Spring Security Hibernate Annotations Login

[Partheban Udayakumar]

Hi all,

I am trying spring security, hibernate login with the help of example from Mykong websites. The problem is that what ever username and password combination I give (correct ones and the wrong ones), it shows credential errors. Here are the classes:

AppConfig.java
package com.sample.dental.config;

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.ComponentScan;
import org.springframework.context.annotation.Configuration;
import org.springframework.context.annotation.Import;
import org.springframework.jdbc.datasource.DriverManagerDataSource;
import org.springframework.web.servlet.config.annotation.EnableWebMvc;

@Configuration
@ComponentScan(basePackages = "com.sample.dentals")
@EnableWebMvc
@Import({ SecurityConfig.class })
public class AppConfig {

	@Bean(name = "dataSource")
	public DriverManagerDataSource dataSource() {
		DriverManagerDataSource driverManagerDataSource = new DriverManagerDataSource();
		driverManagerDataSource.setDriverClassName("org.postgresql.Driver");
		driverManagerDataSource.setUrl("jdbc:postgresql://localhost/dental");
		driverManagerDataSource.setUsername("postgres");
		driverManagerDataSource.setPassword("root");
		return driverManagerDataSource;
	}
}

ApplicationContextConfig.java
package com.sample.dental.config;

import java.util.Properties;

import javax.sql.DataSource;

import org.hibernate.SessionFactory;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.ComponentScan;
import org.springframework.context.annotation.Configuration;
import org.springframework.orm.hibernate4.HibernateTransactionManager;
import org.springframework.orm.hibernate4.LocalSessionFactoryBuilder;
import org.springframework.transaction.annotation.EnableTransactionManagement;
import org.springframework.web.multipart.commons.CommonsMultipartResolver;

import com.sample.dental.dao.FileActionDAO;
import com.sample.dental.dao.FileActionDAOImpl;
import com.sample.dental.dao.TreatmentDAO;
import com.sample.dental.dao.TreatmentDAOImpl;
import com.sample.dental.model.Consultation;
import com.sample.dental.model.Content;
import com.sample.dental.model.FileAction;
import com.sample.dental.model.Menu;
import com.sample.dental.model.Testimonial;
import com.sample.dental.model.Treatment;

@Configuration
@ComponentScan("com.sample.dental")
@EnableTransactionManagement
public class ApplicationContextConfig {

	@Autowired
	@Bean(name = "fileUploadDao")
	public FileActionDAO getUserDao(SessionFactory sessionFactory) {
		return new FileActionDAOImpl(sessionFactory);
	}
	
	@Autowired
	@Bean(name = "treatmentDao")
	public TreatmentDAO getTreatmentDao(SessionFactory sessionFactory) {
		return new TreatmentDAOImpl(sessionFactory);
	}

	@Bean(name = "multipartResolver")
	public CommonsMultipartResolver getCommonsMultipartResolver() {
		CommonsMultipartResolver multipartResolver = new CommonsMultipartResolver();
		multipartResolver.setMaxUploadSize(20971520); // 20MB
		multipartResolver.setMaxInMemorySize(1048576); // 1MB
		return multipartResolver;
	}
	
	@Autowired
    @Bean(name = "sessionFactory")
    public SessionFactory getSessionFactory(DataSource dataSource) {
    	LocalSessionFactoryBuilder sessionBuilder = new LocalSessionFactoryBuilder(dataSource);
    	sessionBuilder.addProperties(getHibernateProperties());
    	sessionBuilder.addAnnotatedClasses(FileAction.class,Treatment.class, Consultation.class, Testimonial.class, Content.class, Menu.class);
    	return sessionBuilder.buildSessionFactory();
    }
	
	 private Properties getHibernateProperties() {
	    	Properties properties = new Properties();
	    	properties.put("hibernate.show_sql", "true");
	    	properties.put("hibernate.dialect", "org.hibernate.dialect.PostgreSQLDialect"); //org.hibernate.dialect.MySQLDialect
	    	return properties;
	    }
	 
