title: How exactly works Spring Security configuration in this Spring Boot project?
body: <p>I am not so into <strong>Spring Security</strong>. I am working on a <strong>Spring Boot</strong> project (implementing some REST web sercices) where someone else have implemented Spring Security to perform authentication. It seems works fine but I have some doubts about how it exactly works (the architecture).</p>
  
  <p>So basically I have the following classes:</p>
  
  <p>1) <strong>User</strong> that is my <strong>model class</strong> representing a user:</p>
  
  <pre><code>@Entity
  @Table(name = "user",
          uniqueConstraints = {
          @UniqueConstraint(columnNames = {"email","username"})
  })
  public class User  {
      @Id
      @GeneratedValue(strategy = GenerationType.IDENTITY)
      private Long id;
  
  
      //@Pattern(regexp="\\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\\.[A-Z]{2,4}\\b",flags = Pattern.Flag.CASE_INSENSITIVE)
      @Column(name="email", unique=true,nullable=false)
      private String email;
  
      @NotNull
      @Column(name="registration_date",nullable=false)
      private Date registration_date;
  
      @NotBlank
      @Column(name="username",nullable = false,unique=true)
      private String username;
  
      @NotBlank
      @Column(name="password",nullable = false)
      private String password;
  
  
      @Column(name="enabled", nullable = false)
      private boolean enabled;
  
      @ManyToMany
      @JoinTable(name = "user_user_roles", joinColumns = {
              @JoinColumn(name = "id_user", updatable = true) },
              inverseJoinColumns = { @JoinColumn(name = "id_roles",
                      updatable = true)},
              uniqueConstraints={@UniqueConstraint(columnNames = {"id_user","id_roles"})}
      )
      @Cascade({CascadeType.DETACH,CascadeType.MERGE,CascadeType.REFRESH,CascadeType.PERSIST,
              CascadeType.SAVE_UPDATE})
      private List&lt;UserRole&gt; userRoles;
  
      // CONSTRUCTOR, GETTER AND SETTER METHODS
  }
  </code></pre>
  
  <p>It is an hibernate class that provide the join with the <strong>user_user_roles</strong> database table containing the list of user rool associated to the specific user (I think the <strong>ROLE_ADMIN</strong>, <strong>ROLE_USER</strong>, etcetc)</p>
  
  <p>2) Then I have <strong>CustomUserDetails</strong> class that extends <strong>User</strong> and implements Spring Security <strong>UserDetails</strong> interface.</p>
  
  <p>So it means that will contain all the information related to a specific user (among which the role associated to this user) and implement all the methods declared in the <strong>UserDetails</strong> interface.</p>
  
  <pre><code>public class CustomUserDetails extends User implements UserDetails {
  
      private static final long serialVersionUID = 1L;
  
  
      public CustomUserDetails(User user){
          super(user);
      }
  
  
      @Override
      public Collection&lt;? extends GrantedAuthority&gt; getAuthorities() {
          Set&lt;GrantedAuthority&gt; authorities = new HashSet&lt;GrantedAuthority&gt;();
          for(UserRole role : this.getUserRoles() ){
              GrantedAuthority grantedAuthority = new SimpleGrantedAuthority(role.getName());
              authorities.add(grantedAuthority);
          }
  
          return authorities;
      }
  
      @Override
      public boolean isAccountNonExpired() {
          return true;
      }
      @Override
      public boolean isAccountNonLocked() {
          return true;
      }
  
      @Override
      public boolean isCredentialsNonExpired() {
          return true;
      }
      @Override
      public boolean isEnabled() {
          return true;
      }
  
      @Override
      public String getUsername() {
          return super.getUsername();
      }
  
  }
  </code></pre>
  
  <p>It seems to me that this class represent the bridge between Spring application and Spring Security (something like that carry the roles information related to a specific user, is it?).</p>
  
  <p>In this class the information related to the list of roles of an user is contained into a collection of generic object that extends <strong>GrantedAuthority</strong>.</p>
  
  <p>I think that the <strong>GrantedAuthority</strong> objects represents the roles of a user (infact are builded by <strong>role.getName()</strong> that is the string representing a role of the current user). Is it this reasoning correct?</p>
  
  <p>Basically the prvious implementation only return the collection of <strong>GrantedAuthority</strong> related to a specific user, is it?</p>
  
  <p>3) The <strong>CustomUserDetailsService</strong> class implementing Spring Security <strong>UserDetailsService</strong> interface:</p>
  
  <pre><code>@Transactional
  @Service("customUserDetailsService")
  public class CustomUserDetailsService implements UserDetailsService{
      @Autowired
      private UserDAO userDao;
  
      @Override
      public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
          User user = userDao.findByUsername(username);
          if(user == null){
              throw new UsernameNotFoundException("No user present with username: "+username);
          }else{
              return new CustomUserDetails(user);
          }
      }
  
  }
  </code></pre>
  
  <p>Basically this is a service that only implements the <strong>loadUserByUsername(String username))</strong> method that do:</p>
  
  <ul>
  <li><p>First retrieve the information related the user (a <strong>User</strong> object) including the list of his roles (<strong>List userRoles</strong>).</p></li>
  <li><p>Then use this <strong>User</strong> object to build the previous <strong>CustomUserDetails</strong> used to retrieve the collection of the <strong>GrantedAuthority</strong> related to the user.</p></li>
  </ul>
  
  <p>Is all these reasoning correct?</p>
  
  <p>Then I also have this <strong>WebSecurityConfig</strong> that I think represent the <strong>Spring Security</strong> configuration:</p>
  
  <pre><code>@Configuration
  @EnableWebSecurity
  @ComponentScan(basePackageClasses = CustomUserDetailsService.class)
  @EnableAutoConfiguration
  public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
  
      @Autowired 
      private UserDetailsService userDetailsService;
  
      @Override
      protected void configure(HttpSecurity http) throws Exception {
      }
  }
  </code></pre>
  
  <p>This is pretty obsucre for me. What exactly does?</p>
  
  <p>From what I have understand it is enabling the REST web services security by ** @EnableWebSecurity**.</p>
  
  <p>But why does the autowire of the <strong>UserDetailsService</strong> bean?</p>
  
  <p>And what exactly foes this empty <strong>configure()</strong> method?</p>