JWT with spring-boot and spring-security

Question

I am very new to Spring-Security. I am trying to implement JWT in my spring-boot application to perform authentication. I followed on example code and I am able to generate jwt. But as per the configurations done in the example files, I can validate the input in the HttpRequest with the in-memory data set in the configuration. But, I am not understanding how to check the username and password sent in the request with the values present in my database. Please guide me. My Configuration classes are

@Configuration
@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

@Override
protected void configure(HttpSecurity http) throws Exception {
    http.csrf().disable().authorizeRequests()
            .antMatchers("/").permitAll()
            .antMatchers(HttpMethod.POST, "/login").permitAll()
            .anyRequest().authenticated()
            .and()
            // We filter the api/login requests
            .addFilterBefore(new JWTLoginFilter("/login", authenticationManager()),
                    UsernamePasswordAuthenticationFilter.class)
            // And filter other requests to check the presence of JWT in header
            .addFilterBefore(new JWTAuthenticationFilter(),
                    UsernamePasswordAuthenticationFilter.class);
}

@Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
    // Create a default account
    auth.inMemoryAuthentication()
            .withUser("admin")
            .password("password")
            .roles("ADMIN");
}
}

Here in the overrided configure(AuthenticationManagerBuilder auth) throws Exception, I am able to set the credentials which will be compared with the credentials present in the request for /login path

public class TokenAuthenticationService {

static final long EXPIRATIONTIME = 864_000_000; // 10 days
static final String SECRET = "ThisIsASecret";
static final String TOKEN_PREFIX = "Bearer";
static final String HEADER_STRING = "Authorization";

static void addAuthentication(HttpServletResponse res, String username)     {
    String JWT = Jwts.builder()
            .setSubject(username)
            .setExpiration(new Date(System.currentTimeMillis() + EXPIRATIONTIME))
            .signWith(SignatureAlgorithm.HS512, SECRET)
            .compact();
    res.addHeader(HEADER_STRING, TOKEN_PREFIX + " " + JWT);
}

static Authentication getAuthentication(HttpServletRequest request) {
    String token = request.getHeader(HEADER_STRING);
    if (token != null) {
        // parse the token.
        String user = Jwts.parser()
                .setSigningKey(SECRET)
                .parseClaimsJws(token.replace(TOKEN_PREFIX, ""))
                .getBody()
                .getSubject();

        return user != null ?
                new UsernamePasswordAuthenticationToken(user, null, Collections.emptyList()) :
                null;
    }
    return null;
}
}

public class JWTLoginFilter extends AbstractAuthenticationProcessingFilter {

public JWTLoginFilter(String url, AuthenticationManager authManager) {
super(new AntPathRequestMatcher(url));
setAuthenticationManager(authManager);
}

@Override
public Authentication attemptAuthentication(
        HttpServletRequest req, HttpServletResponse res)
        throws AuthenticationException, IOException, ServletException {
    AccountCredentials creds = new ObjectMapper()
            .readValue(req.getInputStream(), AccountCredentials.class);
    return getAuthenticationManager().authenticate(
            new UsernamePasswordAuthenticationToken(
                    creds.getUsername(),
                    creds.getPassword(),
                    Collections.emptyList()
            )
    );
}

@Override
protected void successfulAuthentication(
        HttpServletRequest req,
        HttpServletResponse res, FilterChain chain,
        Authentication auth) throws IOException, ServletException {
    TokenAuthenticationService
            .addAuthentication(res, auth.getName());
}
}

public class JWTAuthenticationFilter extends GenericFilterBean{

@Override
public void doFilter(ServletRequest request,
                     ServletResponse response,
                     FilterChain filterChain)
        throws IOException, ServletException {
    Authentication authentication = TokenAuthenticationService
            .getAuthentication((HttpServletRequest)request);

    SecurityContextHolder.getContext()
            .setAuthentication(authentication);
    filterChain.doFilter(request,response);
}
}

Answer 1

You need to implement UserDetailsService interface (accessing your database) and configure it to be used by Spring Security.

A nice example (without JWT, but this is not the point) can be found here: Spring Security: Authentication with a Database-backed UserDetailsService