Well, speaking a lot about the authority's rules, privileges to control user level access and user
level actions that he or she can perform in any secure application.
But if you ask me, where does all these authorities are rules, privileges, details are stored inside
string security, the answer is user details itself.
If you can remember from the previous videos, User Details is a contract which is maintained by Sprink
Security, where all the details associated to end user will be stored.
It includes is authentication details, username, email, password along with the authorities.
So inside user details interface.
If you go unchecked, we have a method called Get Authorities and it will return a collection of granter
authority.
Granted, authority is again an interface which has a single method called Get Authority, which will
return the authority name in a string format.
This indicates a single user can have multiple authorities.
The rules like as a user, I mean how both read write authorities in such scenarios, user details has
the flexibility to maintain all my authority details detailed in its collection.
And we store all these authorities detailed using Granton Authority interface.
And inside this interface we have a method called Cat Authority, which will be called by spring security
at the right time to fetch the name of the authority and try to compare with other configurations or
business logic that you have implemented.
So let's try to go and see inside the code.
All this person interfaces.
No, we are inside the user details interface.
As you can see, there is a method called Get Authorities, which will return a collection of objects
which implements grant authority interface.
I can go on to insert granted authority interface is a single matter called Cat Authority, which will
give you my authority in the string format.
We have many implementations of granted authority.
One such is.
Simply granted authority, as you can see, it, is a class which implements granted authority and it
has a method called get authority, which will return the role or authority in the string format.
So you can call it whatever name you want, like a role or authority at the end.
All these details are related to authorization or user level controlling access inside your application.
Let's try and go inside our previous implementation that we have built here.
I'm not going with a default user details manager like this user details manager.
So if you are going with in-memory or elab or JBC user details manager, your return type will be user
details where the authorities also will be stored.
But here previously we have implemented our own authentication provider, which will expect an authentication
object as a return type.
As you can remember from our previous sections, authentication also is one of the schema representation
of the user and inside this interface also we have the same method like user details here.
You can see putting authentication.
I'm trying to load user details with email address.
Once I have customer details, I will verify his password.
Once the passwords, everything is verified, I will try to load his role details from the database
and convert it into a simple grantor authority.
And while retaining this authentication object, I pass a username, password and authorities.
So now my frame hotspring security.
How and access to these authorities using gate authorities method.
Now we know how this authorities insert spring security will be stored and how those details will be
loaded by the spring security.
Let's try to see in the next video how I can really configure authorization of my An application like
this user with this Rulz only should be able to access this Apapa.
Thank you and get you in the next room by.