Role Based Access Command Using Jump Safety In Addition To Mvc, Mapping Ldap Groups To Government For Authorization

Authentication together with Authorization is integral component subdivision of whatsoever Java corporation or spider web application. Since most of the fellowship uses LDAP Active directory for authentication, authorization together with Role based access command (RBAC), it's practiced to know How to implement Role based access command using Spring MVC together with Spring Security. This is the minute component subdivision of my articles on using Spring Security for authentication together with authorization inward Spring MVC based Java application. In lastly part, nosotros stimulate got learned nearly doing LDAP authentication against Windows active directory, and inward this Spring Security tutorial, nosotros volition larn How to map LDAP groups to government for implementing Role based access command or authorization. If you lot are developing an application, whose access is controled yesteryear adding user to a exceptional LDAP group, together with hence you lot demand a machinery to charge those LDAP grouping afterwards successful authentication. Spring Secuirty uses GrantedAuthority class for holding all roles for a exceptional user. 

Based upon these roles, a exceptional user tin sack perform certainly functionality inward your application. For example, a read exclusively user tin sack exclusively run into data, but a user alongside ADMIN role, tin sack add together or withdraw information from your application. 

After implementing Role based access control, you lot are complimentary of user administration task, those volition live taken assist yesteryear respective squad which manages LDAP groups together with access, ordinarily Windows back upwards teams. 

In this article, nosotros volition all the steps required to map LDAP groups to granted government inward Spring Security. If you lot honey to read books, than you lot may desire to check Spring Security 3.1 By Robert Winch,Peter Mularien, a great book, which teaches all practiced features of Spring safety including LDAP authentication together with authorization inward neat details. 

If you lot are developing secure corporation application inward Java together with considering boundary security, this is the i of the best together with must read majority on Spring Security.

Steps to Map LDAP groups to Authorities for Role based Access Control (RBAC)

1) Create an Application specific Authority classes, ordinarily an enum alongside values similar APP_USER, APP_ADMIN

2) Create Authority Mapper which volition Map LDAP groups to application specific authorization for representative if grouping inward LDAP is "Application Access (Gn)" than mapping that to APP_USER.

3) If you lot are authenticating against Active directory than render your custom Authority mapper to ActiveDirectoryLdapAuthenticationProvider. After successful authentication, it volition charge all the groups for which authenticated user_id is fellow member of, together with map alongside application specific authority.

4) Use application specific government or roles equally APP_USER or APP_ADMIN to secure your URL's yesteryear using

<intercept-url pattern="/secure/admin/**" access="hasRole('APP_ADMIN')"/>

<intercept-url pattern="/secure/user/**" access="hasRole('APP_USER')"/>

<intercept-url pattern="/secure/**" access="isAuthenticated()" />

Java code for Mapping LDAP Groups to Authorities using Spring Security

Here is the Java code, required to map LDAP groups into granted government of Spring Security. We demand i class, ordinarily enum to create roles supported yesteryear our application, this must implement GrantedAuthority interface, which is used to stand upwards for role inward Spring Security. Now nosotros demand a Mapper class to map LDAP groups into granted authorities, this class must implement GrantedAuthoritiesMapper interface. We create event of this class using Spring together with render names of LDAP groups for mapping alongside a exceptional role. For example, if application has two  roles USER together with ADMIN together with LDAP grouping "Application User Access (Gn)" is for User together with "Application Admin Access (Gn)" is for Admin, together with hence this information is configured inward Spring configuration file together with this authorization mapper is provided to LDAP authentication provider. Keeping application role carve upwards from LDAP groups allows you lot to create create upwards alongside whatsoever modify inward LDAP grouping name, you lot simply demand to modify your boundary configuration file.

