Spring Security

What is spring boot two way SSL?

• Both server and client Trust each other certificate.
• Both server and client validate each other Certificate.
• Server send certificate to client and client also has to send required certificate to server, then only handshake happens.
• Add certificate to client, JDK key store and verify user.

How are we managing security in our applications?

• We can use LDAP based or OAuth based authentication.
• We are using Bearer token with Correlation ID
• For role based We are using spring security roles based on access lists.
• For Custom Authentication, we can use annotation based security.

How do we provide role based access control using Spring Security?

• Provide implementation of User details interface
• https://github.com/gauravmatta/springmvc/blob/0950f428b1bec0a034862d0f2c82142fccf64d66/course-api/src/main/java/com/springimplant/cms/entities/UserPrincipal.java
• Provide implementation of user detail service interface
• https://github.com/gauravmatta/springmvc/blob/0950f428b1bec0a034862d0f2c82142fccf64d66/course-api/src/main/java/com/springimplant/cms/service/MyUserDetailsService.java
• Provide configuration in a class that extends WebSecurityConfigurer Adapter
• https://github.com/gauravmatta/springmvc/blob/0950f428b1bec0a034862d0f2c82142fccf64d66/course-api/src/main/java/com/springimplant/cms/config/AppSecurityConfig.java
• In user details interface Grant authorities in the getauthorities method.