We have seen in the previous videos both in the authentication, Maneesha, and authentication provider,
so there is a method called authentication which accepts and returns authentication object.
So that means this authentication object is very crucial to the framework whenever it wants to perform
any authentication, often user.
So let's try to understand what is this authentication object and how it is different from user detailed
interface or object that we have discussed previously, along with the user details, service and password.
And so authentication interface.
It implements principle interface, which is from the Java API.
So principle is an interface from Java Security API and it has only one method which indicates the name
of the user.
But coming to the authentication interface, it has various methods like get authorities or the authorities
associated for this user, get credentials, which usually represents the password of the user, get
detailed the additional details that we want to maintain associated for this user, like the IP address
he's trying to log in any such additional details we can maintain and fetch it from the get details
method and get principle is the one which is extended from this principle interface.
And using that principle will come to know the name of the user and is authenticated is the one which
maintained by the framework for the user is authenticated.
So by default, this value is false.
But of the successful authentication this is authenticated will be changed to prove, and this will
continuously maintained by the framework at various stages of the authentication and authenticated.
So this is the method that we use when we want to change the authentication of the user is true or false.
So now we understand authentication is an important interface maintained by the security and it has
all the associated details of an user while performing authentication.
So let's try to look into the core also, as I was saying, authentication, interface principle.
And this is from the our library.
It has only one which retains the name of user and entity that we have methods like authorities to understand
the authorities associated with the user, followed by get credentials.
Usually this is the password of the user, followed by additional details that we want to maintain using
get details and get principle.
Usually referred to the user name and is authenticated is a boolean, which indicates whether the user
is logged in successfully or not.
And authenticated is a method which we call whenever we want to update the is authenticated boolean.
So now we understand this is the ID object that maintained by this being security.
But if you remember from our previous implementation inside our application, we are dealing with user
details.
So if I go to my user detail service implementation of my application, we are calling your user by
user name and it will retain user details.
And we know by default, setting security really leverages Davo authentication provider.
But how the conversion between this user details and authentication is happening.
Let's try to look into the code by going to the Davo authentication provider.
I'm just going to the authentication provider and we don't have authenticate method inside this, which
will be called by the manager that is being maintained inside this class, which is tracked user details,
authentication provider.
I go to the complicated matter from this authenticate method.
It call will go to the retrieve user.
So it is implemented inside our transaction provider itself.
Here you can see by default, this is calling my user details service, which is Implementor and the
return type is user details.
OK, so and that type of user also user details.
Let's try to backtrace and the way the conversion is happening here, we are capturing the user.
And if you come down so this is the place where it will convert this user to an authentication object.
If you go and look into this creates a complication, the return type is automatically.
And leverages that he's received from our user detailed surveys, and it is converting into a type of
username, password authentication toker.
So this is an implementation of a product application which internally extends protection.
That means as long as you retaining this, since it is implementing authentication interface itself,
the framework will not complain.
And by the way, our user details is converting into authentication details.
But you may ask, what is the need of authentication and user details?
Two different mechanisms to maintain the similar user details.
The answer is spring security.
Want to give you that flexibility at each and every layer.
So my user details manager and user detail service will leverage my user details, whereas my authentication
manager and the authentication provider, they always leverage authentication interface.
So that's why spring security always give you the flexibility of maintaining aspart your requirement.
But if you don't want user details to be maintained, you can always free to customize the authentication
provider aspart requirement and free to use directly the authentication object.
So now we understand what is authentication authentication provider in the last few videos.
So let's try to implement and customize authentication provider based upon our custom requirements inside
our application and see how it works.
Thank you.
And see you in the next review by.