Spring boot security using userDetailsService - spring-boot

Question

#Service
public class UserDetService implements UserDetailsService{
#Autowired
private UserRepository userRepository;
#Override
public UserDetails loadUserByUsername(String userName) throws UsernameNotFoundException {
User user = userRepository.findByUserName(userName);
if(user == null){
throw new UsernameNotFoundException(userName);
}
return new UserPrincipal(user);
}
}
SecConfig.java
#Configuration
#EnableWebSecurity
public class SecConfig extends WebSecurityConfigurerAdapter{
#Bean
public UserDetailsService userDetailsService(){
return new UserDetService();
}
#Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception{
auth.userDetailsService(userDetailsService());
}
#Override
protected void configure(HttpSecurity http) throws Exception {
http.authorizeRequests()
.antMatchers("/hello").access("hasRole('ROLE_ADMIN')")
.anyRequest().permitAll()
.and()
.formLogin().loginPage("/login")
.usernameParameter("username").passwordParameter("password")
.and()
.logout().logoutSuccessUrl("/login?logout")
.and()
.exceptionHandling().accessDeniedPage("/403")
.and()
.csrf();
}
}
I was learning spring security and didn't find anyone to ask if I was correct and is this all to do to secure login authentication or have I missed something?
Also I got a confusion that I haven't written any queries to get username and password, how does the validation of username and password from user input and database work and where the validation occur ?
Thank you for such a helpful people around here

Answer 1

You don't need to write queries because if you are using jpa it will write the queries for you.
This line: User user = userRepository.findByUserName(userName);
Will use the repository to auto-generate the query to check if the supplied parameter returns anything and in your service
if(user == null){
throw new UsernameNotFoundException(userName);
}
will throw the error if the repository couldn't find the user.
Hope this answers your question.