Role based dashboard in spring security - spring

Question

CREATE TABLE `role_details` (
`role_id` int(11) NOT NULL AUTO_INCREMENT,
`role_name` varchar(45) DEFAULT NULL,
`role_desc` varchar(100) DEFAULT NULL,
`rights` varchar(300) DEFAULT NULL,
PRIMARY KEY (`role_id`)
)
CREATE TABLE `user_details` (
`user_id` int(11) NOT NULL AUTO_INCREMENT,
`display_name` varchar(45) DEFAULT NULL,
`password` varchar(45) DEFAULT NULL,
`emp_id` int(11) DEFAULT NULL,
`role` varchar(45) DEFAULT NULL,
`email` varchar(45) DEFAULT NULL,
`mobile` varchar(45) DEFAULT NULL,
`creation_time` datetime DEFAULT CURRENT_TIMESTAMP,
`status` varchar(45) DEFAULT NULL,
PRIMARY KEY (`user_id`)
)
This is my database schema. I am using spring security.
But I am confused...what I need to write in spring-security.xml ?
<authentication-manager>
<authentication-provider>
<jdbc-user-service data-source-ref="dataSource"
users-by-username-query=
"SELECT * FROM hmis_db.user_details where display_name=? and status='active'"
authorities-by-username-query=
"**QUESTION** " />
</authentication-provider>
</authentication-manager>
Actually, I want to create Role based dashboard. and 'rights' in role_details table that specifies the access menu list..and according it it will generate role based dashboard.

Answer 1

Actually I can't see the relationship between your UserDetails table and the RoleDetails one, maybe I'm losing something.
When I have made such a kind of entities schemas, I allways made a 1-to-n relations between Users and roles, so one user can have one role or more.
But assumming you are conguring a 1-1 relation from user to role, and assuming the ROLE_xxx you are looking for is on the role field in UserDetails table, your authorities-by-username-query must be more or less like this:
"select display_name as username, role as authority from user_details where display_name =? "
If the field role in user_details is the foreign key which must match the field role_name in role_details, and rigths are actually the authorities which are referenced in access elements of security_intercept urls, it should be this way:
"select u.display_name as username, r.rights as authority
from user_details as u INNER JOIN role_details as r ON u.role = r.role_name
where u.display_name =? "
But here you might have a trouble if rights are a comma separated list of authorities. authorities-by-username-query expects to receive a list of rows with an authority in each of this rows. If this is what you were seeking, you should consider changing the schema or making even a view of the tables which returns a right per row result
EDIT: I should do this way:
This is the creation script:
CREATE TABLE IF NOT EXISTS `role_details` (
`role_id` INT(11) NOT NULL AUTO_INCREMENT,
`role_name` VARCHAR(45) NULL DEFAULT NULL,
`role_desc` VARCHAR(100) NULL DEFAULT NULL,
`role_authority` VARCHAR(300) NOT NULL,
PRIMARY KEY (`role_id`))
ENGINE = InnoDB
DEFAULT CHARACTER SET = utf8;
CREATE TABLE IF NOT EXISTS `user_details` (
`user_id` INT(11) NOT NULL AUTO_INCREMENT,
`display_name` VARCHAR(45) NULL DEFAULT NULL,
`password` VARCHAR(45) NULL DEFAULT NULL,
`emp_id` INT(11) NULL DEFAULT NULL,
`email` VARCHAR(45) NULL DEFAULT NULL,
`mobile` VARCHAR(45) NULL DEFAULT NULL,
`creation_time` DATETIME NULL DEFAULT CURRENT_TIMESTAMP,
`status` TINYINT(1) NULL DEFAULT 0,
PRIMARY KEY (`user_id`))
ENGINE = InnoDB
DEFAULT CHARACTER SET = utf8;
CREATE TABLE IF NOT EXISTS `user_role_details` (
`user_details_user_id` INT(11) NOT NULL,
`role_details_role_id` INT(11) NOT NULL,
PRIMARY KEY (`user_details_user_id`, `role_details_role_id`),
INDEX `fk_user_details_has_role_details_role_details1_idx` (`role_details_role_id` ASC),
INDEX `fk_user_details_has_role_details_user_details_idx` (`user_details_user_id` ASC),
CONSTRAINT `fk_user_details_has_role_details_user_details`
FOREIGN KEY (`user_details_user_id`)
REFERENCES `user_details` (`user_id`)
ON DELETE NO ACTION
ON UPDATE NO ACTION,
CONSTRAINT `fk_user_details_has_role_details_role_details1`
FOREIGN KEY (`role_details_role_id`)
REFERENCES `role_details` (`role_id`)
ON DELETE NO ACTION
ON UPDATE NO ACTION)
ENGINE = InnoDB
DEFAULT CHARACTER SET = utf8;
Note I deleted column 'role' in user_details, renamed 'rights' to 'role_authority' in role_details and changed 'status' from varchar to tinyint(1) to use it as boolean.
Then, the user details sqls:
users-by-username-query=
"SELECT display_name as username, password, status as enabled
FROM user_details as u WHERE u.display_name = ? and status = 1;"
authorities-by-username-query=
"Select u.display_name as username, r.role_authority as authority
FROM
user_details as u
INNER JOIN user_role_details as urd ON u.user_id = urd.user_details_user_id
INNER JOIN role_details as r ON urd.role_details_role_id = r.role_id
WHERE u.display_name = ?"
This way you can have multiple roles binded to each user

Answer 2

Refer to following link that covers basics and example http://en.tekstenuitleg.net/blog/spring-security-with-roles-and-rights
Once you familiarize yourself with basics, please look deeper into Spring Security documentation https://docs.spring.io/spring-security/site/docs/3.0.x/reference/ns-config.html before you implement that code for production.
If you are using Spring Security 4, you may prefer annotations based configurations like
#Configuration
#EnableWebSecurity
public class SecurityConfiguration extends WebSecurityConfigurerAdapter {
#Autowired
public void configureGlobalSecurity(AuthenticationManagerBuilder auth) throws Exception {
auth.inMemoryAuthentication().withUser("user").password("userpwd").roles("USER");
auth.inMemoryAuthentication().withUser("admin").password("adminpwd").roles("ADMIN");
}
#Override
protected void configure(HttpSecurity http) throws Exception {
http.authorizeRequests()
.antMatchers("/", "/home").permitAll()
.antMatchers("/admin/**").access("hasRole('ADMIN')")
.and().formLogin()
.and().exceptionHandling().accessDeniedPage("/Access_Denied");
}
}