Spring and more Kafka

In the last post, we saw how to integrate Kafka with Spring Boot application. The post was a very simple implementation of Kafka. The real world is much more complex. You have to deal with multiple topics, you need multiple partitions. In this post, we explore more details of a spring boot application with Kafka.

Let's start with the fact that we have multiple topics that we are dealing with. The very first thing that we need to do is to separate out the properties for each of the topics.

	spring.kafka.topic1.bootstrap-servers=localhost:9092
	spring.kafka.topic1.consumer.group-id=firstGroupId
	spring.kafka.topic2.bootstrap-servers=localhost:9092
	spring.kafka.topic2.consumer.group-id=secondGroupId

view raw application-kafka-multiple.properties hosted with ❤ by GitHub

We can no longer use default KafkaTemplate, we will have to create our own. The best way is to define a KafkaProducer. To create a KafkaProducer, we need to create KarkaProducerConfig. Here are two sets of KafkaProducerConfig class, one each for the topic.

	package in.springframework.blog.tutorials.configs;
	import in.springframework.blog.tutorials.Constants;
	import org.apache.kafka.clients.producer.ProducerConfig;
	import org.apache.kafka.common.serialization.StringSerializer;
	import org.springframework.beans.factory.annotation.Value;
	import org.springframework.context.annotation.Bean;
	import org.springframework.kafka.core.DefaultKafkaProducerFactory;
	import org.springframework.kafka.core.KafkaTemplate;
	import org.springframework.kafka.core.ProducerFactory;
	import org.springframework.stereotype.Component;
	import java.util.HashMap;
	import java.util.Map;
	@Component
	public class FirstTopicProducerConfig {
	@Value("${spring.kafka.topic1.bootstrap-servers:localhost}")
	private String bootstrapAddress;
	public ProducerFactory<String, String> producerFactory() {
	Map<String, Object> configProps = new HashMap<>();
	configProps.put(
	ProducerConfig.BOOTSTRAP_SERVERS_CONFIG,
	bootstrapAddress);
	configProps.put(
	ProducerConfig.KEY_SERIALIZER_CLASS_CONFIG,
	StringSerializer.class);
	configProps.put(
	ProducerConfig.VALUE_SERIALIZER_CLASS_CONFIG,
	StringSerializer.class);
	return new DefaultKafkaProducerFactory<>(configProps);
	}
	@Bean(name = Constants.FIRST_TOPIC_TEMPLATE_NAME)
	public KafkaTemplate<String, String> kafkaTemplate() {
	return new KafkaTemplate<>(producerFactory());
	}
	}

view raw FirstTopicProducerConfig.java hosted with ❤ by GitHub

	package in.springframework.blog.tutorials.configs;
	import in.springframework.blog.tutorials.Constants;
	import org.apache.kafka.clients.producer.ProducerConfig;
	import org.apache.kafka.common.serialization.StringSerializer;
	import org.springframework.beans.factory.annotation.Value;
	import org.springframework.context.annotation.Bean;
	import org.springframework.kafka.core.DefaultKafkaProducerFactory;
	import org.springframework.kafka.core.KafkaTemplate;
	import org.springframework.kafka.core.ProducerFactory;
	import org.springframework.stereotype.Component;
	import java.util.HashMap;
	import java.util.Map;
	@Component
	public class SecondTopicProducerConfig {
	@Value("${spring.kafka.topic2.bootstrap-servers:localhost}")
	private String bootstrapAddress;
	public ProducerFactory<String, String> producerFactory() {
	Map<String, Object> configProps = new HashMap<>();
	configProps.put(
	ProducerConfig.BOOTSTRAP_SERVERS_CONFIG,
	bootstrapAddress);
	configProps.put(
	ProducerConfig.KEY_SERIALIZER_CLASS_CONFIG,
	StringSerializer.class);
	configProps.put(
	ProducerConfig.VALUE_SERIALIZER_CLASS_CONFIG,
	StringSerializer.class);
	return new DefaultKafkaProducerFactory<>(configProps);
	}
	@Bean(name = Constants.SECOND_TOPIC_TEMPLATE_NAME)
	public KafkaTemplate<String, String> kafkaTemplate() {
	return new KafkaTemplate<>(producerFactory());
	}
	}

view raw SecondTopicProducerConfig.java hosted with ❤ by GitHub

Looking at the producer config, we can observe that we create two beans which are qualified by names and return an appropriate KafkaTemplate which is later used to send the message. Similar to producer config, we need to create consumer config. Consumer config is used by the listener to listen for the message.

	package in.springframework.blog.tutorials.configs;
	import org.apache.kafka.clients.consumer.ConsumerConfig;
	import org.apache.kafka.common.serialization.StringDeserializer;
	import org.springframework.beans.factory.annotation.Value;
	import org.springframework.context.annotation.Bean;
	import org.springframework.context.annotation.Configuration;
	import org.springframework.kafka.annotation.EnableKafka;
	import org.springframework.kafka.config.ConcurrentKafkaListenerContainerFactory;
	import org.springframework.kafka.core.ConsumerFactory;
	import org.springframework.kafka.core.DefaultKafkaConsumerFactory;
	import java.util.HashMap;
	import java.util.Map;
	@EnableKafka
	@Configuration
	public class FirstTopicConsumerConfig {
	@Value("${spring.kafka.topic1.bootstrap-servers:localhost}")
	private String bootstrapAddress;
	@Value("${spring.kafka.topic1.group-id:firstgroup}")
	private String groupId;
	public ConsumerFactory<String, String> consumerFactory() {
	Map<String, Object> props = new HashMap<>();
	props.put(
	ConsumerConfig.BOOTSTRAP_SERVERS_CONFIG,
	bootstrapAddress);
	props.put(
	ConsumerConfig.GROUP_ID_CONFIG,
	groupId);
	props.put(
	ConsumerConfig.KEY_DESERIALIZER_CLASS_CONFIG,
	StringDeserializer.class);
	props.put(
	ConsumerConfig.VALUE_DESERIALIZER_CLASS_CONFIG,
	StringDeserializer.class);
	return new DefaultKafkaConsumerFactory<>(props);
	}
	@Bean(name="firstTopicListenerContainerFactory")
	public ConcurrentKafkaListenerContainerFactory<String, String>
	kafkaListenerContainerFactory() {
	ConcurrentKafkaListenerContainerFactory<String, String> factory
	= new ConcurrentKafkaListenerContainerFactory<>();
	factory.setConsumerFactory(consumerFactory());
	return factory;
	}
	}

view raw FirstTopicConsumerConfig.java hosted with ❤ by GitHub

	package in.springframework.blog.tutorials.configs;
	import org.apache.kafka.clients.consumer.ConsumerConfig;
	import org.apache.kafka.common.serialization.StringDeserializer;
	import org.springframework.beans.factory.annotation.Value;
	import org.springframework.context.annotation.Bean;
	import org.springframework.context.annotation.Configuration;
	import org.springframework.kafka.annotation.EnableKafka;
	import org.springframework.kafka.config.ConcurrentKafkaListenerContainerFactory;
	import org.springframework.kafka.core.ConsumerFactory;
	import org.springframework.kafka.core.DefaultKafkaConsumerFactory;
	import java.util.HashMap;
	import java.util.Map;
	@EnableKafka
	@Configuration
	public class SecondTopicConsumerConfig {
	@Value("${spring.kafka.topic2.bootstrap-servers:localhost}")
	private String bootstrapAddress;
	@Value("${spring.kafka.topic2.group-id:secondgroup}")
	private String groupId;
	public ConsumerFactory<String, String> consumerFactory() {
	Map<String, Object> props = new HashMap<>();
	props.put(
	ConsumerConfig.BOOTSTRAP_SERVERS_CONFIG,
	bootstrapAddress);
	props.put(
	ConsumerConfig.GROUP_ID_CONFIG,
	groupId);
	props.put(
	ConsumerConfig.KEY_DESERIALIZER_CLASS_CONFIG,
	StringDeserializer.class);
	props.put(
	ConsumerConfig.VALUE_DESERIALIZER_CLASS_CONFIG,
	StringDeserializer.class);
	return new DefaultKafkaConsumerFactory<>(props);
	}
	@Bean(name="secondTopicListenerContainerFactory")
	public ConcurrentKafkaListenerContainerFactory<String, String>
	kafkaListenerContainerFactory() {
	ConcurrentKafkaListenerContainerFactory<String, String> factory
	= new ConcurrentKafkaListenerContainerFactory<>();
	factory.setConsumerFactory(consumerFactory());
	return factory;
	}
	}

view raw SecondTopicConsumerConfig.java hosted with ❤ by GitHub

As we can see in each of the consumer configs, we create a bean which returns a ConcurrentKafkaListenerContainerFactory. The beans are qualified by a name so that we can use an appropriate container factory for receiving messages.
We also modify the MyTopicMessage and add a member variable topicName that will help us distinguish the topic to which the message needs to be sent.

