Hi, I'm building a multiplatform side project in k...

# spring

[bdeg]

Hi, I'm building a multiplatform side project in kotlin. I have decided to use spring as my backend, because our backend team use it and I have used it in the past.

I'm trying to build an authentication system using spring security, spring security will delegate authentication to my firebase Auth manager from the firebase java admin sdk.

I have done some research, and discovered 3 approach for custom authentication using spring security:

1- user detail services.
2- authentication provider.
3- authentication manager.
4- simply by setting the authenticated user in the security context holder.

My first question is what's the recommended approach to custom authentication system?

Second question is there a way to use my own domain object for authentication?

I known that I can use the user detail interface but I think that returning my user identifier or email in the getUsername method introduce confusion in my source code. So is there's another way to use my domain object?

[diesieben07]

Implementing UserDetailsService is the simplest of them all and what I would recommend. You can have your domain object impmenent UserDetails and then return it from your UserDetailsService, it will then be accessible from anywhere from the Authentication object (Authentication#principal will contain your UserDetails implementation).

[bdeg]

Yes i agree it's the simplest way but is it not confusing to return something else from the method in userDetails just to match your domain object?

Since I'm trying to build something that I would use daily and maybe sell it.

I would like to known the + and - of using each of them.

I like the authentication manager approach, but what do I loose by using this approach?

[Jukka Siivonen]

Isn't AuthenticationProvider what you need at least? Which can use UserDetailsService or not

[Jukka Siivonen]

UserDetails is not meant for authentication itself

[diesieben07]

Depends. If you use Spring Boot it will set up DaoAuthenticationProvider automatically if you have UserDetailsService, or you can do that yourself.

[diesieben07]

But if all you are doing is "fetch user data from somewhere", then UserDetailsService is fine, then you can let Spring handle all the validation (correct password, is locked or not, etc.)

[bdeg]

Yes, spring boot setup the Dao one automatically if you make a bean of userdetailservice I think.

[bdeg]

What are the pros and cons of each approach?

[Jukka Siivonen]

Easier probably but maybe if you dont feel that UserDetails fits your needs then it should be quite easy to implement AuthenticationProvider

[bdeg]

I don't want to choose a solution, just because it's the easiest, if it's doesn't match my needs.

[Jukka Siivonen]

Most confusing part with UserDetails is that it may include your authorities (getAuthorities) which are not of course used for authorization, since Authentication.getAuthorities is used for that

[Jukka Siivonen]

So you may end up syncin authorities in two places

[diesieben07]

Actually, getAuthorities on Authorization will return the authorities from the UserDetails if you have the correct AuthenticationProvider.

[Jukka Siivonen]

What kind of AuthenticationProvider would take part in authorization and behave like that?

[diesieben07]

Any AbstractUserDetailsAuthenticationProvider will create a UsernamePasswordAuthenticationToken as the Authentication, which takes it's authorities from the UserDetails. DaoAuthenticationProvider (based on UserDetailsService) is one such provider

[diesieben07]

In my last message I accidentially wrote Authorization (which is not a thing) instead of Authentication.

[Jukka Siivonen]

I wrote that wrong too earlier 🙂

[Jukka Siivonen]

You are correct, I was referring to custom authentication implementations where custom UserDetails is used together with Spring Authentication types

[isto]

a lightweight approach if 1) this backend to which you refer is a spring mvc based rest api 2) you only need to authenticate the user, and you do not need e.g. method level security, is to not use spring security at all, just use handler method argument resolvers in the rest endpoints

[isto]

an example https://github.com/istonikula/realworld-api/blob/master/realworld-app/web/src/main/kotlin/io/realworld/Application.kt#L65

[bdeg]

Same answer from my backend team and thank you very much for the repository. Really helpful. @isto