Role Based Access Command Using Confine Safety As Well As Mvc, Mapping Ldap Groups To Government For Authorization

Authentication as well as Authorization is integral share of whatever Java firm or spider web application. Since most of the companionship uses LDAP Active directory for authentication, authorization as well as Role based access command (RBAC), it's skillful to know How to implement Role based access command using Spring MVC as well as Spring Security. This is the minute share of my articles on using Spring Security for authentication as well as authorization inwards Spring MVC based Java application. In lastly part, nosotros stimulate got learned close doing LDAP authentication against Windows active directory, and inwards this Spring Security tutorial, nosotros volition larn How to map LDAP groups to regime for implementing Role based access command or authorization. If you lot are developing an application, whose access is controled yesteryear adding user to a special LDAP group, as well as hence you lot demand a machinery to charge those LDAP grouping afterwards successful authentication. Spring Secuirty uses GrantedAuthority flat for holding all roles for a special user. 

Based upon these roles, a special user tin perform certainly functionality inwards your application. For example, a read solely user tin solely encounter data, but a user alongside ADMIN role, tin add together or take information from your application. 

After implementing Role based access control, you lot are gratis of user administration task, those volition live taken attention yesteryear respective squad which manages LDAP groups as well as access, commonly Windows back upward teams. 

In this article, nosotros volition all the steps required to map LDAP groups to granted regime inwards Spring Security. If you lot honey to read books, than you lot may desire to check Spring Security 3.1 By Robert Winch,Peter Mularien, a great book, which teaches all skillful features of Spring safety including LDAP authentication as well as authorization inwards cracking details. 

If you lot are developing secure firm application inwards Java as well as considering boundary security, this is the ane of the best as well as must read majority on Spring Security.

Steps to Map LDAP groups to Authorities for Role based Access Control (RBAC)

1) Create an Application specific Authority classes, commonly an enum alongside values similar APP_USER, APP_ADMIN

2) Create Authority Mapper which volition Map LDAP groups to application specific potency for instance if grouping inwards LDAP is "Application Access (Gn)" than mapping that to APP_USER.

3) If you lot are authenticating against Active directory than supply your custom Authority mapper to ActiveDirectoryLdapAuthenticationProvider. After successful authentication, it volition charge all the groups for which authenticated user_id is fellow member of, as well as map alongside application specific authority.

4) Use application specific regime or roles every bit APP_USER or APP_ADMIN to secure your URL's yesteryear using

<intercept-url pattern="/secure/admin/**" access="hasRole('APP_ADMIN')"/>

<intercept-url pattern="/secure/user/**" access="hasRole('APP_USER')"/>

<intercept-url pattern="/secure/**" access="isAuthenticated()" />

Java code for Mapping LDAP Groups to Authorities using Spring Security

Here is the Java code, required to map LDAP groups into granted regime of Spring Security. We demand ane class, commonly enum to exercise roles supported yesteryear our application, this must implement GrantedAuthority interface, which is used to stand upward for role inwards Spring Security. Now nosotros demand a Mapper flat to map LDAP groups into granted authorities, this flat must implement GrantedAuthoritiesMapper interface. We exercise instance of this flat using Spring as well as supply names of LDAP groups for mapping alongside a special role. For example, if application has two  roles USER as well as ADMIN as well as LDAP grouping "Application User Access (Gn)" is for User as well as "Application Admin Access (Gn)" is for Admin, as well as hence this information is configured inwards Spring configuration file as well as this potency mapper is provided to LDAP authentication provider. Keeping application role divide from LDAP groups allows you lot to deal upward alongside whatever alter inwards LDAP grouping name, you lot only demand to alter your boundary configuration file.