	package in.springframework.blog.tutorials.pojos;
	import in.springframework.blog.tutorials.Constants;
	public class MyTopicMessage {
	public MyTopicMessage() {
	}
	public MyTopicMessage(String message, Constants.TOPIC_NAME topicName) {
	this.message = message;this.topicName = topicName;
	}
	public String getMessage() {
	return message;
	}
	public void setMessage(String message) {
	this.message = message;
	}
	public Constants.TOPIC_NAME getTopicName() {
	return topicName;
	}
	public void setTopicName(Constants.TOPIC_NAME topicName) {
	this.topicName = topicName;
	}
	private String message;
	private Constants.TOPIC_NAME topicName;
	}

view raw MyTopicMessage.java hosted with ❤ by GitHub

We also modify the endpoint so that the message can be sent to the appropriate topic.

	package in.springframework.blog.tutorials.endpoints;
	import in.springframework.blog.tutorials.Constants;
	import in.springframework.blog.tutorials.MyConstants;
	import in.springframework.blog.tutorials.pojos.MyTopicMessage;
	import lombok.extern.slf4j.Slf4j;
	import org.apache.log4j.Level;
	import org.apache.log4j.Logger;
	import org.springframework.beans.factory.annotation.Autowired;
	import org.springframework.beans.factory.annotation.Qualifier;
	import org.springframework.http.MediaType;
	import org.springframework.kafka.core.KafkaTemplate;
	import org.springframework.security.access.prepost.PreAuthorize;
	import org.springframework.util.concurrent.ListenableFutureCallback;
	import org.springframework.web.bind.annotation.RequestBody;
	import org.springframework.web.bind.annotation.RequestMapping;
	import org.springframework.web.bind.annotation.RequestMethod;
	import org.springframework.web.bind.annotation.RestController;
	@RestController
	@RequestMapping("/send")
	public class MyTopicMessageSenderEndpoint {
	@Autowired
	@Qualifier(Constants.FIRST_TOPIC_TEMPLATE_NAME)
	private KafkaTemplate firstKafkaTemplate;
	@Autowired
	@Qualifier(Constants.SECOND_TOPIC_TEMPLATE_NAME)
	private KafkaTemplate secondKafkaTemplate;
	Logger logger = Logger.getLogger(MyTopicMessageSenderEndpoint.class);
	@RequestMapping(method = RequestMethod.POST, produces = MediaType.APPLICATION_JSON_VALUE)
	@PreAuthorize(MyConstants.ANNOTATION_ROLE_USER)
	public String sendMessage(@RequestBody MyTopicMessage message) {
	switch(message.getTopicName()) {
	case FirstTopic:
	firstKafkaTemplate.send(Constants.FIRST_TOPIC, message.getMessage()).addCallback(new ListenableFutureCallback() {
	@Override
	public void onFailure(Throwable throwable) {
	logger.log(Level.INFO, String.format("Message '%s' failed!", message.getMessage()));
	}
	@Override
	public void onSuccess(Object o) {
	logger.log(Level.INFO, String.format("Message '%s' sent successfully!", message.getMessage()));
	}
	});
	break;
	case SecondTopic:
	secondKafkaTemplate.send(Constants.SECOND_TOPIC, message.getMessage()).addCallback(new ListenableFutureCallback() {
	@Override
	public void onFailure(Throwable throwable) {
	logger.log(Level.INFO, String.format("Message '%s' failed!", message.getMessage()));
	}
	@Override
	public void onSuccess(Object o) {
	logger.log(Level.INFO, String.format("Message '%s' sent successfully!", message.getMessage()));
	}
	});
	break;
	}
	return "Success!";
	}
	}

view raw MyTopicMessageSenderEndpoint.java hosted with ❤ by GitHub

Now we modify the Listener to integrate everything so that the appropriate message can be received. Look at @KafkaListener annotation, we pass on the ListenerContainerFactory as an argument to receive a message from a queue.

	package in.springframework.blog.tutorials.listeners;
	import org.apache.logging.log4j.LogManager;
	import org.apache.logging.log4j.Logger;
	import org.springframework.kafka.annotation.KafkaListener;
	import org.springframework.kafka.support.KafkaHeaders;
	import org.springframework.messaging.handler.annotation.Header;
	import org.springframework.messaging.handler.annotation.Payload;
	import org.springframework.stereotype.Component;
	@Component
	public class KafkaMessageListener {
	Logger logger = LogManager.getLogger(KafkaMessageListener.class);
	@KafkaListener(topics = "FirstTopic", containerFactory = "firstTopicListenerContainerFactory")
	public void processFirstTopicMessage(@Payload String content,
	@Header(KafkaHeaders.RECEIVED_PARTITION_ID) int partition,
	@Header(KafkaHeaders.RECEIVED_TOPIC) String topic) {
	logger.info(String.format("Received %s message for partition %d ", topic, partition) + content);
	}
	@KafkaListener(topics = "SecondTopic", containerFactory = "secondTopicListenerContainerFactory")
	public void processSecondTopicMessage(@Payload String content,
	@Header(KafkaHeaders.RECEIVED_PARTITION_ID) int partition,
	@Header(KafkaHeaders.RECEIVED_TOPIC) String topic) {
	logger.info(String.format("Received %s message for partition %d ", topic, partition) + content);
	}
	}

view raw KafkaMessageListener.java hosted with ❤ by GitHub

Now we can test the server. The flow of the service is as below.

1. The message is posted to the endpoint as a POST request
2. The @RestController receives the message and based on the topicName in the request, it sends to message to the topic with the same name.
3. The listener receives the message from the appropriate queue.

$ curl -X POST \
>   'http://localhost:8081/send?token=3193fa24-a0ba-451b-83ff-eb563c3fd43b-cdf12811-7e41-474b-8fa6-e8fefd4a738c' \
>   -H 'Content-Type: application/json' \
>   -H 'Postman-Token: 15fbe075-9c80-4af9-a797-6b5e0979fd1b' \
>   -H 'cache-control: no-cache' \
>   -H 'token: 3193fa24-a0ba-451b-83ff-eb563c3fd43b-cdf12811-7e41-474b-8fa6-e8fefd4a738c' \
>   -d '{
> "message" : "This is my message!",
> "topicName" : "FirstTopic"
> }'
Success!

The message receipt is indicated in the server log.

2019-04-12 14:50:47.142  INFO 51396 --- [ntainer#0-0-C-1] i.s.b.t.listeners.KafkaMessageListener   : Received FirstTopic message for partition 0 This is my message!

Similarly, we can send a message to SecondTopic.

$ curl -X POST   'http://localhost:8?token=3193fa24-a0ba-451b-83ff-eb563c3fd43b-cdf12811-7e41-474b-8fa6-e8fefd4a738c'   -H 'Content-Type: application/json'   -H 'Postman-Token: 15fbe075-9c80-4af9-a797-6b5e0979fd1b'   -H 'cache-control: no-cache'   -H 'token: 3193fa24-a0ba-451b-83ff-eb563c3fd43b-cdf12811-7e41-474b-8fa6-e8fefd4a738c'   -d '{
"message" : "This is another message!",
"topicName" : "SecondTopic"
}'
Success!