	 @Autowired
		@Bean(name = "transactionManager")
		public HibernateTransactionManager getTransactionManager(
				SessionFactory sessionFactory) {
			HibernateTransactionManager transactionManager = new HibernateTransactionManager(
					sessionFactory);

			return transactionManager;
		}

}

ApplicationInit.java
package com.sample.dental.config;

import javax.servlet.ServletContext;
import javax.servlet.ServletException;
import javax.servlet.ServletRegistration;

import org.springframework.web.context.ContextLoaderListener;
import org.springframework.web.context.WebApplicationContext;
import org.springframework.web.context.support.AnnotationConfigWebApplicationContext;
import org.springframework.web.servlet.DispatcherServlet;
import org.springframework.web.servlet.support.AbstractAnnotationConfigDispatcherServletInitializer;

public class ApplicationInit extends AbstractAnnotationConfigDispatcherServletInitializer{

	@Override
	protected Class<?>[] getRootConfigClasses() {
		// TODO Auto-generated method stub
		return new Class[]{AppConfig.class};
	}

	@Override
	protected Class<?>[] getServletConfigClasses() {
		// TODO Auto-generated method stub
		return new Class[]{WebConfig.class};
	}

	@Override
	protected String[] getServletMappings() {
		// TODO Auto-generated method stub
		return new String[]{"/"};
	}

	 @Override
	    public void onStartup(ServletContext servletContext) throws ServletException {
	        AnnotationConfigWebApplicationContext appContext = new AnnotationConfigWebApplicationContext();
	        WebApplicationContext context = getContext();
	        servletContext.addListener(new ContextLoaderListener(context));
	        appContext.register(ApplicationContextConfig.class);
	         
	        ServletRegistration.Dynamic dispatcher = servletContext.addServlet(
	                "SpringDispatcher", new DispatcherServlet(appContext));
	        dispatcher.setLoadOnStartup(1);
	        dispatcher.addMapping("/");
	         
	    }
	 
	 private AnnotationConfigWebApplicationContext getContext() {
	        AnnotationConfigWebApplicationContext context = new AnnotationConfigWebApplicationContext();
	        context.setConfigLocation("com.sample.dental.config");
	        return context;
	    }
}

SecurityConfig.java
package com.sample.dental.config;

/*import javax.sql.DataSource;*/

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.beans.factory.annotation.Qualifier;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;


@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

	@Autowired
	@Qualifier("userDetailsService")
	UserDetailsService userDetailsService;

	@Autowired
	public void configAuthentication(AuthenticationManagerBuilder auth)
			throws Exception {
		
		auth.userDetailsService(userDetailsService).passwordEncoder(
				passwordEncoder());
	}

	@Override
	protected void configure(HttpSecurity http) throws Exception {

		http.authorizeRequests().antMatchers("/admin/**")
				.access("hasRole('ROLE_ADMIN')").and().formLogin()
				.loginPage("/login").failureUrl("/login?error")
				.usernameParameter("username").passwordParameter("password")
				.and().exceptionHandling().accessDeniedPage("/403").and()
				.csrf().disable();
	}

	/*
	 * public UsernamePasswordAuthenticationFilter
	 * usernamePasswordAuthenticationFilter() throws Exception {
	 * UsernamePasswordAuthenticationFilter usernamePasswordAuthenticationFilter
	 * = new UsernamePasswordAuthenticationFilter();
	 * usernamePasswordAuthenticationFilter
	 * .setAuthenticationManager(authenticationManager());
	 * usernamePasswordAuthenticationFilter.setAllowSessionCreation(true);
	 * SimpleUrlAuthenticationSuccessHandler successHandler = new
	 * SimpleUrlAuthenticationSuccessHandler( "/");
	 * successHandler.setAlwaysUseDefaultTargetUrl(true);
	 * usernamePasswordAuthenticationFilter
	 * .setAuthenticationSuccessHandler(successHandler);
	 * usernamePasswordAuthenticationFilter .setAuthenticationFailureHandler(new
	 * SimpleUrlAuthenticationFailureHandler( "/login?error=true"));
	 * usernamePasswordAuthenticationFilter.afterPropertiesSet();
	 * 
	 * return usernamePasswordAuthenticationFilter; }
	 */

	@Bean
	public PasswordEncoder passwordEncoder() {
		PasswordEncoder encoder = new BCryptPasswordEncoder();
		return encoder;
	}
}

SpringSecurityInitializer
package com.sample.dental.config;

import org.springframework.security.web.context.AbstractSecurityWebApplicationInitializer;

public class SpringSecurityInitializer extends AbstractSecurityWebApplicationInitializer{

