Spring Security user account registration, creation and management

Question

I've been looking into using Spring Security for the authentication/authorization of my web application (this will be JDBC based).

However, a core component seems to be left out from my perspective. How do I register/create new users? Is there an out of the box API for that?

Do i need to write user registration and management from scratch? Things i need to do include: - Registering a new user - Resetting passwords - Emailing a user to activate their account - Emailing a user to reset their account.

Thank you in advance.

Answer 1

I use Spring Security on my project. The framework does not have an API for user creation or registration as you asked. For Spring Security to be generic and usable across multiple frameworks, it can only take you so far before you have to write custom code. You can't really get a more specific answer about a framework or tool to use because at this point you will just use the frameworks you are already using anyway.

If you've set it up to use users and roles in your database, from your data access layer you would create a record in the user table or update a password (preferably stored as a hash) in that record. And as Aravind said, Spring does provide email support.

If you really want to see one way to do it: I'm using Spring MVC, JSP, and Hibernate. I use Spring's form tags in a JSP to bind a new user form to a Person object, and my controller method passes that Person object to my Dao to persist it.

The controller method signature looks like this...

@RequestMapping(value = "/newUser", method = RequestMethod.POST)
public ModelAndView createNewUser(final @Valid @ModelAttribute Person user,
                                  final BindingResult result,
                                  final SessionStatus status,
                                  final @RequestParam(value = "unencodedPassword", required = true) String password) {
        ...
        user.getRoles().add(new Role(user, Role.APPLICATION_ROLE.ROLE_USER));
        userDao.createNewUser(user);
        ...
}

and my PersonDao would use Hibernate to persist the user like so

@Transactional
public void createNewUser(Person user)
{
    Session session = sessionFactory.getCurrentSession();
    session.save(user);
    session.flush();
}

Answer 2

Have a look at my answer here.

"I have implemented a JAVA project for this use case. It is open source, based on Spring-Security. A release version is on Maven-Central, so you do not need to compile it, but instead you can fetch it as maven-dependency to your project!"

<dependency>
     <groupId>com.ohadr</groupId>
     <artifactId>authentication-flows</artifactId>
     <version>1.5.0-RELEASE</version> 
</dependency>

Answer 3

As far as I know, Spring Security does not have built in support for new user creation and registration. You will have to manage this yourself. However it does have emailing support. Check here for more on this.