The message receipt is indicated in the server log.

2019-04-12 14:53:14.972  INFO 51396 --- [ntainer#1-0-C-1] i.s.b.t.listeners.KafkaMessageListener   : Received SecondTopic message for partition 0 This is another message!

The complete code base for this tutorial can be found at my github repository at v1.4.

Kafka and Spring

Kafka has become a very popular platform and is being used as a stream, journal and even eventing system. In this post, we explore how to integrate Kafka with spring framework application. First, we add the Kafka bootstrap server details in the application.properties file.

	spring.kafka.bootstrap-servers=localhost:9092
	spring.kafka.consumer.group-id=ofs

view raw application-kafka.properties hosted with ❤ by GitHub

Let's also add dependencies in pom.xml.

	<dependency>
	<groupId>org.springframework.kafka</groupId>
	<artifactId>spring-kafka</artifactId>
	</dependency>
	<dependency>
	<groupId>org.apache.kafka</groupId>
	<artifactId>kafka-clients</artifactId>
	</dependency>

view raw pom-kafka.xml hosted with ❤ by GitHub

Now, for each Kafka topic, we create a listener class. The listener class provides a callback method that is called when any message is retrieved on that topic.

	package in.springframework.blog.tutorials.listeners;
	import in.springframework.blog.tutorials.Constants;
	import org.apache.logging.log4j.LogManager;
	import org.apache.logging.log4j.Logger;
	import org.springframework.beans.factory.annotation.Value;
	import org.springframework.kafka.annotation.KafkaListener;
	import org.springframework.stereotype.Component;
	@Component
	public class MyTopicKafkaListener {
	Logger logger = LogManager.getLogger(MyTopicKafkaListener.class);
	@KafkaListener(topics = Constants.MY_TOPIC)
	public void processMessage(String content) {
	logger.info("Received Promise message " + content);
	}
	}

view raw MyTopicKafkaListener.java hosted with ❤ by GitHub

Now we create an endpoint through which we inject a message in the queue. The message is sent to the queue and is retrieved by the listener.

	package in.springframework.blog.tutorials.endpoints;
	import in.springframework.blog.tutorials.Constants;
	import in.springframework.blog.tutorials.MyConstants;
	import in.springframework.blog.tutorials.pojos.MyTopicMessage;
	import org.springframework.beans.factory.annotation.Autowired;
	import org.springframework.http.MediaType;
	import org.springframework.kafka.core.KafkaTemplate;
	import org.springframework.security.access.prepost.PreAuthorize;
	import org.springframework.web.bind.annotation.RequestBody;
	import org.springframework.web.bind.annotation.RequestMapping;
	import org.springframework.web.bind.annotation.RequestMethod;
	import org.springframework.web.bind.annotation.RestController;
	@RestController
	@RequestMapping("/send")
	public class MyTopicMessageSenderEndpoint {
	@Autowired
	private KafkaTemplate kafkaTemplate;
	@RequestMapping(method = RequestMethod.POST, produces = MediaType.APPLICATION_JSON_VALUE)
	@PreAuthorize(MyConstants.ANNOTATION_ROLE_USER)
	public String createUser(@RequestBody MyTopicMessage message) {
	kafkaTemplate.send(Constants.MY_TOPIC, message.getMessage());
	return "Message sent successfully!.";
	}
	}

view raw MyTopicMessageSenderEndpoint.java hosted with ❤ by GitHub

We autowire a KafkaTemplate instance that is used to send the message to the queue.

$ curl -X POST \
>   'http://localhost:8081/send?token=3193fa24-a0ba-451b-83ff-eb563c3fd43b-cdf12811-7e41-474b-8fa6-e8fefd4a738c' \
>   -H 'Content-Type: application/json' \
>   -H 'Postman-Token: e281e3c5-0dae-4bb7-ac8d-6555f66a18c6' \
>   -H 'cache-control: no-cache' \
>   -H 'token: 3193fa24-a0ba-451b-83ff-eb563c3fd43b-cdf12811-7e41-474b-8fa6-e8fefd4a738c' \
>   -d '{
> "message" : "This is my message!"
> }'
Message sent successfully!.

The receipt of message is indicated in the spring server log.

2019-04-10 14:28:03.969  INFO 31091 --- [ntainer#0-0-C-1] i.s.b.t.listeners.MyTopicKafkaListener   : Received Promise message This is my message!

Spring Boot and Docker Containers

With microservices based deployment, the first step is to dockerize your software. In our case, we want to create docker images for each of our microservices so that we can orchestrate them better. I have decided to use container registry provided by Google to build and upload the images.

	<properties>
	<docker.image.prefix>rae</docker.image.prefix>
	</properties>
	<dependencyManagement>
	<dependencies>
	<!-- https://mvnrepository.com/artifact/org.springframework.cloud/spring-cloud-dependencies -->
	<dependency>
	<groupId>org.springframework.cloud</groupId>
	<artifactId>spring-cloud-dependencies</artifactId>
	<version>Greenwich.RELEASE</version>
	<type>pom</type>
	<scope>import</scope>
	</dependency>
	</dependencies>
	</dependencyManagement>
	<dependencies>
	<dependency>
	<groupId>org.springframework.cloud</groupId>
	<artifactId>spring-cloud-config-server</artifactId>
	</dependency>
	</dependencies>
	<build>
	<plugins>
	<plugin>
	<groupId>com.spotify</groupId>
	<artifactId>dockerfile-maven-plugin</artifactId>
	<version>1.4.10</version>
	<executions>
	<execution>
	<id>default</id>
	<goals>
	<goal>build</goal>
	<goal>push</goal>
	</goals>
	</execution>
	</executions>
	<configuration>
	<repository>gcr.io/${docker.gcp.project}/${docker.image.prefix}/${project.artifactId}</repository>
	<tag>${project.version}</tag>
	<buildArgs>
	<JAR_FILE>${project.build.finalName}.jar</JAR_FILE>
	</buildArgs>
	</configuration>
	</plugin>
	</plugins>
	</build>

view raw pom-docker.xml hosted with ❤ by GitHub

The first thing we need to do is to create a dependency to spring-cloud-dependencies pom. Then we add a dependency to spring-cloud-config-server. Then we add a dockerfile-maven-plugin. Now we need to keep in mind that in the configuration for dockerfile-maven-plugin we need to provide the repository. If can see that our repository starts with gcr.io/. This makes sure that the image after creation is pushed to the container registry hosted by Google. If you want to have some other registry, you need to provide it in the form hostname:portnumber.
Now we can issue the following command the docker image would be build and pushed to google registry.

$ mvn deploy -DskipTests
[INFO] 
[INFO] --- dockerfile-maven-plugin:1.4.10:push (default) @ customer ---
[INFO] Using Google application default credentials
[INFO] loaded credentials for user account with clientId=764086051850-6qr4p6gpi6hn506pt8ejuq83di341hur.apps.googleusercontent.com
[INFO] The push refers to repository [gcr.io/myproject/rae/customer]
[INFO] Image 967d96afcc46: Preparing
[INFO] Image 36e051842720: Preparing
[INFO] Image d1646aaa6540: Preparing
[INFO] Image 19382582b926: Preparing
[INFO] Image 41715d8d7d2b: Preparing
[INFO] Image f3a38968d075: Preparing
[INFO] Image a327787b3c73: Preparing
[INFO] Image 5bb0785f2eee: Preparing
[INFO] Image f3a38968d075: Waiting
[INFO] Image a327787b3c73: Waiting
[INFO] Image 5bb0785f2eee: Waiting
[INFO] Image 36e051842720: Layer already exists
[INFO] Image 41715d8d7d2b: Layer already exists
[INFO] Image d1646aaa6540: Layer already exists
[INFO] Image 19382582b926: Layer already exists
[INFO] Image 967d96afcc46: Pushing
[INFO] Image a327787b3c73: Layer already exists
[INFO] Image 5bb0785f2eee: Layer already exists
[INFO] Image f3a38968d075: Layer already exists
[INFO] Image 967d96afcc46: Pushed
[INFO] 0.0.1-SNAPSHOT: digest: sha256:f6bad4811f867dd75225797bee684ea43c0ddaf2b83de1b419a9f75e9a3941bc size: 2001
[INFO] ------------------------------------------------------------------------
[INFO] BUILD SUCCESS
[INFO] ------------------------------------------------------------------------
[INFO] Total time: 47.638 s
[INFO] Finished at: 2019-03-10T19:58:27+05:30
[INFO] Final Memory: 55M/857M
[INFO] ------------------------------------------------------------------------

We can see below that the image is now pushed to google container registry.

