spring JPA users, roles authentication - how do I avoid duplicate role entries? - spring

Question

Hi I'm new to spring JPA and spring security, I've spent a while trying to get authentication working based on users and roles.
A user should be able to have many roles, and a role can belong to many users.
There should only be about 4 roles.
I've tried to achieve this with a #Manytomany mapping and a join table.
It more or less works, but when I try to persist a new user with a set of Roles it will add duplicate entries to the roles table (or if I put a unique key on the roles table hits a UK violation).
here's the code:
user
import java.util.Set;
import javax.persistence.*;
#Entity
public class User {
#Id
#GeneratedValue(strategy = GenerationType.AUTO)
private long id;
private String email;
private String password;
public long getId() {
return id;
}
public void setId(long id) {
this.id = id;
}
public String getEmail() {
return email;
}
public void setEmail(String email) {
this.email = email;
}
public String getPassword() {
return password;
}
public void setPassword(String password) {
this.password = password;
}
public Set<Role> getRoles() {
return roles;
}
public void setRoles(Set<Role> roles) {
this.roles = roles;
}
#ManyToMany(fetch = FetchType.EAGER,cascade = CascadeType.ALL)
#JoinTable(joinColumns = #JoinColumn(name = "id"),inverseJoinColumns = #JoinColumn(name = "roleId"))
private Set<Role> roles;
public User(String email, String password, Set<Role> roles) {
super();
this.email = email;
this.password = password;
this.roles = roles;
}
}
role
import java.util.Set;
import javax.persistence.Entity;
import javax.persistence.FetchType;
import javax.persistence.GeneratedValue;
import javax.persistence.GenerationType;
import javax.persistence.Id;
import javax.persistence.ManyToMany;
#Entity
public class Role {
#Id
#GeneratedValue(strategy = GenerationType.AUTO)
private long id;
private String role;
#ManyToMany(mappedBy = "roles",fetch = FetchType.LAZY)
private Set<User> users;
public Role(String role) {
super();
this.role = role;
}
public long getId() {
return id;
}
public void setId(long id) {
this.id = id;
}
public String getRole() {
return role;
}
public void setRole(String role) {
this.role = role;
}
public Set<User> getUsers() {
return users;
}
public void setUser(Set<User> users) {
this.users = users;
}
}

Answer 1

ManyToMany is the correct logical relationship type. The reason you are getting too many roles is probably that you create new instances of Role, but if the role already exist in the database, you must load it into the persistence context, and only create a new role if it does not exist.
It would look something like this if you managed the transactions in code, if you're using container managed persistence with #Transactional you should remove the transaction code, and the try-finally block.
try {
List<String> roleNames = Lists.newArrayList("user, admin, superuser");
User user = new User("Peter", "Pan");
List<Role> roles = new ArrayList<>();
entityManager.getTransaction().begin();
for (String roleName : roleNames) {
List<Role> found = entityManager.createQuery("select r from Roles r where r.name = :roleName", Role.class)
.setParameter("roleName", roleName).getResultList();
if (found.isEmpty()) {
Role role = new Role(roleName);
entityManager.persist(role);
roles.add(role);
} else {
roles.addAll(found);
}
}
user.setRoles(roles);
entityManager.persist(user);
entityManager.getTransaction().commit();
} finally {
entityManager.close();
}
Personally I almost never use JPA's ManyToMany, I typically break it down to 2 OneToManyrelations, that way I have an Entity for the mapping table which is otherwise magically created by JPA. This also gives you additional control, for instance if you need to modify or delete a role from a user, you can delete the UserRoleMapping entity directly, instead of having to manipulate list on Role and User. It also giver you more control over cascading.