Token Based Authorization for REST services using Spring Security+Spring Boot - spring

Question

I am building REST services(JAVA/SPRING) for mobile applications in which have to take care of Authentication and Authorization. For Authentication I am using external tool but for role based Authorization I want to use Spring Security. The project uses Spring Boot +Spring Data JPA+ Spring REST.
I did a sample Project to get some hands on Spring Security but after spending few hours I was able to make it work some how, but have specific doubts.
Few classes from Sample:-
#Configuration
#EnableWebSecurity
#ComponentScan("com.ezetap.security")
#EnableGlobalMethodSecurity(prePostEnabled = true,securedEnabled=true)
public class SecurityConfig extends WebSecurityConfigurerAdapter {
#Autowired DataSource dataSource;
#Autowired CustomAuthenticationProvider authenticationProvider;
#Autowired CustomerUserDetailService customerUserDetailService;//Overrides loadByUserName method
#Autowired
public void configure(AuthenticationManagerBuilder auth) throws Exception {
//auth.userDetailsService(customerUserDetailService);
auth.authenticationProvider(authenticationProvider);
}
#Override
protected void configure(HttpSecurity http) throws Exception {
http.authorizeRequests()
.antMatchers(HttpMethod.GET,"/spring-security/test/**").hasRole("USER");
http.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS).and().csrf().disable();
http.addFilterBefore(new RestAuthenticationFilter(authenticationProvider,customerUserDetailService), BasicAuthenticationFilter.class);
}
}
public class RestAuthenticationFilter extends GenericFilterBean {
CustomerUserDetailService authenticationService;
AuthenticationProvider authenticationProvider;
public RestAuthenticationFilter() {
}
public RestAuthenticationFilter(CustomerUserDetailService customerUserDetailService) {
this.authenticationService=customerUserDetailService;
}
public RestAuthenticationFilter(AuthenticationProvider authenticationProvider,
CustomerUserDetailService customerUserDetailService) {
this.authenticationProvider=authenticationProvider;
this.authenticationService=customerUserDetailService;
}
public final String HEADER_SECURITY_TOKEN = "X-CustomToken";
public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain)
throws IOException, ServletException {
HttpServletRequest request = (HttpServletRequest) req;
HttpServletResponse response = (HttpServletResponse) res;
if("test".equalsIgnoreCase(request.getHeader(HEADER_SECURITY_TOKEN))){
UserDetails userDetails=authenticationService.loadUserByUsername("");//assume this is working
UsernamePasswordAuthenticationToken authentication =
new UsernamePasswordAuthenticationToken(userDetails, null, userDetails.getAuthorities());
authentication.setDetails(new WebAuthenticationDetailsSource().buildDetails(request));
SecurityContextHolder.getContext().setAuthentication(authentication);
chain.doFilter(request, response);
}else{
response.sendError(401, "Authorization failed");
//response.getWriter().append("Access denied");
}
} <br>
I have to use Token based Authorization in the Header. What will be the correct way to Generate tokens and then encrypt and send to Browser which then be used with all requests.
Is their any service where Spring generates a Token and persists or I have to do it manually and generate a token and store it somewhere and then evict it periodically?
I should also be able to get all tokens or invalidate a particular token or some other token related services.
Also, please let me know if the approach I am following is correct or if some other thing needs to be considered.This is purely for REST services, so no state or session. Dont want to use Spring Oauth due to complexity and time constraints.