new ApplicationUsers();
public OrderDetailsUsers(ResourceLoader resourceLoader) {
this.resourceLoader = resourceLoader;
}
#PostConstruct
public void init() {
try {
log.info("Trying to load users...");
Resource resource = resourceLoader.getResource("classpath:application-users.txt");
InputStream inputStream = resource.getInputStream();
log.info("inputStream = " + inputStream.toString());
BufferedReader bufferedReader = new BufferedReader(new InputStreamReader(inputStream, "UTF-8"));
StringBuilder stringBuilder = new StringBuilder();
String str;
while ( (str = bufferedReader.readLine()) != null) {
stringBuilder.append(str);
}
log.info("stringBuilder = " + stringBuilder.toString());
JsonObject jsonObject = new JsonParser().parse(stringBuilder.toString()).getAsJsonObject();
JsonArray users = jsonObject.get("users").getAsJsonArray();
log.info("users = " + users.toString());
String[] strUsersArray = toStringArray(users);
KeyValues kvUsers = new KeyValues();
kvUsers.setKey("users");
kvUsers.setValues(strUsersArray);
applicatonUsers.setUsers(kvUsers);
log.info("final users = " + applicatonUsers.getUsers().toString());
JsonArray agents = jsonObject.get("agents").getAsJsonArray();
log.info("agents = " + agents.toString());
String[] strAgentsArray = toStringArray(agents);
KeyValues kvAgents = new KeyValues();
kvAgents.setKey("agents");
kvAgents.setValues(strAgentsArray);
applicatonUsers.setAgents(kvAgents);
log.info("final Agents = " + applicatonUsers.getAgents().toString());
JsonArray leads = jsonObject.get("leads").getAsJsonArray();
log.info("leads = " + leads.toString());
String[] strLeadsArray = toStringArray(leads);
KeyValues kvLeads = new KeyValues();
kvLeads.setKey("leads");
kvLeads.setValues(strLeadsArray);
applicatonUsers.setLeads(kvLeads);
log.info("final leads = " + applicatonUsers.getLeads().toString());
JsonArray admins = jsonObject.get("admins").getAsJsonArray();
log.info("admins = " + admins.toString());
String[] strAdminsArray = toStringArray(admins);
KeyValues kvAdmins = new KeyValues();
kvAdmins.setKey("admins");
kvAdmins.setValues(strAdminsArray);
applicatonUsers.setAdmins(kvAdmins);
log.info("final admins = " + applicatonUsers.getAdmins().toString());
} catch(IOException | NullPointerException e) {
log.error("Failing to load users..." , e);
}
}
public static String[] toStringArray(JsonArray jsonArray) {
if (jsonArray == null)
return null;
String[] strArray = new String[jsonArray.size()];
for ( int i =0; i < strArray.length ; i++) {
strArray[i] = jsonArray.get(i).getAsString();
}
return strArray;
}
}
#Getter
#Setter
#ToString
public class ApplicationUsers {
private KeyValues users;
private KeyValues agents;
private KeyValues leads;
private KeyValues admins;
}
#Getter
#Setter
#ToString
public class KeyValues {
private String key;
private String[] values;
}
UsernamePasswordAuthenticationToken is asking for two arguments userid and password. But, I would like to pass userid, password as null, role of userid.

Answer 1

The purpose of InMemoryUserDetailsManager is just to represent user information in memory, it's userdetails service which is used by authentication provider. Ex:
#Bean
public InMemoryUserDetailsManager inMemoryUserDetailsManager() {
List<UserDetails> listOfUserDetails = new ArrayList<>();
listOfUserDetails.add(User.withUsername("userName").password(passwordEncoder().encode("pass"))
.roles("ADMIN", "LEAD","AGENT").build());
return new InMemoryUserDetailsManager(listOfUserDetails);
}
I do not think it is a good place to have authentication manipulations in InMemoryUserDetailsManager bean(It has different purpose).
Then register inMemoryUserDetailsManager bean to authenticationManagerBuilder:
#Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception
{
auth.userDetailsService(inMemoryUserDetailsManager());
}
As for UsernamePasswordAuthenticationToken, authentication provider after successful credential validation should return UsernamePasswordAuthenticationToken object built by 3 argument constructor as it sets authenticated flag to true.

Answer 2

I changed inMemoryUserDetailsManager() method and added passwordEncoder() method.
#Bean
public InMemoryUserDetailsManager inMemoryUserDetailsManager() {
final InMemoryUserDetailsManager manager = new InMemoryUserDetailsManager();
KeyValues kvAgents = orderDetailsUsers.applicatonUsers.getAgents();
String keyAgent = kvAgents.getKey();
String[] valueAgents = kvAgents.getValues();
for (int i = 0; i < valueAgents.length ; i++) {
manager.createUser(User.withUsername(valueAgents[i])
.password(passwordEncoder().encode(""))
.roles(keyAgent)
.build());
}
KeyValues kvAdmins = orderDetailsUsers.applicatonUsers.getAdmins();
String keyAdmin = kvAdmins.getKey();
String[] valueAdmins = kvAdmins.getValues();
for (int i = 0; i < valueAdmins.length ; i++) {
manager.createUser(User.withUsername(valueAdmins[i])
.password(passwordEncoder().encode(""))
.roles(keyAdmin)
.build());
}
KeyValues kvLeads = orderDetailsUsers.applicatonUsers.getLeads();
String keyLead = kvLeads.getKey();
String[] valueLeads = kvLeads.getValues();
for (int i = 0; i < valueLeads.length ; i++) {
manager.createUser(User.withUsername(valueLeads[i])
.password(passwordEncoder().encode(""))
.roles(keyLead)
.build());
}
return manager;
}
private PasswordEncoder passwordEncoder() {
return PasswordEncoderFactories.createDelegatingPasswordEncoder();
}