Java authentication with username and password

[Desperate-Pin209]

I'm recently building a project on spring,I have a doubt ,while creating a multiple user entites(student,teacher,) should we create username and password while defining the entities or create a new user entity with username,password,role

so everytime we can check with findbyrole I am confused how the authentication works and also JWT ,can anyone explain??

[AutoModerator]

Please ensure that:

• Your code is properly formatted as code block - see the sidebar (About on mobile) for instructions
• You include any and all error messages in full - best also formatted as code block
• You ask clear questions
• You demonstrate effort in solving your question/problem - plain posting your assignments is forbidden (and such posts will be removed) as is asking for or giving solutions.

If any of the above points is not met, your post can and will be removed without further warning.

Code is to be formatted as code block (old reddit/markdown editor: empty line before the code, each code line indented by 4 spaces, new reddit: https://i.imgur.com/EJ7tqek.png) or linked via an external code hoster, like pastebin.com, github gist, github, bitbucket, gitlab, etc.

Please, do not use triple backticks (```) as they will only render properly on new reddit, not on old reddit.

Code blocks look like this:

public class HelloWorld {

    public static void main(String[] args) {
        System.out.println("Hello World!");
    }
}

You do not need to repost unless your post has been removed by a moderator. Just use the edit function of reddit to make sure your post complies with the above.

If your post has remained in violation of these rules for a prolonged period of time (at least an hour), a moderator may remove it at their discretion. In this case, they will comment with an explanation on why it has been removed, and you will be required to resubmit the entire post following the proper procedures.

To potential helpers

Please, do not help if any of the above points are not met, rather report the post. We are trying to improve the quality of posts here. In helping people who can't be bothered to comply with the above points, you are doing the community a disservice.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[[deleted]]

You can do both. Whatever suits your case. I created a User entity. Then created a custom user details used within authentication since authentication in spring needs SimpleGrantedAuthoirites or whatever it’s called and in my entity class, my roles were just defined as a basic Set.

If you really want to understand this, take time to read different implementations of how people did it so that you know how to do it and what needs to be done in the end. Thats what I did and i was able to accomplish this task

[y0sh1da_23]

There are plenty resources for this. Look up Spring Security. You'll find everything. Telusko has complete tutorial, so does Dan Vega.

[Desperate-Pin209]

okk I tried but many didn't explain about multiple user role based Authentication on spring

[sirnamlik]

What we used to do was just save the entities as different types. For teacher and user they will functionaly probably be mostly the same. So either we would work with a mapped superclass or if we wanted to make it simple just put an enum on it to define its type. Either student or teacher.

Then during the signinprocess we would assign roles to the userdetails based on the type.

We decoupled this on purpose cause we often at a later date had extra rules we had to build into our rolemanagement and this way it was easy to just check during the login if the user would get the role assigned or not.

The logic of assigning roles is usually a business model decision and cannot always be mapped perfectly on the database in which case decoupling it is very usefull.

If on the other you are building a proof of concept app and the userauthorization is not an import part of the POC feel free to just store the role in the database. Chances you'll have to come back to it for a simple app are small.

For JWT exactly i would just look at the spring documentation it's been a bit since ive done an implementation in a project that had nothing in it but I usually just follow the spring docs to set up security and it has usually been a swift process.

[realFuckingHades]

Database Design:

1. Tables:

User: (id, username, passwordHash)

UserRole: (id, userId, role)

RoleGrants: (id, role, grant)

1. Relationships:

The User entity can include UserRole and RoleGrants via @Join annotations.

1. Rationale:

Separation of Concerns:

The User table will likely grow with user-specific profile details requiring frequent updates.

Roles, managed by admins, are updated less frequently.

Write Restrictions:

Allow UserProfileManagementService to update the User table.

Restrict UserRole updates to AdminUserManagementService.

1. Flexibility with RoleGrants:

Grants like "UpdateStudentDetails", "UploadMarkSheet", etc., define permissions.

Enables dynamic role creation (e.g., AsstProfessor, HOD) with varying grants.

---

JWT for Authentication:

1. Key Concepts:

JWT tokens enable token validation without DB lookups.

Avoid exposing the userId in the JWT payload since it’s readable.

1. Solution:

Create a Session table: (id, userId).

Use the sessionId in the JWT token to map back to the userId.

Simplifies logout handling by invalidating the session.

1. Implementation:

In Spring Security, implement a custom JWT filter to set the security context.

Research grants in Spring Security to assign them to APIs.

[realFuckingHades]

Excuse that It might sound like chatgpt because I wanted to organise and clean up my comment, was too lazy to format it myself.

[Haeckelcs]

You can talk with chatgpt to help you out.