By now, we have spent enough time understanding spring security, user management interfaces, class
and default implementations provided by spring security like in memory user details, manager Judy PC
user details manager.
And we all just so like what is the importance of user details where it maintains the contact and schema
of the user?
And what is user detailed service and what is user manager?
So as of now, we aligned ourselves with the spring framework and we fugitivity user details, manager
and in memory detail to user manager to perform authentication.
But in this video, let's try to create our own custom table hasbara requirement and change spring security
behavior by implementing user detail service where I can tell spring framework.
These are my table and these are my column names which are not similar to what you are maintaining in
such a framework.
But still, I want to leverage them to perform authentication so far that let's quickly go ahead and
create a new table in the database.
I'm just running use is bank and now I'm creating a new table here.
The table name is customer and I have an email and password which I intentionally put the column name
SPW.
And instead of authorities, I just put as a rule, suppose that I will insert a rule also for our testing
purpose.
I'm inserting one email, which is John, a direct example dot com followed by password.
Also, this time I change to request five, four, three, two, one.
And the rule is admin.
So now we have a new table and we also insert the card inside.
So one thing that you have to observe here is we are not following spring security conventions like
my table name is not user, it is customer.
And at the same time I don't have a username and password columns, but instead I have my own columns
like email and PWP, which indicates password I use.
So now let's go to the code and try to do some changes to the new table that we have created.
For that, we are going to use a repository framework to perform Crota operations onto the database.
If we are aware of J-P, it's more than enough.
But if you are new to the JP, there is no worry here.
I will make sure that your understanding whatever is needed for storing security perspective.
So the very first thing that I have to do is in JP, I have to create the Bojo class, which indicate
our presence in database table.
So in this scenario, my table name is customer.
So I met my class to customer and whenever you mark direct entity.
So this represents Springboard and [REMOVED] that this class is a representation of a database table with
the name customer.
And at the same time we have declared in the database ideas auto generated and Primerica.
That's where I have used these two annotations which tell a framework that this is a primary key and
you have to generate sequence number one, that we are trying to insert a new record into the database
for this customer table.
Bozkurt, we should also create Java variables similar to column names where I am just maintaining the
same names like email, BWB, and if there is a change in the name, then Kippie cannot detect to which
column you are trying to refer.
But if there is a scenario where you want to maintain different Java variable name and different database
column, there is always a direct column annotation which you can leverage to mention which column you
are speaking about.
But in this scenario, since we are good to go with whatever we have created in the database, I'm just
keeping the team and Bozak that we should have it.
That doesn't satisfy the customer.
Now we have created a representation of my customer Taperoo.
Now I should have a repository also.
So in J-P we have a great repository repository, which are the classes and interfaces which will help
me to perform Crota operations on to my table.
So in this scenario, I'm creating an interface called Customer Repository, which extends current repository
provided by spring to be a framework.
Here I have to give an indication that this repository is specific to customer people.
That's why go and use the customer for class that are in the class that I have created previously.
And the primary key is of type along the beauty of Japanese.
You don't have to write my if cual statements to fetch records or to update or insert records.
For example, here I just wanted to fetch the records from my customer table based upon e-mail of the
user.
So here my customer repository already knows this is the table name and when I say fine by yeaman to
G.P.A. internally regenerator implementation of this abstract method and it will be the Escuela Statman
whatever condition having email is equal to so-and-so or whatever input we are providing.
So that's the beauty of.
So here I'm saying fine by him.
If I say fine by email and password then since there is a unconditioned in my method name.
So G.P.A. is Martynov to detect that their condition should have both email and password.
And the return type of this method is a list of customers who may get one customer on more than one
customer based upon the email.
So now we have implemented the repository and at the same time we have an entity class, so we have
enough G.P.A. details to fetch records from customer table.
Next, as we are discussing in the previous reviews, Spring Framework understand users details that
we provide like here.
I'm just having the user details in terms of customer.
But spring security can't understand that in order to make us bring security to understand, we should
always create a class which implements user details interface.
For that, I have created the same customer with a different name security customer, which implements
user details.
So obviously whenever we are implementing user details, we have to override all these methods and implement
like what is a good password.
Get username is a concern expressed so by default for all of them I have put through because in our
application we don't have a requirement to perform some logic to indicate whether the account is logged
or expired or enabled.
So that way, for now, this matters always indicate a return true value.
That means there is no negative action will be performed on the user.
Now, on top of that, we have three important methods, which is get user name, get password and get
authorities.
So these are the methods will be called by spring security while performing authentication operation.
So far that what I have done is I have wrapped my customer object or class inside this and would want
to create a user which can be understand by spring security.
They have to call the security customer by using it constructor along with the customer Poggio object
that we have created previously.
