Spring Boot MVC with JWT Token - spring

Question

I am trying to build a web app with custom login page and access roles, but I wanna include JWT token also for the authentication and authorization.
Before including JWT, I configured security with access roles and ant matchers and custom login, I am able to access index view, when i wanna access "List of Students" i have to login with Admin credentials, when i wanna access "List of Subjects" i have to login with User credentials and it all works.
Now i wanna include JWT and i have all the JWT dependencies enabled, JwtRequest class, JwtResponse class, JwtUtil class and JwtRequestFilter. My security configuration is:
csrf().disable()
.authorizeRequests()
.antMatchers("/","/registration/**","/logout","/login").permitAll()
.antMatchers("/students/**").hasRole("Admin")
.antMatchers("/subjects/**").hasAnyRole("User","Admin")
.anyRequest().authenticated()
.and()
.formLogin()
.loginPage("/login")
.and()
.logout()
.logoutSuccessUrl("/login?logout");
and i also included:
// http.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);
//
// http.addFilterBefore(jwtRequestFilter, UsernamePasswordAuthenticationFilter.class);
I have my CustomUserDetailsClass:
public class CustomUserDetails implements UserDetails {
private User user;
public CustomUserDetails(User user) {
this.user = user;
}
#Override
public Collection<? extends GrantedAuthority> getAuthorities()
{
List<Role> roles = user.getRoles();
List<SimpleGrantedAuthority> authorities = new ArrayList<>();
for(Role role : roles)
{
authorities.add(new SimpleGrantedAuthority("ROLE_" + role.getName()));
}
return authorities;
}
#Override
public String getPassword() {
return user.getPassword();
}
#Override
public String getUsername() {
return user.getEmail();
}
I have my CustomUserDetailsService:
public class CustomUserDetailsService implements UserDetailsService {
#Autowired
UserRepository userRepository;
#Override
public UserDetails loadUserByUsername(String email) throws UsernameNotFoundException {
User user = userRepository.findByEmail(email);
if(user == null)
{
throw new UsernameNotFoundException("User Not Found!");
}
return new CustomUserDetails(user);
}
I am not finding a solution to implement Token with my views. I can do it using postman with #RestController using a "/authenticate" method.
THanks in advance!
I wanna build an web app with user and admin. Users can access "list of subjects" and admin can access "list of students".
But im not being able to implement the JWT token with my WEb app

Answer 1

I had this kind of scenario in one of my projects, I uploaded it on GitHub so you can have a look, I fell it exactly what you want.
You just have to create a Authentication filter like in this project.
https://github.com/Parneet-Raghuvanshi/Spring-Boot-Basics
Do watch the security folder, it's all in there what you need.
#Override
protected void configure(HttpSecurity http) throws Exception {
http.cors().and()
.csrf().disable().authorizeRequests()
.antMatchers(HttpMethod.GET, "/customer").hasRole("CUSTOMER")
.antMatchers(HttpMethod.GET, "/admin").hasRole("ADMIN")
.antMatchers(HttpMethod.GET, SecurityConstants.TEST_URL).permitAll()
.antMatchers(HttpMethod.GET, SecurityConstants.VERIFICATION_EMAIL_URL).permitAll()
.antMatchers(HttpMethod.POST, SecurityConstants.SIGNUP_URL).permitAll()
.antMatchers(HttpMethod.POST, SecurityConstants.PASSWORD_URL).permitAll()
.antMatchers(HttpMethod.POST, SecurityConstants.PASSWORD_RESET_URL).permitAll()
.anyRequest().authenticated()
.and().addFilter(getAuthenticationFilter())
.addFilter(new JwtFilter(authenticationManager()))
.sessionManagement()
.sessionCreationPolicy(SessionCreationPolicy.STATELESS);
}
this is the configure() function of my web security from same project, so that you can have an idea about the filters used here.
And feel free to ask any doubt from repo too. Good Luck :)