Spring Security: JDBC Authentication example

Below is an example configuration using the WebSecurityConfigurerAdapter with an embedded DataSource that is initialized with the default schema and has a single user:

@Configuration

public class SecurityConfiguration extends WebSecurityConfigurerAdapter {

    @Bean

    public DataSource dataSource() {

        return new EmbeddedDatabaseBuilder()

            .setType(EmbeddedDatabaseType.H2)

            .build();

    }

    @Override

    protected void configure(AuthenticationManagerBuilder auth) throws Exception {

        UserDetails user = User.withDefaultPasswordEncoder()

            .username("user")

            .password("password")

            .roles("USER")

            .build();

        auth.jdbcAuthentication()

            .withDefaultSchema()

            .dataSource(dataSource())

            .withUser(user);

    }

}

The recommended way of doing this is registering a JdbcUserDetailsManager bean:

@Configuration

public class SecurityConfiguration {

    @Bean

    public DataSource dataSource() {

        return new EmbeddedDatabaseBuilder()

            .setType(EmbeddedDatabaseType.H2)

            .addScript(JdbcDaoImpl.DEFAULT_USER_SCHEMA_DDL_LOCATION)

            .build();

    }

    @Bean

    public UserDetailsManager users(DataSource dataSource) {

        UserDetails user = User.withDefaultPasswordEncoder()

            .username("user")

            .password("password")

            .roles("USER")

            .build();

        JdbcUserDetailsManager users = new JdbcUserDetailsManager(dataSource);

        users.createUser(user);

        return users;

    }

}

Note: In these examples, we use the method User.withDefaultPasswordEncoder() for readability. It is not intended for production and instead we recommend hashing your passwords externally. One way to do that is to use the Spring Boot CLI as described in the reference documentation.