$ docker images
REPOSITORY                     TAG                 IMAGE ID            CREATED             SIZE
gcr.io/myproject/rae/customer   0.0.1-SNAPSHOT      a566e2f28705        19 seconds ago      518MB
gcr.io/myproject/rae/customer                       8c61d1a5aef4        13 minutes ago      518MB

12. Adding GIT release information

In the previous post, we saw how to enable actuator endpoints on our spring server. Once we have done that, it is a good idea to add GIT release information to the server in order to get the information related to the currently deployed server at runtime.
We add the git-commit-id-plugin to our pom.xml.

   <plugin>
    <groupid>pl.project13.maven</groupid>
    <artifactid>git-commit-id-plugin</artifactid>
    <version>2.2.1</version>
   </plugin>

The next things to do is to create a git.properties file in the resource directory of the project.

	# git.properties
	git.tags=${git.tags}
	git.branch=${git.branch}
	git.dirty=${git.dirty}
	git.remote.origin.url=${git.remote.origin.url}
	git.commit.id=${git.commit.id}
	git.commit.id.abbrev=${git.commit.id.abbrev}
	git.commit.id.describe=${git.commit.id.describe}
	git.commit.id.describe-short=${git.commit.id.describe-short}
	git.commit.user.name=${git.commit.user.name}
	git.commit.user.email=${git.commit.user.email}
	git.commit.message.full=${git.commit.message.full}
	git.commit.message.short=${git.commit.message.short}
	git.commit.time=${git.commit.time}
	git.closest.tag.name=${git.closest.tag.name}
	git.closest.tag.commit.count=${git.closest.tag.commit.count}
	git.build.user.name=${git.build.user.name}
	git.build.user.email=${git.build.user.email}
	git.build.time=${git.build.time}
	git.build.host=${git.build.host}
	git.build.version=${git.build.version}

view raw git.properties hosted with ❤ by GitHub

The git-commit-id is added by the maven plugin so it is a good idea to build the project using maven.

$ mvn clean package -DskipTests

Now we can run the server and check the /manage/info endpoint using curl command.

$ curl -X GET http://localhost:9091/manage/info
{"git":{"branch":"master","commit":{"id":"6fb94c0","time":1549868235.000000000}}

11. Spring Actuators

Spring provides actuators that are a helpful set of tools to debug the application on runtime. Here is how to enable them. We first add actuator dependency in the pom.xml

<dependency>
  <groupid>org.springframework.boot</groupid>
  <artifactid>spring-boot-starter-actuator</artifactid>
</dependency>

Now we define a prefix for all the actuator endpoints. We add the following line into the application.properties file. This enables all the actuator endpoints. We can enable specific endpoints by adding a comma delimited list of endpoints. We also deploy management endpoint on a separate port so that we can block its access from something like ELB.

management.endpoints.web.base-path=/manage
management.server.port=9091
management.endpoints.web.exposure.include=*

Since we already have a security filter defined, we need to exempt health and info endpoint from security check. We add the following URLs int he SecurityConfiguration configure method.

@Override
    public void configure(WebSecurity web) throws Exception {
        web.ignoring().antMatchers("/manage/health");
        web.ignoring().antMatchers("/manage/info");
        web.ignoring().antMatchers("/webjars/**");
        web.ignoring().antMatchers("/error");
        web.ignoring().antMatchers("/swagger-ui.html");
        web.ignoring().antMatchers("/v2/api-docs/**");
        web.ignoring().antMatchers("/swagger-resources/**");
    }

Here we have added paths related to error, actuator, and swagger.
This enables actuator endpoints for our server. We can query these endpoints and following is the sample response.

$ curl -X GET http://localhost:9091/manage/health
{"status":"UP"}

10. Application with multiple datasources

Many times it is a practical requirement to have multiple databases for a single application. These databases could be at different locations on the cloud and different entities in your application may be dealing with these databases.
Multi-tenancy is a great requirement when multiple data sources are needed. Many tenants may insist on having their own databases. Here we present how we can configure the spring application to interact with multiple databases.
The first step is to look at our application.properties file. We have a list of properties defined for the default dataSource which we will need to replicate for our second database. Let's assume we are going to use two data sources, the first one is called the user and the second one is called other.

	management.security.enabled=false
	#==== connect to default mysql ======#
	spring.jpa.hibernate.ddl-auto=update
	spring.datasource.url=jdbc:mysql://localhost:3306/tutorial?useSSL=false&allowPublicKeyRetrieval=true
	spring.datasource.username=tutorial
	spring.datasource.password=tutorial123
	spring.datasource.driver-class-name=com.mysql.jdbc.Driver
	spring.jpa.properties.hibernate.dialect = org.hibernate.dialect.MySQL5Dialect
	#==== connect to other mysql ======#
	other.jpa.hibernate.ddl-auto=update
	other.datasource.url=jdbc:mysql://localhost:3306/other?useSSL=false&allowPublicKeyRetrieval=true
	other.datasource.username=other
	other.datasource.password=other123
	other.datasource.driver-class-name=com.mysql.jdbc.Driver
	other.jpa.properties.hibernate.dialect = org.hibernate.dialect.MySQL5Dialect
	logging.level.org.springframework.security=DEBUG

view raw application.properties hosted with ❤ by GitHub

As we can see above, we have replicated all the data source properties and given it a new prefix, other. Now, these two databases could have completely independent settings. They could point to totally different databases. Each of these properties could be configured to completely different settings. Here we have just changed the name of the database, username, password.
To make this work. we will have to split the repositories and the entity objects for each of the data sources. Here we create the following hierarchy of packages for each of the data sources.

src/main/java
- in.springframework.blog.tutorials
 - user
    - domain
    - repository
  - other
    - domain
    - repository

As we can see for each of the data sources, we have a domain package that would contain the entities and a repository package that would contain the repository class. This is needed so that each of the entity managers only searches for its own classes.
Now we need to define a configuration of each of the data sources that we have defined. The first data source will contain the user table and will also be the primary data source.

