Customized Login Response in Spring Security Basic Auth - spring

Question

I have a table named "user_detail" having columns firstname,lastname,username,password.This table I am using for basic auth.
Currently when I give username, password in the /login controller then it validates with the table data. I want first name to be returned on successful login.
Below is my code.
public class LoginController {
#GetMapping(path = "/login")
public LoginResponse login() {
return new LoginResponse("You are authenticated");
}
}
#Configuration
#EnableWebSecurity
public class SpringSecurityConfigurationBasicAuth extends WebSecurityConfigurerAdapter {
#Autowired
MongoUserDetailsService userDetailsService;
#Override
protected void configure(HttpSecurity http) throws Exception {
AuthenticationEntryPoint entryPoint = new CustomAuthenticationEntryPoint();
http
.csrf().disable()
.authorizeRequests().anyRequest().authenticated()
.and().httpBasic().authenticationEntryPoint(entryPoint).and()
.exceptionHandling().authenticationEntryPoint(entryPoint)
.and().sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);
http.cors().configurationSource(request -> new CorsConfiguration().applyPermitDefaultValues());
}
#Bean
public PasswordEncoder passwordEncoder() {
return new BCryptPasswordEncoder();
}
#Override
public void configure(AuthenticationManagerBuilder builder) throws Exception {
builder.userDetailsService(userDetailsService);
}
#Override
public void configure(WebSecurity web) throws Exception {
web.ignoring().antMatchers("/user-registration/users");
}
#Bean
CorsConfigurationSource corsConfigurationSource() {
CorsConfiguration configuration = new CorsConfiguration();
configuration.setAllowCredentials(true);
configuration.setAllowedOrigins(Arrays.asList("http://localhost:3000"));
configuration.setAllowedMethods(Arrays.asList("GET"));
UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
source.registerCorsConfiguration("/**", configuration);
return source;
}
}
public #Data class LoginResponse {
private String message;
public LoginResponse(String message) {
this.message = message;
}
public String getMessage() {
return message;
}
public void setMessage(String message) {
this.message = message;
}
}
#Component
public class MongoUserDetailsService implements UserDetailsService {
#Autowired
MongoOperations mongoOperations;
#Override
public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
Query query = new Query(Criteria.where("emailId").is(username));
List<UserDetailData> user = mongoOperations.find(query, UserDetailData.class, "user_details");
if (CollectionUtils.isEmpty(user)) {
throw new UsernameNotFoundException("User not found");
}
List<SimpleGrantedAuthority> authorities = Arrays.asList(new SimpleGrantedAuthority("user"));
return new User(user.get(0).getEmailId(), user.get(0).getPassword(), authorities);
}
}
Currently it returns "You are authenticated" instead of this I want the first name of the user from the DB for that username.

Answer 1

You can try to use http.successHandler(handler). In the most primitive case handler can extend SimpleUrlAuthenticationSuccessHandler class. This handler redirects user to an arbitrary url after authentication.
If firstname is fetched from DB, you can convey it with custom user object:
public class ExtendedUser extends User {
private static final long serialVersionUID = -1;
private String name;
ExtendedUser(String email, String password, boolean enabled,
Collection<? extends GrantedAuthority> authorities,
String name) {
super(email, password, enabled, true, true, true, authorities);
this.name = name;
}
// getter and setter
}
Then use this class in your UserDetailsService instead of plain 'User'. After that, in success handler you can retrieve it like authentication.getPrincipal() in onAuthenticationSuccess method. Then you can put it as a query parameter of redirect url