We have discussed security, architecture and its internal flaw previously in the Section one, we have
seen how ring security handles the request that comes in terms of authorizing and authenticating.
During that discussion, we came to know user detail service and password encoder are the important
interfaces that helps in maintaining the user details and validating them.
That means if someone provides some credentials, these two user detail services and password and take
the responsibility of validating whether the username and password entered by user is correct or not.
So in this section, let's try to explore more on user user details of password encoders and how to
create multiple users for our application.
The problem with the current application that we have developed in the previous section is it has only
a single user that we configured in the application that is ideally most of our application conservate
with a single user.
Your application should support as many users as we want, along with the rules authorities to achieve
that.
Let's go to our project security config class where we previously customized our bot level security
using matches.
So since here we want to customize our user details and user detail services users and password and
coders, we have to override another method provided by spring security framework under this class Web
security Conficker adapter with the same name Conficker.
But the difference between the operation and this one is the input argument.
The upper one will accept extra security and the lawyer will accept authentication manageable.
So this is a matter where if we want to customize your user user detailed password encoders along with
authentication providers.
So this is a matter where we have to customize, let's try to configure multiple users.
So this is the code that we have to write.
If you want to configure your own users and multiple users, as you will see here, for now, we are
going to use in-memory authentication.
That means all these users that we want to maintain will be stored inside memory of its print container,
which will be leveraged by spring security while performing authentication and authorization details.
First, we have to select in-memory authentication, and whenever we want to add and user, we have
to call the method with user.
And what is a user name followed by DOT Password and the user password along with the authorities that
the user want to maintain.
Like in this scenario, we have an admin user who should have admin authorities and at the same time,
if you want to configure multiple users, you can also configure by using an end operator, followed
by same code like with user password and authorities where I have configured another user called normal
user with the same password.
But his authorities are the level of target.
And at the same time, whenever we are using user details and whenever we are trying to customize the
user details by default, definitely we should pass the password in order.
If you are not passing the password and code, spring security will throw an error.
I don't know how to validate your password.
Use your password is stored as a normal text, or is it encoded or encrypted inside the memory of the
shipping container?
It does not.
That's why we should always pass the password encoder.
Along with Vannatter.
We try to customize the user details.
So previously we have not provided and we didn't try to customize this entire method that way.
Spring security went ahead and use the users password present in this property file and it also considers
default password encoded here.
I'm saying I will be using password encoder, which is of no password and that means I don't want to
have any passwords and codes will show as a deep because this is not recommended.
But since we are enhancing our application by step by step final, I'm just configuring password and
code as no Ostrower and I don't know that.
Let's try to add our application by going to the main springboard application.
I'll change the class name and the.
His name compared to our previous section, so that we can maintain the same consistent last name for
all the for the sections.
So what I will do is I click on and select one as our application.
So now I have my service started.
So this time it's go to end browser and try to validate on our parts.
So we send our notices but should be executed.
So obviously it wouldn't hurt us any correction.
But if I want to access my account, I will ask the correction.
I'll type first the corrections that we mentioned in the application properties and it will not accept
because now we have provided our own users inside the security configuration glass here I can type at
one two for free as a password which will allow or I can also enter other normal user that I have configured
with this user.
One, two, three, four, five.
Did you see now we came from where we maintained single static user to your position where we can maintain
any number of users that we want inside a security configuration.
But this is not the production ready application.
But I just wanted to show you inside the memory of our application.
Also, we can maintain the user's details daily.
In any production environment.
We maintain all sorts of details inside database or OLAP or any other conflicts.
But in this scenario, since the application that we are trying to enhance step by step, I have I want
to show first that we can also maintain the memory of that Springbrook application with that.
Now we know how to configure multiple users and how to pass a password encoder associated to my user
details.
Thank you.
And you in the next release by.