	package in.springframework.blog.tutorials;
	import org.springframework.beans.factory.annotation.Qualifier;
	import org.springframework.beans.factory.annotation.Value;
	import org.springframework.boot.jdbc.DataSourceBuilder;
	import org.springframework.boot.orm.jpa.EntityManagerFactoryBuilder;
	import org.springframework.context.annotation.Bean;
	import org.springframework.context.annotation.Configuration;
	import org.springframework.context.annotation.Primary;
	import org.springframework.data.jpa.repository.config.EnableJpaRepositories;
	import org.springframework.orm.jpa.JpaTransactionManager;
	import org.springframework.orm.jpa.LocalContainerEntityManagerFactoryBean;
	import org.springframework.transaction.PlatformTransactionManager;
	import org.springframework.transaction.annotation.EnableTransactionManagement;
	import javax.persistence.EntityManagerFactory;
	import javax.sql.DataSource;
	import java.util.HashMap;
	import java.util.Map;
	@Configuration
	@EnableTransactionManagement
	@EnableJpaRepositories(
	entityManagerFactoryRef = "entityManagerFactory",
	basePackages = { "in.springframework.blog.tutorials.user.repository" }
	)
	public class UserDatabaseConfig {
	@Value("${spring.datasource.driver-class-name}")
	private String driverClassName;
	@Value("${spring.datasource.url}")
	private String url;
	@Value("${spring.datasource.username}")
	private String username;
	@Value("${spring.datasource.password}")
	private String password;
	@Value("${spring.jpa.hibernate.ddl-auto}")
	private String ddlAuto;
	@Value("${spring.jpa.properties.hibernate.dialect}")
	private String dialect;
	@Primary
	@Bean(name = "dataSource")
	public DataSource dataSource() {
	return DataSourceBuilder.create().driverClassName(driverClassName).url(url).username(username).password(password).build();
	}
	@Primary
	@Bean(name = "entityManagerFactory")
	public LocalContainerEntityManagerFactoryBean
	entityManagerFactory(
	EntityManagerFactoryBuilder builder,
	@Qualifier("dataSource") DataSource dataSource
	) {
	Map<String, Object> properties = new HashMap<String, Object>();
	properties.put("hibernate.hbm2ddl.auto", ddlAuto);
	properties.put("hibernate.dialect", dialect);
	return builder
	.dataSource(dataSource)
	.packages("in.springframework.blog.tutorials.user.domain")
	.persistenceUnit("userPu")
	.properties(properties)
	.build();
	}
	@Primary
	@Bean(name = "transactionManager")
	public PlatformTransactionManager transactionManager(
	@Qualifier("entityManagerFactory") EntityManagerFactory
	entityManagerFactory
	) {
	return new JpaTransactionManager(entityManagerFactory);
	}}

view raw UserDatabaseConfig.java hosted with ❤ by GitHub

As we can see in the class above, it uses all the properties prefixed with spring.datasource and scans directories related to the user data source. Now let's look at the configuration for other data source.

	package in.springframework.blog.tutorials;
	import org.springframework.beans.factory.annotation.Qualifier;
	import org.springframework.beans.factory.annotation.Value;
	import org.springframework.boot.context.properties.ConfigurationProperties;
	import org.springframework.boot.jdbc.DataSourceBuilder;
	import org.springframework.boot.orm.jpa.EntityManagerFactoryBuilder;
	import org.springframework.context.annotation.Bean;
	import org.springframework.context.annotation.Configuration;
	import org.springframework.context.annotation.Primary;
	import org.springframework.data.jpa.repository.config.EnableJpaRepositories;
	import org.springframework.orm.jpa.JpaTransactionManager;
	import org.springframework.orm.jpa.LocalContainerEntityManagerFactoryBean;
	import org.springframework.transaction.PlatformTransactionManager;
	import org.springframework.transaction.annotation.EnableTransactionManagement;
	import javax.persistence.EntityManagerFactory;
	import javax.sql.DataSource;
	import java.util.HashMap;
	import java.util.Map;
	@Configuration
	@EnableTransactionManagement
	@EnableJpaRepositories(
	entityManagerFactoryRef = "otherEntityManagerFactory",
	transactionManagerRef = "otherTransactionManager",
	basePackages = { "in.springframework.blog.tutorials.other.repository" }
	)
	public class OtherDatabaseConfig {
	@Value("${other.datasource.driver-class-name}")
	private String driverClassName;
	@Value("${other.datasource.url}")
	private String url;
	@Value("${other.datasource.username}")
	private String username;
	@Value("${other.datasource.password}")
	private String password;
	@Value("${other.jpa.hibernate.ddl-auto}")
	private String ddlAuto;
	@Value("${other.jpa.properties.hibernate.dialect}")
	private String dialect;
	@Bean(name = "otherDataSource")
	@ConfigurationProperties(prefix = "other.datasource")
	public DataSource dataSource() {
	return DataSourceBuilder.create().driverClassName(driverClassName).url(url).username(username).password(password).build();
	}
	@Bean(name = "otherEntityManagerFactory")
	public LocalContainerEntityManagerFactoryBean
	otherEntityManagerFactory(
	EntityManagerFactoryBuilder builder,
	@Qualifier("otherDataSource") DataSource dataSource) {
	Map<String, Object> properties = new HashMap<String, Object>();
	properties.put("hibernate.hbm2ddl.auto", ddlAuto);
	properties.put("hibernate.dialect", dialect);
	return builder
	.dataSource(dataSource)
	.packages("in.springframework.blog.tutorials.other.domain")
	.persistenceUnit("otherPu")
	.properties(properties)
	.build();
	}
	@Bean(name = "otherTransactionManager")
	public PlatformTransactionManager otherTransactionManager(
	@Qualifier("otherEntityManagerFactory") EntityManagerFactory
	otherEntityManagerFactory
	) {
	return new JpaTransactionManager(otherEntityManagerFactory);
	}}

view raw OtherDatabaseConfig.java hosted with ❤ by GitHub

The things to note in the other data source is that the @Primary annotation doesn't exist because we can have only one set of primary beans of a type. Also, the directories to be searched are for the other data source's domain and repository objects.
At this time we also move the old User and UserRepository classes to their respective subdirectories. We also create Other and OtherRepository classes in their respective subdirectories. We also change CrudRepository to JpaRepository in each of the repository classes.
Now, our application is set up to use two different data sources and we can verify that by running the application. Since we have set ddl-auto property to update, it should create a new schedule when the application is run.

$ mysql -u tutorial -ptutorial123 tutorial
mysql: [Warning] Using a password on the command line interface can be insecure.
Reading table information for completion of table and column names
You can turn off this feature to get a quicker startup with -A

Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 115
Server version: 8.0.12 Homebrew

Copyright (c) 2000, 2018, Oracle and/or its affiliates. All rights reserved.

Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

mysql> show tables;
+--------------------+
| Tables_in_tutorial |
+--------------------+
| hibernate_sequence |
| user               |
+--------------------+
2 rows in set (0.00 sec)

mysql> desc user;
+------------+--------------+------+-----+---------+-------+
| Field      | Type         | Null | Key | Default | Extra |
+------------+--------------+------+-----+---------+-------+
| id         | bigint(20)   | NO   | PRI | NULL    |       |
| email      | varchar(255) | YES  | UNI | NULL    |       |
| fullname   | varchar(255) | YES  |     | NULL    |       |
| password   | varchar(255) | YES  |     | NULL    |       |
| username   | varchar(255) | YES  | UNI | NULL    |       |
| auth_token | varchar(255) | YES  | UNI | NULL    |       |
| expiry     | datetime     | YES  |     | NULL    |       |
| mask       | bigint(20)   | NO   |     | NULL    |       |
| authToken  | varchar(255) | YES  |     | NULL    |       |
+------------+--------------+------+-----+---------+-------+
9 rows in set (0.00 sec)

$ mysql -u other -pother123 other
mysql: [Warning] Using a password on the command line interface can be insecure.
Reading table information for completion of table and column names
You can turn off this feature to get a quicker startup with -A

Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 116
Server version: 8.0.12 Homebrew

Copyright (c) 2000, 2018, Oracle and/or its affiliates. All rights reserved.

Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

mysql> show tables;
+--------------------+
| Tables_in_other    |
+--------------------+
| hibernate_sequence |
| other              |
+--------------------+
2 rows in set (0.00 sec)

mysql> desc other
    -> ;
+-----------+--------------+------+-----+---------+-------+
| Field     | Type         | Null | Key | Default | Extra |
+-----------+--------------+------+-----+---------+-------+
| id        | bigint(20)   | NO   | PRI | NULL    |       |
| otherData | varchar(255) | YES  |     | NULL    |       |
+-----------+--------------+------+-----+---------+-------+
2 rows in set (0.00 sec)

The source code for this tutorial is available at git repository as v1.2.