LDAPGrantedAuthoritiesMapper.java

import java.util.Collection;

import java.util.EnumSet;

import java.util.Set;

import org.springframework.security.core.GrantedAuthority;

import org.springframework.security.core.authority.mapping.GrantedAuthoritiesMapper;

/**

 * LDAP Authorities mapper, Maps LDAP groups to APP_USER together with APP_ADMIN

 */

public class LDAPGrantedAuthoritiesMapper implements GrantedAuthoritiesMapper {

    private concluding String APP_USER ="Ldap User Group";   //default user ldap group

    private concluding String APP_ADMIN ="Ldap Admin Group"; //default adming ldap group

    public ADGrantedAuthoritiesMapper(String userGroup, String adminGroup) {

        APP_USER = userGroup;

        APP_ADMIN = adminGroup;

    }

    public Collection  mapAuthorities(

            final Collection authorities) {

        Set roles = EnumSet.noneOf(LDAPAuthority.class); //empty EnumSet

        for (GrantedAuthority authorization : authorities) {

            if (APP_USER.equals(authority.getAuthority())) {

                roles.add(LDAPAuthority.APP_USER);

            } else if (APP_ADMIN.equals(authority.getAuthority())) {

                roles.add(LDAPAuthority.APP_ADMIN);

            }

        }

        return roles;

    }

}

LDAPAuthority.java

import org.springframework.security.core.GrantedAuthority;

/**

 * Maps LDAP Group application roles

 */

public enum LDAPAuthority implements GrantedAuthority{

    APP_USER, APP_ADMIN; //roles used inward application

    public String getAuthority() {

        return name();

    }

}

Spring Security Configuration for Role based Access together with Mapping LDAP groups

As stated above, get-go configuration is creating an event of LDAPGrantedAuthoritiesMapper together with mapping LDAP groups to application roles, hence that when a user is successfully authenticated together with comes alongside all LDAP groups, he is fellow member of, those groups are read together with converted into corresponding roles. Second configuration is to render this mapper to ActiveDirectoryLdapAuthenticationProvider, this is similar to our lastly representative of LDAP authentication, except <beans:property name="authoritiesMapper" ref="ldapAuthoritiesMapper"/>, which is requite to map LDAP groups to granted government for role based access control.

<beans:bean id="ldapAuthoritiesMapper" class="com.abc.web.security.LDAPGrantedAuthoritiesMapper">

        <beans:constructor-arg value="Ldap User Group" />

        <beans:constructor-arg value="Ldap Admin Group" />

</beans:bean>   

<beans:bean id="LdapAuthProvider"  class="org.springframework.security.ldap.authentication.ad.ActiveDirectoryLdapAuthenticationProvider">

        <beans:constructor-arg ref="domain" />

        <beans:constructor-arg ref="url" />

        <beans:property name="convertSubErrorCodesToExceptions" value="true"/>

        <beans:property name="authoritiesMapper" ref="ldapAuthoritiesMapper"/>   //LDAP authorization mapper

        <beans:property name="useAuthenticationRequestCredentials" value="true"/>

</beans:bean

 

That's all you lot demand to implement Role based access command on your Spring MVC, Spring Security based Java spider web application. Like other features, LDAP authorization doesn't come upwards out of box from Spring Security together with you lot demand to follow higher upwards steps to map LDAP groups to granted authorities.

Further Reading
Spring Framework 5: Beginner to Guru
Spring Master Class - Beginner to Expert
Spring Security Fundamentals yesteryear Bryan Hassen
Learn Spring Security iv Basic hands on

Recommended Book:

Spring Security 3.1 By Robert Winch,Peter Mularien is i of the best together with must read majority on Spring security, fifty-fifty for experienced developers. It takes application evolution approach to instruct basics of corporation security, LDAP concepts, authentication, authorization together with several other boundary safety features alongside not footling examples.

P.S. - If you lot are an experienced Java/JEE Program together with desire to larn Spring Security end-to-end, I recommend Learn Spring Security class yesteryear Eugen Paraschiv, The definitive guide to secure your Java application. It's useful for both junior together with experienced Java Web developers.