In this video, let's try to see actually how to configure authorities for any application.
So there are many ways how we can configure authorities in cyberspace security framework, a few of
them using the methods like has authority, has any authority access method, so has authority method
will accept a single authority value for which the user will be validated.
Whether he or she has that authority, then only they will be allowed to access that endpoint.
Whereas has any endpoint means you can pass multiple values like we right delete.
And if the user has any of those authorities configure for them, then they will be allowed to access
the endpoint.
At the same time, if we have a very complex condition where you can configure using simple approach,
like has authority, has any authority, we can leverage access method which will accept expression
based upon string expression language.
It provides you unlimited possibilities, like any complex scenarios that I want to have a scenario
where a user who has delayed access but not right access should be able to access this.
But then in such scenarios, we can use access method and leverage logical operators as well, like
our own, not for our authorization configurations.
So let's try to go to the court and do some simple configuration and performing testing around it to
understand the things around authority in a more clear manner.
This is the previous configuration that we have done for all the years that we have.
We protect the users.
My account, my balance, my lords, my cards use the various notices and contract is permitted for
everyone without authentication.
So when there is no authentication, there is no authorization that we can confirm.
Due to that reason, we can't configure authorization for open.
You are URLs like notices and contact, but we can perform or configure authorization for the security
URLs like my account.
My balance here, instead of an indicator like authenticated, indicates any person who is authenticator
can access this.
You are, but I don't want to access to be all the users.
I want to have a look only for particular users who has specific authority for such scenarios.
I can remove this authenticator, which is free form of accessing the URL for all the authenticated
users.
Instead, I will use has authority here.
I can say someone who has obtained authority can access my account.
Similarly, I can mention my balance can be accessed by someone who has authority of free for my loans.
I would say delete the names, are you not?
We like we have to follow this.
This is a string.
We can configure any value that we want.
And at the same time, my card, I'm saying could be access to everyone who authenticated success.
Now how configure the authorization in order to validate first for a particular user, we should configure
authorities inside database.
Let's try to go to the database and understand how we can do this.
Previously, we have a customer table where we have customer details like email, password and his role.
But here you can see we can only configure one role or one authority.
But we want to have a scenario where a single user can have multiple authorities and tools for such
scenarios.
We can go with a single table, but we should create one more table where we can store.
All our authorities often use it for that purpose.
I have created a table call authorities and insert a few records for the customer happy and the customer
happy has authorities called, write and read and authorities and customer has a foreign key relationship
using customer ID.
So now we configure in the database but a single customer.
We have many authorities configure the scripts associated to this table.
Creation records in session, I hope mentioned in script start a school inside the workspace.
Now we have been database configuration.
How what a configuration for that we have to do some changes.
So inside our customer entity.
That one too many mapping between customers and authorities entity, and that's where you can see here,
one too many, I'm mapping by a variable customer in the authority entity and which state should be
eager, so eager, which means so whenever I'm trying to load customer details, I want to load the
authority details as well by the chip.
And since it's a multiple values, we can have that where we are having a set and Jason ignore this
will make sure that we are not passing a product is detailed to the Frankton so that people who are
using the front end will not know what a thought is a particular user has.
This is for security concerns.
Similarly, we can go and check the authority in detail.
So here we have a table defined our priorities and we have a name where we define a positive name for
each and every record and we configure many to one, like multiple authorities can be mapped to a single
customer.
That's why we have mentioned many to one, and the joint column is customarily between both authority
and customer.
With this, we have done JPA configuration also.
Now, let's try to go to our authentication provider here.
Right now we are using the roll column mentioned inside our customer table, but now we change it to
a different able call authorities for the same reason we should get prole, we should call get authorities
to.
What we can do is how created a helper method granted to authorities which will accept the set of authorities
and convert them into a list of granted a certificate.
What I will do here is I can call, get granter authorities and pass and after my dog get the first
customer ID card and passes through these details.
And now we don't need these two statements here with this.
You can see here we will take the authorities from the database and we try to see by each record, by
record and created and simply granted authority by passing the authority, which is of timestream.
So now my spring security also hold the authorities details.
When someone tried to access this end point, it will try to validate whether the particular user has
this authority or not.
So in these examples, you can see a user happy who has rules, read and write stuff up that we can
mention as right now the user happy, who has authority to read and write, can access this to End Point
and my cards as well, and users as well, because my cards and users are allowed for any user authenticated
user, whereas my account, my balance, my loans are allowed only based upon authority and IP does
not have the authority to delete.
He should not be able to access my loans.
But so let's try to test that typing this over.
You server also started successfully, it may try to launch it under the credentials, kicking, signing,
but now I'm clicking on OK, I should be able to access yes.
I go back and clicking on my account, my balance, and I should be able to access I'm able to access
it.
But coming loans I should have an authority to access.
But since I don't have in this scenario, I should get another four zero three, which indicates I'm
not authorized to use this feature.
Clicking on launch and you can see nothing is coming and you can go and play in the console.
We get a response from someone saying that four zero three, which indicates that this user is not authorized
to access Mylan's.
But with this, we understand how to configure authorities and how to validate it.
Here you can see a single user has multiple priorities like I read delete, but you can use rules to
club all sorts of priorities and create a rule indicating all touch privileges that the user can have
a mean role.
Admin can read delete.
Right, whereas a role user should be able to retrieve that data.
If we have such a requirement where I want to group all my privileges or authorities under rules, then
we also have role based authentication and authorization in bring security.
Let's try to understand how we can do that in the next room.
Thank you.
And by.