9. Role based data access

Many times we have a need to return data from an endpoint based on the role. Springframework provider easy mechanism for us to be able to do that. Let's take an example. In the previous example, we want to add a GET method in UserEndpoint that returns all the users. For any safe system, we want to return all the users if the role is ADMIN but if the role is USER then we want to return only that particular user. We don't want to write multiple methods for that purpose.

    @RequestMapping(method = RequestMethod.GET, produces = MediaType.APPLICATION_JSON_VALUE)
    @PostFilter("hasAuthority('ADMIN') or filterObject.authToken == authentication.name")
    public Iterable getUsers() {
        Iterable users = userRepository.findAll();
        return users;
    }

The method is described above. As we can see it is an extremely simple method, it calls findAll method on the repository which will return all the valid user records and returns an Iterable collection back. The interesting aspect of this method is in the @PostFilter annotation. Let's try to understand the annotation. The first condition is hasAuthority('ADMIN'). It implies that if the authenticated role is ADMIN then return the records as it is. The next bit of the filter condition uses an object called filterObject. This is an automatically defined expression that we can use in @PostAuthorize filter. A complete list of all the expressions exists here. The expression filterObject is used for each element of a collection that is returned from the endpoint. Since we know that when this endpoint is called, we would only be authenticating using authToken, the name of authentication in security context is set to the token itself. We can verify this in the code in AuthenticationFilter class.

            else {

                Optional token = getOptionalHeader(httpRequest,"token");
                TokenPrincipal authTokenPrincipal = new TokenPrincipal(token);
                processTokenAuthentication(authTokenPrincipal);
            }

The code fragment described above creates a TokenPrincipal object with the token as its name. That is the reason we have the condition filterObject.authToken == authentication.name. Taking the complete condition of @PostFilter we can see that the condition implies that return everything unconditionally if the role is ADMIN otherwise return the users with authToken as the currently authenticated user.
We have two users defined on the system. One has a role of the user and the other has a role of admin. Here are the examples of what happens when we call the endpoint with both of these users.
The first example is with a user with role USER.

$ curl -X GET "http://localhost:8081/user" -H "accept: application/json" -H "token: 3d47912d-73a0-4c4c-95e6-0486273d6221-28fa4f38-0f1b-4740-8e1d-3228288de631" | python -m json.tool
[
    {
        "authToken": "3d47912d-73a0-4c4c-95e6-0486273d6221-28fa4f38-0f1b-4740-8e1d-3228288de631",
        "email": "user@springframework.in",
        "expiry": 1548345909000,
        "fullname": "User",
        "id": 2,
        "mask": 1,
        "password": "User123",
        "username": "user"
    }
]

The second example is with a user with role ADMIN.

$ curl -X GET "http://localhost:8081/user" -H "accept: application/json" -H "token: a137dd09-11e4-4dcf-a141-0b235d39a505-60d43bf4-3674-4248-be1d-c2669f14589f" | python -m json.tool
[
    {
        "authToken": "3d47912d-73a0-4c4c-95e6-0486273d6221-28fa4f38-0f1b-4740-8e1d-3228288de631",
        "email": "user@springframework.in",
        "expiry": 1548345909000,
        "fullname": "User",
        "id": 2,
        "mask": 1,
        "password": "User123",
        "username": "user"
    },
    {
        "authToken": "a137dd09-11e4-4dcf-a141-0b235d39a505-60d43bf4-3674-4248-be1d-c2669f14589f",
        "email": "admin@springframework.in",                                                                                         
        "expiry": 1548348263000,                                                                                                     
        "fullname": "Administrator",                                                                                                 
        "id": 3,                                                                                                                     
        "mask": 4,                                                                                                                   
        "password": "Admin123",                                                                                                      
        "username": "admin"                                                                                                          
    }
]

As we can see above, the call with the role USER only returns the object related to that particular user while the call with the role returns all the users present in the system. This is how we can achieve role based object access without writing multiple endpoints.

8. That little matter of creating a user

Now that our simplified authentication system is in place, we are faced with the little matter of how to create a new user. Since we don't have a username, password, or token we can't really create a new user.
To accomplish that, we need to make some modifications to our AuthenticationFilter.  In the doFilter method, we add a special if block to take care of user creation.

            if (httpRequest.getRequestURI().toString().equals("/user") && httpRequest.getMethod().equals("POST")) {

                Optional username = getOptionalHeader(httpRequest,"username");
                UsernamePasswordPrincipal usernamePasswordPrincipal = new UsernamePasswordPrincipal(username, username, true);
                processUsernameAuthentication(usernamePasswordPrincipal);
            }
            else if (httpRequest.getRequestURI().toString().equals("/authenticate") && httpRequest.getMethod().equals("POST")) {

                Optional username = getOptionalHeader(httpRequest,"username");
                Optional password = getOptionalHeader(httpRequest,"password");
                UsernamePasswordPrincipal usernamePasswordPrincipal = new UsernamePasswordPrincipal(username, password);
                processUsernameAuthentication(usernamePasswordPrincipal);
            }

