In this video, let's try to look into how spring security internally handles authorisation and authentication.
So in industry, we call authentication in the short form with art and and authorization with the form.
So that's a heading that I would use to make you aware of it.
So coming to the Point Home Springs Security internally handles exactly.
An underwater authorization is an optional step in any application.
Like there are a good number of applications where they just want to authenticate the person or authenticate
the user.
They don't have a complex requirements like they want to control the actions or pages, display the
data based upon the user access and roles in such scenarios.
They will go with only authentication.
But majority of the applications, particularly if your application having thousands of users, then
obviously there's a good chance that you may have a requirement to control the user actions and display
of the data based upon the rules and authorities.
So in such scenarios only, we configure authorization inside the Springsure.
As we know from previous sections, all the user related contract contracting schema is stored inside
user details.
So that's what will happen as soon as a user interface credentials authentication filter will intercept
the request.
And it will call the method like law user by user name and try to validate it with the credentials are
correct or not.
If the credentials are correct, all the user details excluding password will be stored in the user
detailed keema implementation and it will be stored inside the security context once it is stored inside
the security context.
And if you have configured authorization inside your framework, we will see how to configure authorization,
the coming videos.
But for now, assume if you configure our transition inside, our application authorization filter also
will come into picture and it will try to load the user details from the security context.
And when I say user details, along with his name and email and all other details, it will also load
authorities are rules that user associated based upon those values.
It will try to compare whether this particular user has access to perform this action or not.
Only if he has access, then it will allow the business execution to the associated Apapa that you are
like in the scenarios we have bots like admin dashboard and based upon the rules that we configure,
the authorization filter will allow them to execute further.
Otherwise it will throw an error for the two, three, four billion error we have discussed on a high
level.
Hotspring security handles transition scenarios in the next video.
Let's try to understand where exactly this authorization details like Rolt authorities will be stored
inside the user detailed schema.
Thank you.
And by.