LDAPGrantedAuthoritiesMapper.java

import java.util.Collection;

import java.util.EnumSet;

import java.util.Set;

import org.springframework.security.core.GrantedAuthority;

import org.springframework.security.core.authority.mapping.GrantedAuthoritiesMapper;

/**

 * LDAP Authorities mapper, Maps LDAP groups to APP_USER as well as APP_ADMIN

 */

public flat LDAPGrantedAuthoritiesMapper implements GrantedAuthoritiesMapper {

    private terminal String APP_USER ="Ldap User Group";   //default user ldap group

    private terminal String APP_ADMIN ="Ldap Admin Group"; //default adming ldap group

    public ADGrantedAuthoritiesMapper(String userGroup, String adminGroup) {

        APP_USER = userGroup;

        APP_ADMIN = adminGroup;

    }

    public Collection  mapAuthorities(

            final Collection authorities) {

        Set roles = EnumSet.noneOf(LDAPAuthority.class); //empty EnumSet

        for (GrantedAuthority potency : authorities) {

            if (APP_USER.equals(authority.getAuthority())) {

                roles.add(LDAPAuthority.APP_USER);

            } else if (APP_ADMIN.equals(authority.getAuthority())) {

                roles.add(LDAPAuthority.APP_ADMIN);

            }

        }

        return roles;

    }

}

LDAPAuthority.java

import org.springframework.security.core.GrantedAuthority;

/**

 * Maps LDAP Group application roles

 */

public enum LDAPAuthority implements GrantedAuthority{

    APP_USER, APP_ADMIN; //roles used inwards application

    public String getAuthority() {

        return name();

    }

}

Spring Security Configuration for Role based Access as well as Mapping LDAP groups

As stated above, offset configuration is creating an instance of LDAPGrantedAuthoritiesMapper as well as mapping LDAP groups to application roles, hence that when a user is successfully authenticated as well as comes alongside all LDAP groups, he is fellow member of, those groups are read as well as converted into corresponding roles. Second configuration is to supply this mapper to ActiveDirectoryLdapAuthenticationProvider, this is similar to our lastly instance of LDAP authentication, except <beans:property name="authoritiesMapper" ref="ldapAuthoritiesMapper"/>, which is requite to map LDAP groups to granted regime for role based access control.

<beans:bean id="ldapAuthoritiesMapper" class="com.abc.web.security.LDAPGrantedAuthoritiesMapper">

        <beans:constructor-arg value="Ldap User Group" />

        <beans:constructor-arg value="Ldap Admin Group" />

</beans:bean>   

<beans:bean id="LdapAuthProvider"  class="org.springframework.security.ldap.authentication.ad.ActiveDirectoryLdapAuthenticationProvider">

        <beans:constructor-arg ref="domain" />

        <beans:constructor-arg ref="url" />

        <beans:property name="convertSubErrorCodesToExceptions" value="true"/>

        <beans:property name="authoritiesMapper" ref="ldapAuthoritiesMapper"/>   //LDAP potency mapper

        <beans:property name="useAuthenticationRequestCredentials" value="true"/>

</beans:bean

 

That's all you lot demand to implement Role based access command on your Spring MVC, Spring Security based Java spider web application. Like other features, LDAP authorization doesn't come upward out of box from Spring Security as well as you lot demand to follow higher upward steps to map LDAP groups to granted authorities.

Further Reading
Spring Framework 5: Beginner to Guru
Spring Master Class - Beginner to Expert
Spring Security Fundamentals yesteryear Bryan Hassen
Learn Spring Security iv Basic hands on

Recommended Book:

Spring Security 3.1 By Robert Winch,Peter Mularien is ane of the best as well as must read majority on Spring security, fifty-fifty for experienced developers. It takes application evolution approach to learn basics of firm security, LDAP concepts, authentication, authorization as well as several other boundary safety features alongside not lilliputian examples.

P.S. - If you lot are an experienced Java/JEE Program as well as desire to larn Spring Security end-to-end, I recommend Learn Spring Security class yesteryear Eugen Paraschiv, The definitive guide to secure your Java application. It's useful for both junior as well as experienced Java Web developers.

Share this post