	package in.springframework.blog.tutorials;
	import com.google.gson.Gson;
	import org.apache.log4j.Level;
	import org.apache.log4j.Logger;
	import org.springframework.http.HttpStatus;
	import org.springframework.security.authentication.AuthenticationManager;
	import org.springframework.security.authentication.BadCredentialsException;
	import org.springframework.security.authentication.InternalAuthenticationServiceException;
	import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
	import org.springframework.security.core.Authentication;
	import org.springframework.security.core.AuthenticationException;
	import org.springframework.security.core.context.SecurityContextHolder;
	import org.springframework.security.web.authentication.preauth.PreAuthenticatedAuthenticationToken;
	import org.springframework.web.filter.GenericFilterBean;
	import javax.servlet.FilterChain;
	import javax.servlet.ServletException;
	import javax.servlet.ServletRequest;
	import javax.servlet.ServletResponse;
	import javax.servlet.http.HttpServletRequest;
	import javax.servlet.http.HttpServletResponse;
	import java.io.IOException;
	import java.util.Optional;
	/**
	* Created by vinay on 2/3/16.
	*/
	public class AuthenticationFilter extends GenericFilterBean {
	public static final String TOKEN_SESSION_KEY = "token";
	public static final String USER_SESSION_KEY = "user";
	private final static Logger logger = Logger.getLogger(AuthenticationFilter.class);
	private AuthenticationManager authenticationManager;
	public AuthenticationFilter(AuthenticationManager authenticationManager) {
	this.authenticationManager = authenticationManager;
	}
	/**
	* Entry point into the authentication filter. We check if the token and token cache is present, we do token based
	* authentication. Otherwise we assume it to be username and password based authentication.
	* @param request
	* @param response
	* @param chain
	* @throws IOException
	* @throws ServletException
	*/
	@Override
	public void doFilter(ServletRequest request,
	ServletResponse response,
	FilterChain chain) throws IOException, ServletException {
	HttpServletResponse httpResponse = asHttp(response);
	try {
	HttpServletRequest httpRequest = asHttp(request);
	if (httpRequest.getRequestURI().toString().equals("/user") && httpRequest.getMethod().equals("POST")) {
	Optional<String> username = getOptionalHeader(httpRequest,"username");
	UsernamePasswordPrincipal usernamePasswordPrincipal = new UsernamePasswordPrincipal(username, username, true);
	processUsernameAuthentication(usernamePasswordPrincipal);
	}
	else if (httpRequest.getRequestURI().toString().equals("/authenticate") && httpRequest.getMethod().equals("POST")) {
	Optional<String> username = getOptionalHeader(httpRequest,"username");
	Optional<String> password = getOptionalHeader(httpRequest,"password");
	UsernamePasswordPrincipal usernamePasswordPrincipal = new UsernamePasswordPrincipal(username, password);
	processUsernameAuthentication(usernamePasswordPrincipal);
	}
	else {
	Optional<String> token = getOptionalHeader(httpRequest,"token");
	TokenPrincipal authTokenPrincipal = new TokenPrincipal(token);
	processTokenAuthentication(authTokenPrincipal);
	}
	chain.doFilter(request, response);
	} catch (InternalAuthenticationServiceException e) {
	SecurityContextHolder.clearContext();
	handleExceptions(e, asHttp(response));
	logger.error("Internal authentication service exception", e);
	} catch (AuthenticationException e) {
	SecurityContextHolder.clearContext();
	handleExceptions(e, asHttp(response));
	} catch(Exception e) {
	handleExceptions(e, asHttp(response));
	}
	finally {
	}
	}
	private HttpServletRequest asHttp(ServletRequest request) {
	return (HttpServletRequest) request;
	}
	private HttpServletResponse asHttp(ServletResponse response) {
	return (HttpServletResponse) response;
	}
	private void processUsernameAuthentication(UsernamePasswordPrincipal usernamePasswordPrincipal) {
	Authentication resultOfAuthentication = tryToAuthenticateWithUsername(usernamePasswordPrincipal);
	SecurityContextHolder.getContext().setAuthentication(resultOfAuthentication);
	}
	private Authentication tryToAuthenticateWithUsername(UsernamePasswordPrincipal usernamePasswordPrincipal) {
	UsernamePasswordAuthenticationToken requestAuthentication
	= new UsernamePasswordAuthenticationToken(usernamePasswordPrincipal, usernamePasswordPrincipal.getPassword());
	return tryToAuthenticate(requestAuthentication);
	}
	private void processTokenAuthentication(TokenPrincipal tokenPrincipal) {
	Authentication resultOfAuthentication = tryToAuthenticateWithToken(tokenPrincipal);
	SecurityContextHolder.getContext().setAuthentication(resultOfAuthentication);
	}
	private Authentication tryToAuthenticateWithToken(TokenPrincipal tokenPrincipal) {
	PreAuthenticatedAuthenticationToken requestAuthentication
	= new PreAuthenticatedAuthenticationToken(tokenPrincipal, null);
	return tryToAuthenticate(requestAuthentication);
	}
	private Authentication tryToAuthenticate(Authentication requestAuthentication) {
	Authentication responseAuthentication = authenticationManager.authenticate(requestAuthentication);
	if (responseAuthentication == null || !responseAuthentication.isAuthenticated()) {
	throw new InternalAuthenticationServiceException("Unable to authenticate Domain User for provided credentials");
	}
	logger.debug("User successfully authenticated");
	return responseAuthentication;
	}
	private void handleExceptions(Exception ex, HttpServletResponse response) {
	try {
	if (ex instanceof EntityAlreadyExistsException) {
	EntityAlreadyExistsException e = (EntityAlreadyExistsException) ex;
	handleExceptionMsg(HttpStatus.UNPROCESSABLE_ENTITY.value(), e.getErrorCode(), response, e);
	} else if (ex instanceof NotFoundException) {
	NotFoundException e = (NotFoundException) ex;
	handleExceptionMsg(HttpStatus.NOT_FOUND.value(), e.getErrorCode(), response, e);
	} else {
	handleExceptionMsg(HttpStatus.UNAUTHORIZED.value(), HttpStatus.UNAUTHORIZED.value(), response, ex);
	}
	}
	catch(Exception jsonex) {
	logger.log(Level.ERROR, "Error during error generation", jsonex);
	}
	}
	private void handleExceptionMsg(int status, int errorCode, HttpServletResponse response, Exception e)
	throws IOException {
	ExceptionResponse er
	= new ExceptionResponseBuilder()
	.setStatus(status)
	.setCode(errorCode)
	.setMessage(e.getMessage())
	.setMoreInfo(String.format(MyConstants.EXCEPTION_URL,errorCode))
	.createExceptionResponse();
	response.setStatus(status);
	Gson gson = new Gson();
	String tokenJsonResponse = gson.toJson(er);
	response.addHeader("Content-Type", "application/json");
	response.getWriter().print(tokenJsonResponse);
	if (e instanceof BadRequestException ||
	e instanceof BadCredentialsException ) {
	// these are repetitive exceptions and having stacktrace in the logs does not help us..
	// rather log becomes too big.
	// Log only the message so we can keep track
	logger.error(e.getMessage());
	} else {
	// log the entire details.. we need the stack trace here...
	logger.error(tokenJsonResponse, e);
	}
	}
	private Optional<String> getOptionalParameter(HttpServletRequest httpRequest, String parameterName) {
	String[] values = httpRequest.getParameterValues(parameterName);
	if (values.length == 0) {
	return Optional.of((String)null);
	}
	return Optional.of(values[0]);
	}
	private Optional<String> getOptionalHeader(HttpServletRequest httpRequest, String headerName) {
	return Optional.of(httpRequest.getHeader(headerName));
	}
	}

view raw AuthenticationFilter.java hosted with ❤ by GitHub

As we can see the code fragment, if the call is made to /user endpoint with POST method, we look for a username header and trigger spring authentication. We also need to make a change in the UsernamePasswordPrincipal to take a flag that would tell us if the user is a new user or existing user.

	package in.springframework.blog.tutorials;
	import java.security.Principal;
	import java.util.Optional;
	/**
	* Created by vinay on 2/3/16.
	*/
	public class UsernamePasswordPrincipal implements Principal {
	public UsernamePasswordPrincipal(Optional<String> username, Optional<String> password) {
	this.username = username;
	this.password = password;
	this.newUser = false;
	}
	public UsernamePasswordPrincipal(Optional<String> username, Optional<String> password, boolean newUser) {
	this.username = username;
	this.password = password;
	this.newUser = newUser;
	}
	@Override
	public String getName() {
	return username.get();
	}
	public Optional<String> getUsername() {
	return username;
	}
	public Optional<String> getPassword() {
	return password;
	}
	public boolean isNewUser() {
	return newUser;
	}
	private final Optional<String> username;
	private final Optional<String> password;
	private final boolean newUser;
	}

view raw UsernamePasswordPrincipal.java hosted with ❤ by GitHub

Now that we have modified the principal and filter, we need to handle this in the provider. The provider that gets invoked for username and password authentication is UsernamePasswordAuthenticationProvider.
As we can see in the provider's authenticate method, we have added an if block that checks if this is a new user. In case it is a new user, we authenticate this user with a role NEWUSER. The create user endpoint is only allowed to be called for a role NEWUSER.
Now that we have stitched the path for authentication of a new user to create user endpoint, we can see the endpoint itself.

    @RequestMapping(method = RequestMethod.POST, produces = MediaType.APPLICATION_JSON_VALUE)
    @PreAuthorize(MyConstants.ANNOTATION_ROLE_NEWUSER)
    public Optional createUser(@RequestHeader(value="username") String username, @RequestBody User user) {
        user.setMask(Role.USER.ordinal());
        User storedUser = userRepository.save(user);
        storedUser.setPassword(null);
        return Optional.of(storedUser);
    }

As we can see, we have a @PreAuthorize added with NEWUSER role. We also set the role of the user to the USER. Before returning the response, we set the password to null.
This fixes our service to allow the creation of a new user. The complete code is available tagged as v1.1 for this and previous posts.

