[Newbie] - Spring Security, Custom Login

[Castiel Snow]

Question
How do I set up a custom login with Spring Boot? I need to use the same connection method of a legacy app I have.




Things to know before I explain

-I have a javafx App that connects to a data base using a php website as proxy/Login
-Obviously, this javafx app has the User class already defined.
-The javafx  application logs in with the web service and retrieves the database URL.
-The javafx  application uses the database URL to access a database directly.

Or, to simplify: The user put the login and password and click LOGIN -> The app,  goes to the webhost, sends the data to a certain php file and requests the database url and data that comes ENCRYPTED through JASPYR and it also comes through https. Once the data is returned, we decrypt it and login to the database directly.


-Im building a SpringBoot application to work with this legacy app.


Where Am I stuck?

I have built a Spring boot maven project and im reading a lot about Spring boot. My first step is to create a login page that behaves as the legacy app.

Currently, Im using a InMemorySecurityConfig as follows:

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;

@Configuration
public class InMemorySecurityConfig {
	
	@Autowired
	public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
		auth.inMemoryAuthentication()
                .withUser("user").password("{noop}123").roles("USER")
                .and()
                .withUser("admin").password("{noop}123").roles("ADMIN");
	}
}

I dont know how to start. I think I have to find away to define the correct User model and then use a class to login that actually allows me to manually login.




Here is the legacy class that I use on my javafx App below. How do I start to convert this to spring boot? Please help.

public JSONObject login(String usuario, String senha) throws MalformedURLException, IOException {
        int timeout = 10;
        RequestConfig config = RequestConfig.custom()
                .setConnectTimeout(timeout * 1000)
                .setConnectionRequestTimeout(timeout * 1000)
                .setContentCompressionEnabled(true)
                .setAuthenticationEnabled(true)
                .setSocketTimeout(timeout * 1000)
                .build();

        CloseableHttpClient httpclient = HttpClientBuilder.create().setDefaultRequestConfig(config).build();
        HttpPost httppost = new HttpPost(Settings.LOGIN_URL);

        int CONNECTION_TIMEOUT_MS = timeout * 1000; // Timeout in millis.
        RequestConfig requestConfig = RequestConfig.custom()
                .setConnectionRequestTimeout(CONNECTION_TIMEOUT_MS)
                .setConnectTimeout(CONNECTION_TIMEOUT_MS)
                .setContentCompressionEnabled(true)
                .setAuthenticationEnabled(true)
                .setSocketTimeout(CONNECTION_TIMEOUT_MS)
                .build();

        httppost.setConfig(requestConfig);

        // Request parameters and other properties.
        ArrayList<NameValuePair> params = new ArrayList<NameValuePair>(2);
        params.add(new BasicNameValuePair("usuario", usuario)); // user
        params.add(new BasicNameValuePair("senha", senha)); // password
        httppost.setEntity(new UrlEncodedFormEntity(params, "UTF-8"));

        CloseableHttpResponse execute = null;

        try {
            execute = httpclient.execute(httppost);
        } catch (Exception ex) {

            try {
                httppost.abort();
                if (execute != null) {
                    execute.close();
                }
            } catch (Exception x) {
                ErrorLogger.log(x);
            }
            throw ex;

        }
        HttpEntity entity = execute.getEntity();

        if (entity != null) {
            JSONObject json = JsonTools.readJson(entity.getContent());
           
            return json;
        }

        return null;
    }

@Override
    protected Task<JSONObject> createTask() {

        return new Task<JSONObject>() {
            @Override
            protected JSONObject call() throws InterruptedException, IOException {
                StringProperty usuario = getUserName();
                StringProperty senha = getPassword();

                LoginDAO loginDAO = new LoginDAO();
                JSONObject login = loginDAO.login(MyTools.encodeToBase64(usuario.get()), MyTools.encodeToBase64(senha.get()));

                String db_url = login.getString("db_url");
                String db_username = login.getString("db_username");
                String db_password = login.getString("db_password");
                String nomeEmpresa = login.getString("nomeEmpresa");

                int idUsuario = login.getInt("idUsuario");
                String nomeDoUsuario = login.getString("nomeUsuario");
                int idTunnel = login.getInt("idTunnel");

                Settings.setDb_password(db_password);
                Settings.setDb_username(db_username);
                Settings.setDb_url(db_url);
                Settings.setDb_empresa(nomeEmpresa);

                //Connect to the data base 
                HibernateUtil.init();


                return login;
            }
        };

    }

How do I start? Any tips on how to start is greatly appreciated.

Im expecting that I have to somehow tell spring boot which User class to use, to tell spring to NOT instantly connect to the database and wait for the database info to be retrieved by the login page, and a way to login using spring.




The following topic explains my login process: https://coderanch.com/t/731125/engineering/Encrypt-JAVA-jasypt-Decrypt-PHP


PS: If the topic is not clear, please let me know. English isnt my first language but im trying my best.
#ThisForumRocks



References:
https://coderanch.com/t/735809/frameworks/User-Authentication-Authorization-Spring-Boot

https://spring.io/guides/gs/securing-web/

https://coderanch.com/t/734572/databases/Changing-database-DNS-Cname-adjustment

[Castiel Snow]

Hi!
I came up with a partial solution.

What Im planning to do is:

-Connect the spring boot directly to the login schema.
-Set up spring boot to use my custom User class.

-Login

-Change schema based on the login information.

--
Im a bit stuck on this part:
-Change schema based on the login information.

I found some information regarding people wanting to use 2 or 3 databases but in my case, it could be 'n' schemas GLOBALLY depending on which user log-in.