}

WebConfig.java
package com.sample.dental.config;

import org.hibernate.SessionFactory;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.ComponentScan;
import org.springframework.context.annotation.Configuration;
import org.springframework.web.multipart.commons.CommonsMultipartResolver;
import org.springframework.web.servlet.config.annotation.DefaultServletHandlerConfigurer;
import org.springframework.web.servlet.config.annotation.EnableWebMvc;
import org.springframework.web.servlet.config.annotation.InterceptorRegistry;
import org.springframework.web.servlet.config.annotation.ResourceHandlerRegistry;
import org.springframework.web.servlet.config.annotation.WebMvcConfigurerAdapter;
import org.springframework.web.servlet.i18n.LocaleChangeInterceptor;
import org.springframework.web.servlet.view.InternalResourceViewResolver;

import com.sample.dental.dao.FileActionDAO;
import com.sample.dental.dao.FileActionDAOImpl;

@Configuration
@EnableWebMvc
@ComponentScan(basePackages = "com.sample.dental")
public class WebConfig extends WebMvcConfigurerAdapter {
	protected int staticResourcesCachePeriod = 31_556_926; // TODO to config # 1
															// year

	@Bean
	public InternalResourceViewResolver getInternalResourceViewResolver() {
		InternalResourceViewResolver resolver = new InternalResourceViewResolver();
		resolver.setPrefix("/WEB-INF/views/");
		resolver.setSuffix(".jsp");
		return resolver;
	}

	@Override
	public void configureDefaultServletHandling(
			DefaultServletHandlerConfigurer configurer) {
		configurer.enable();
	}

	@Override
	public void addResourceHandlers(ResourceHandlerRegistry registry) {
		registry.addResourceHandler("/index.html")
				.addResourceLocations("/index.html")
				.setCachePeriod(staticResourcesCachePeriod);
		registry.addResourceHandler("/views/**")
				.addResourceLocations("/views/")
				.setCachePeriod(staticResourcesCachePeriod);
		registry.addResourceHandler("/resources/**")
				.addResourceLocations("/resources/")
				.setCachePeriod(staticResourcesCachePeriod);
		/*
		 * registry.addResourceHandler("/css/**").addResourceLocations("/css/").
		 * setCachePeriod(staticResourcesCachePeriod);
		 * registry.addResourceHandler
		 * ("/js/**").addResourceLocations("/js/").setCachePeriod
		 * (staticResourcesCachePeriod);
		 * registry.addResourceHandler("/img/**").addResourceLocations
		 * ("/img/").setCachePeriod(staticResourcesCachePeriod);
		 * registry.addResourceHandler
		 * ("/fonts/**").addResourceLocations("/fonts/")
		 * .setCachePeriod(staticResourcesCachePeriod);
		 * registry.addResourceHandler
		 * ("/font-awesome/**").addResourceLocations("/font-awesome/")
		 * .setCachePeriod(staticResourcesCachePeriod);
		 * registry.addResourceHandler
		 * ("/favicon.ico").addResourceLocations("/favicon.ico");
		 * registry.setOrder(-1);
		 */

	}

	@Override
	public void addInterceptors(InterceptorRegistry registry) {
		LocaleChangeInterceptor localeChangeInterceptor = new LocaleChangeInterceptor();
		localeChangeInterceptor.setParamName("lang"); // TODO to constant

		registry.addInterceptor(localeChangeInterceptor);
	}
	
	@Autowired
	@Bean(name = "fileUploadDao")
	public FileActionDAO getUserDao(SessionFactory sessionFactory) {
		return new FileActionDAOImpl(sessionFactory);
	}
	
	@Bean(name = "multipartResolver")
	public CommonsMultipartResolver getCommonsMultipartResolver() {
	    CommonsMultipartResolver multipartResolver = new CommonsMultipartResolver();
	    multipartResolver.setMaxUploadSize(20971520);   // 20MB
	    multipartResolver.setMaxInMemorySize(1048576);  // 1MB
	    return multipartResolver;
	}
}

HomeController.java
@RequestMapping(value = "/", method = RequestMethod.GET)
	public ModelAndView home(Locale locale) {
		// logger.info("Welcome home! The client locale is {}.", locale);

		ModelAndView view = new ModelAndView();

		List<Menu> menu = menuDao.getMenu();

		view.addObject("menu", menu);

		view.setViewName("index");

		return view;
	}

	@RequestMapping(value = "/index")
	public ModelAndView getHomePage() {

		ModelAndView view = new ModelAndView();