So once we have done that, I'm saying password you can get by going into the get BWB column and at
the same time user name also.
I'm saying you can get by going to get email.
That means to.
We are following two different naming conventions like spring security.
Always expect you to maintain your user credentials as username and password spelling.
But here we are maintaining it as email and PWP.
So this is how you spell framework to maintaining different naming conventions.
You can go ahead and use the these details present, insert a custom.
Similarly for authorities, we are taking roles inside customer and converting them into granted authority
and returning to the spring frame.
So now we have user representation of our customer table also, which is security customer.
Now, what I will do is I will go ahead and implement user detail service aspart requirement.
So in this scenario, I'm not implementing user details manager because I don't have a requirement of
creating, deleting, updating or changing passwords.
Such requirements in my application.
I always have a requirement to validate the user is not.
So.
That's right.
I just going with the user details service.
But you are free to do some Hanton on user details manager, and you can implement all other methods
provided by you, but here I can show you how we can implement one method, the similar ways you can
easily adopt for other methods inside user details manager.
If we have such requirement and we can always refer sample implementations of user details, manager
and in-memory as a reference whenever you have such requirements to implement user details.
So here I have only one method inside it, which is law user by user, and this method will always return
user details type object.
So here my framework knows that I haven't sample user detailed service implementation and that's where
it will always use this as a current user details and it will never go to the default implementations.
So since there are a couple of things, that framework will take it in this scenario, since I am implementing
User Detail Service, this is a bank user details service will be the current implementation and it
will call for user by user name and runtime.
And at the same time, since security customer, which implements user details, it will consider this
is the user representation for this application.
So once we have that call is happening, we take that user name and we call our fine by email, which
is inside our repository interface.
And that will go ahead and look into the database with the email and we give me a customer list objects
since in this scenario we always have only one object.
I'm just calling security customer constructor, bypassing the first customer that I'm getting from
the list and it will return the same.
And framework will not complain because my security customer is implemented by user details only.
That's why there is no complaint.
And at the same time, if I don't have any results, I should always throw this exception, which is
user name, not for decryption, which indicates to framework that these user is not a valid user and
we should not accept his credentials and stop his access to the application by throwing bad error,
which is a four zero authentication ever.
Now we have done enough configurations.
Let's try to go to specific security config and come into this, because right now we don't need this.
We have implemented our own custom user database.
And in the easy backend application, which is the main application I have added, these two, which
are specific to JPA to enable J-P repositories, will scan for all repositories present inside our application.
So in this scenario, we have a customer repository and entity scan.
Annotation will help you to scan all our entities associated with the database tables and we have customer
such.
And that's why we have to use these two configurations since they are in the separate package compared
to what this means.
Class present.
No, we are good to go.
I mean, go ahead and start the server in, debug more clicking on Debuggers Java application.
So before that, I'll also keep a breakpoint in this method to confirm that framework is calling this
method only for doing authentication.
So now are server also started?
Let's go to Groser and try to offer me logging on to the application.
So I called my account service, which will direct me to login page here.
First, let me call with some random credentialled, which is admin one, two, three, four, five
and what is happening to my method.
So in this scenario, there is no user with the username.
I mean, if you see in database we maintain humility, but here we are getting a different value.
So this should return zero customers which will satisfy this condition.
So and it will turn user name not from exception, which will result in a valid credentials.
Error on the you know, let me ask you that.
We do have maintained in the database, which is gone to the right example, dot com followed by.
Password is five, four, three, two.
What game breakpoint will stop here?
So this time, let's see, we should get a response with a valid customer.
There you go.
We have one customer details and his e-mail and password, everything.
What we do is we just typecasts our customer into a security customer and return to a framework and
framework will validate.
And that's one of my concern with this is how we how to implement in a scenario where you want to customize
your spring security framework as part of a requirement.
So in this scenario, I just showed you how to override and implement user details.
That is applicable.
Same for user details manager.
Also, in the case of user details manager, you will take responsibility of creating any user updating,
deleting everything.
So that truly depends upon application to application what you want to override.
If we have any questions, please post in the Q&A, but I sincerely advise you to follow me and do coding
along with me and not typing the code the course.
The reason is that will delay or extend the time of this entire course and few people may feel bored
if I take each and every letter inside, because that's why I'm making sure of explaining each and every
code line that I am writing.
But I would always recommend you to possibly do and do the same coding inside your own laptop so that
you understand how the things are working.
And at the same time, I'm also attaching the order that we have developed to the course of sections
every time we are done with this specific section.
So please download that, take them as a reference and see if we are getting any different to address
our issues.
But I would always advise you to do practice on your own while watching these calls.
Thank you.
And see you in the next section by.