		List<Menu> menu = menuDao.getMenu();

		view.addObject("menu", menu);

		view.setViewName("index");

		return view;
	}

	@RequestMapping(value = "/admin**")
	public ModelAndView adminPage() {

		ModelAndView model = new ModelAndView();
		model.addObject("title",
				"Spring Security Login Form - Database Authentication");
		model.addObject("message", "This page is for ROLE_ADMIN only!");
		model.setViewName("admin");
		return model;

	}

@RequestMapping(value = "/login")
	public ModelAndView login(
			@RequestParam(value = "error", required = false) String error,
			@RequestParam(value = "logout", required = false) String logout,
			HttpServletRequest request) {

		ModelAndView model = new ModelAndView();
		if (error != null) {
			model.addObject("error",
					getErrorMessage(request, "SPRING_SECURITY_LAST_EXCEPTION"));
		}

		if (logout != null) {
			model.addObject("msg", "You've been logged out successfully.");
		}
		model.setViewName("login");

		return model;

	}

	private String getErrorMessage(HttpServletRequest request, String key) {

		Exception exception = (Exception) request.getSession()
				.getAttribute(key);

		String error = "";
		if (exception instanceof BadCredentialsException) {
			error = "Invalid username and password!";
		} else if (exception instanceof LockedException) {
			error = exception.getMessage();
		} else {
			error = "Invalid username and password!";
		}

		return error;
	}

	// for 403 access denied page
	@RequestMapping(value = "/403", method = RequestMethod.GET)
	public ModelAndView accesssDenied() {

		ModelAndView model = new ModelAndView();

		// check if user is login
		Authentication auth = SecurityContextHolder.getContext()
				.getAuthentication();
		if (!(auth instanceof AnonymousAuthenticationToken)) {
			UserDetails userDetail = (UserDetails) auth.getPrincipal();
			model.addObject("username", userDetail.getUsername());
		}

		model.setViewName("403");
		return model;
	}

UserDao
package com.sample.dental.dao;

import com.sample.dental.model.User;


public interface UserDao {

	User findByUserName(String username);

}

UserDaoImpl
package com.sample.dental.dao;

import java.util.ArrayList;
import java.util.List;

import org.hibernate.SessionFactory;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.stereotype.Repository;
import org.springframework.transaction.annotation.Transactional;

import com.sample.dental.model.User;



@Repository
public class UserDaoImpl implements UserDao {

	@Autowired
	private SessionFactory sessionFactory;

	@SuppressWarnings("unchecked")
	@Override
	@Transactional
	public User findByUserName(String username) {

		List<User> users = new ArrayList<User>();

		users = sessionFactory.getCurrentSession().createQuery("from User where username=?").setParameter(0, username)
				.list();

		if (users.size() > 0) {
			return users.get(0);
		} else {
			return null;
		}

	}

}

User.java
package com.sample.dental.model;

import java.util.HashSet;
import java.util.Set;

import javax.persistence.Column;
import javax.persistence.Entity;
import javax.persistence.FetchType;
import javax.persistence.Id;
import javax.persistence.OneToMany;
import javax.persistence.Table;

@Entity
@Table(name = "employee")
public class User {

	private String username;
	private String password;
	private boolean enabled;
	private Set<UserRole> userRole = new HashSet<UserRole>(0);

	public User() {
	}

	public User(String username, String password, boolean enabled) {
		this.username = username;
		this.password = password;
		this.enabled = enabled;
	}

	public User(String username, String password, boolean enabled, Set<UserRole> userRole) {
		this.username = username;
		this.password = password;
		this.enabled = enabled;
		this.userRole = userRole;
	}

	@Id
	@Column(name = "username", unique = true, nullable = false, length = 45)
	public String getUsername() {
		return this.username;
	}

	public void setUsername(String username) {
		this.username = username;
	}

	@Column(name = "password", nullable = false, length = 60)
	public String getPassword() {
		return this.password;
	}

	public void setPassword(String password) {
		this.password = password;
	}

	@Column(name = "enabled", nullable = false)
	public boolean isEnabled() {
		return this.enabled;
	}

	public void setEnabled(boolean enabled) {
		this.enabled = enabled;
	}

	@OneToMany(fetch = FetchType.LAZY, mappedBy = "user")
	public Set<UserRole> getUserRole() {
		return this.userRole;
	}

	public void setUserRole(Set<UserRole> userRole) {
		this.userRole = userRole;
	}

}

UserRole.java
package com.sample.dental.model;

import static javax.persistence.GenerationType.IDENTITY;

import javax.persistence.Column;
import javax.persistence.Entity;
import javax.persistence.FetchType;
import javax.persistence.GeneratedValue;
import javax.persistence.Id;
import javax.persistence.JoinColumn;
import javax.persistence.ManyToOne;
import javax.persistence.Table;
import javax.persistence.UniqueConstraint;

@Entity
@Table(name = "user_roles",  uniqueConstraints = @UniqueConstraint(columnNames = { "role", "username" }))
public class UserRole{

	private Integer userRoleId;
	private User user;
	private String role;

	public UserRole() {
	}

	public UserRole(User user, String role) {
		this.user = user;
		this.role = role;
	}

	@Id
	@GeneratedValue(strategy = IDENTITY)
	@Column(name = "user_role_id", unique = true, nullable = false)
	public Integer getUserRoleId() {
		return this.userRoleId;
	}

	public void setUserRoleId(Integer userRoleId) {
		this.userRoleId = userRoleId;
	}

	@ManyToOne(fetch = FetchType.LAZY)
	@JoinColumn(name = "username", nullable = false)
	public User getUser() {
		return this.user;
	}

	public void setUser(User user) {
		this.user = user;
	}

	@Column(name = "role", nullable = false, length = 45)
	public String getRole() {
		return this.role;
	}

	public void setRole(String role) {
		this.role = role;
	}

}

MyUserDetailsService
package com.sample.dental.service;

import java.util.ArrayList;
import java.util.HashSet;
import java.util.List;
import java.util.Set;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.authority.SimpleGrantedAuthority;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.core.userdetails.UsernameNotFoundException;
import org.springframework.stereotype.Service;
import org.springframework.transaction.annotation.Transactional;

import com.sample.dental.dao.UserDao;
import com.sample.dental.model.UserRole;



@Service("userDetailsService")
public class MyUserDetailsService implements UserDetailsService {

	@Autowired
	private UserDao userDao;

	@Transactional(readOnly=true)
	@Override
	public UserDetails loadUserByUsername(final String username) throws UsernameNotFoundException {
	
		com.sample.dental.model.User user = userDao.findByUserName(username);
		List<GrantedAuthority> authorities = buildUserAuthority(user.getUserRole());

		return buildUserForAuthentication(user, authorities);
		
	}

	private User buildUserForAuthentication(com.sample.dental.model.User user, List<GrantedAuthority> authorities) {
		return new User(user.getUsername(), user.getPassword(), user.isEnabled(), true, true, true, authorities);
	}

	private List<GrantedAuthority> buildUserAuthority(Set<UserRole> userRoles) {

		Set<GrantedAuthority> setAuths = new HashSet<GrantedAuthority>();

		for (UserRole userRole : userRoles) {
			setAuths.add(new SimpleGrantedAuthority(userRole.getRole()));
		}

		List<GrantedAuthority> Result = new ArrayList<GrantedAuthority>(setAuths);

		return Result;
	}

}

 login.jsp
<%@ page language="java" contentType="text/html; charset=ISO-8859-1"
	pageEncoding="ISO-8859-1"%>
<%@ taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core"%>
<%@page session="true"%>

<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
<title>Administrator</title>
<style type="text/css">
.centre {
	position: absolute;
	top:100px;
	left:420px;
	text-decoration: underline;
}

.home{
	position: absolute;
	top:20px;
	right: 20px;
}

.home a:link, .home a:visited, .home a:active {
	color:black;
	text-decoration: none;
}

.home a:hover {
	color:black;
	text-decoration: underline;
}

</style>
</head>
<body>

<div class="home">
<a href="index">Home</a>
</div>
	<c:if test="${not empty error}">
		<div class="error">${error}</div>
	</c:if>
	<c:if test="${not empty msg}">
		<div class="msg">${msg}</div>
	</c:if>
	<form action="<c:url value='/login' />" method="post">

<h1 class = "centre">Admin Login</h1>
		<div id="center"
			style="position: absolute; height: 200px; width: 400px; margin: -100px 0 0 -200px; top: 50%; left: 50%;">
			<p>
				<input type="text" path ="username" name="username" placeholder="Username" />
			</p>

			<p>
				<input type="password" name="password" placeholder="Password" />
			</p>

			<p>
				<input type="submit" value="Submit"> <input class="reset" type="reset" value="Clear">
			</p>

		</div>
		<input type="hidden" name="${_csrf.parameterName}"
			value="${_csrf.token}" />
	</form>
</body>
</html>

There are no errors or exceptions, it wont login, that's the problem