	package in.springframework.blog.tutorials;
	import org.springframework.beans.factory.annotation.Autowired;
	import org.springframework.http.MediaType;
	import org.springframework.security.access.prepost.PostFilter;
	import org.springframework.security.access.prepost.PreAuthorize;
	import org.springframework.web.bind.annotation.*;
	import javax.persistence.EntityNotFoundException;
	import java.util.List;
	import java.util.Optional;
	@RestController
	@RequestMapping("/user")
	public class UserEndpoint {
	@Autowired
	private UserRepository userRepository;
	@RequestMapping(value = "", method = RequestMethod.GET, produces = MediaType.APPLICATION_JSON_VALUE)
	@PostFilter("hasRole('ADMIN') or filterObject.username == authentication.name")
	public Iterable<User> getUsers() {
	return userRepository.findAll();
	}
	@RequestMapping(value = "/{idOrUserNameOrEmail}", method = RequestMethod.GET, produces = MediaType.APPLICATION_JSON_VALUE)
	public Optional<User> getUser(@PathVariable("idOrUserNameOrEmail") String idOrUserNameOrEmail) {
	return retrieveUser(idOrUserNameOrEmail);
	}
	@RequestMapping(method = RequestMethod.POST, produces = MediaType.APPLICATION_JSON_VALUE)
	@PreAuthorize(MyConstants.ANNOTATION_ROLE_NEWUSER)
	public Optional<User> createUser(@RequestHeader(value="username") String username, @RequestBody User user) {
	user.setMask(Role.USER.ordinal());
	User storedUser = userRepository.save(user);
	storedUser.setPassword(null);
	return Optional.of(storedUser);
	}
	@RequestMapping(value = "/{idOrUserNameOrEmail}", method = RequestMethod.DELETE, produces = MediaType.APPLICATION_JSON_VALUE)
	public Optional<User> deleteUser(@PathVariable("idOrUserNameOrEmail") String idOrUserNameOrEmail) {
	Optional<User> optionalUser = retrieveUser(idOrUserNameOrEmail);
	if (optionalUser.isPresent()) {
	userRepository.delete(optionalUser.get());
	return optionalUser;
	}
	throw new EntityNotFoundException(String.format("%s user not found.", idOrUserNameOrEmail));
	}
	@RequestMapping(value = "/{idOrUserNameOrEmail}",
	method = RequestMethod.PATCH,
	produces = MediaType.APPLICATION_JSON_VALUE)
	public Optional<User> patchUser(@PathVariable("idOrUserNameOrEmail") String idOrUserNameOrEmail,
	@RequestBody User user) {
	Optional<User> optionalUser = retrieveUser(idOrUserNameOrEmail);
	if (optionalUser.isPresent()) {
	User storedUser = optionalUser.get();
	if (user.getEmail() != null) {
	storedUser.setEmail(user.getEmail());
	}
	if (user.getFullname() != null) {
	storedUser.setFullname(user.getFullname());
	}
	if (user.getPassword() != null) {
	storedUser.setPassword(user.getPassword());
	}
	return Optional.of(userRepository.save(storedUser));
	}
	throw new EntityNotFoundException(String.format(String.format("User with id %s is not found", idOrUserNameOrEmail)));
	}
	private Optional<User> retrieveUser(String idOrUserNameOrEmail) {
	try {
	Long id = Long.parseLong(idOrUserNameOrEmail);
	Optional<User> optionalUser = userRepository.findById(id);
	if (optionalUser.isPresent()) {
	return optionalUser;
	}
	}
	catch(NumberFormatException e) {
	}
	Optional<User> optionalUser = userRepository.findUserByEmail(idOrUserNameOrEmail);
	if (optionalUser.isPresent()) {
	return optionalUser;
	}
	optionalUser = userRepository.findUserByUsername(idOrUserNameOrEmail);
	return optionalUser;
	}
	}

view raw UserEndpoint.java hosted with ❤ by GitHub

7. Enabling Swagger

Before we proceed any further, let's enable swagger on our service so that testing it becomes easy. The first step is to add springfox dependencies.

	<dependency>
	<groupId>io.springfox</groupId>
	<artifactId>springfox-swagger2</artifactId>
	<version>2.9.2</version>
	</dependency>
	<dependency>
	<groupId>io.springfox</groupId>
	<artifactId>springfox-swagger-ui</artifactId>
	<version>2.9.2</version>
	</dependency>

view raw springfox-pom.xml hosted with ❤ by GitHub

Now that we have dependencies added, we need to define a swagger configuration. Most of our endpoint will need to have a token passed as HTTP header, we need to configure our swagger configuration to facilitate that.

	package in.springframework.blog.tutorials;
	import org.springframework.context.annotation.Bean;
	import org.springframework.context.annotation.Configuration;
	import org.springframework.web.servlet.config.annotation.ResourceHandlerRegistry;
	import org.springframework.web.servlet.config.annotation.WebMvcConfigurationSupport;
	import springfox.documentation.builders.ParameterBuilder;
	import springfox.documentation.builders.RequestHandlerSelectors;
	import springfox.documentation.schema.ModelRef;
	import springfox.documentation.spi.DocumentationType;
	import springfox.documentation.spring.web.plugins.Docket;
	import springfox.documentation.swagger2.annotations.EnableSwagger2;
	import java.util.Arrays;
	@Configuration
	@EnableSwagger2
	public class SwaggerConfiguration extends WebMvcConfigurationSupport {
	@Bean
	public Docket productApi() {
	return new Docket(DocumentationType.SWAGGER_2)
	.globalOperationParameters(Arrays.asList(new ParameterBuilder()
	.name("token")
	.description("Authentication token obtained after authentication.")
	.modelRef(new ModelRef("string"))
	.parameterType("header")
	.required(true)
	.build()))
	.select()
	.apis(RequestHandlerSelectors.basePackage("in.springframework.blog.tutorials"))
	.build();
	}
	@Override
	protected void addResourceHandlers(ResourceHandlerRegistry registry) {
	registry.addResourceHandler("swagger-ui.html")
	.addResourceLocations("classpath:/META-INF/resources/");
	registry.addResourceHandler("/webjars/**")
	.addResourceLocations("classpath:/META-INF/resources/webjars/");
	}
	}

view raw SwaggerConfiguration.java hosted with ❤ by GitHub

We create a swagger configuration file as defined above. The globalOperationParameters clause dictates to swagger that each endpoint will have a parameter named token of type header and is mandatory. We know there is two endpoint that will not have a token header but we can just pass some dummy values. We can also make it non-mandatory if we so wish.

	package in.springframework.blog.tutorials;
	import org.springframework.beans.factory.annotation.Autowired;
	import org.springframework.http.MediaType;
	import org.springframework.security.access.prepost.PreAuthorize;
	import org.springframework.web.bind.annotation.*;
	import javax.transaction.Transactional;
	@RestController
	@RequestMapping("/authenticate")
	public class AuthenticateEndpoint {
	@Autowired
	private UserRepository userRepository;
	@PreAuthorize(MyConstants.ANNOTATION_ROLE_USER)
	@RequestMapping(method = RequestMethod.POST, produces = MediaType.APPLICATION_JSON_VALUE)
	public LoginResponse login(@RequestHeader(value="username") String username,
	@RequestHeader(value="password") String password,
	@RequestBody LoginRequest loginRequest) {
	User user = RequestContext.currentUser.get();
	return new LoginResponse(user.getAuthToken(), user.getExpiry());
	}
	@RequestMapping(method = RequestMethod.DELETE, produces = MediaType.APPLICATION_JSON_VALUE)
	@Transactional
	public LoginResponse logout(@RequestBody LoginRequest loginRequest) {
	User user = RequestContext.currentUser.get();
	user = userRepository.findById(user.getId()).get();
	user.setAuthToken(null);
	user.setExpiry(null);
	RequestContext.currentUser.remove();
	return new LoginResponse(user.getAuthToken(), user.getExpiry());
	}
	}

view raw AutenticateEndpoint.java hosted with ❤ by GitHub

We also modify authentication endpoint to take a username and password header for authentication endpoint. That is defined in the AuthenticateEndpoint as above. Look at the @RequestHeader parameter passed in the login method of the endpoint.

        web.ignoring().antMatchers("/swagger-ui.html");
        web.ignoring().antMatchers("/v2/api-docs/**");
        web.ignoring().antMatchers("/swagger-resources/**");

Also, make sure that SecurityConfiguration.java that we had defined in one of the previous posts a list of swagger related URLs were made part of an exception list so that these do not go through authentication filter.
Now if we rebuild the server and run it and visit http://localhost:8081/swagger-ui.html we see the swagger page with all the API endpoints listed there. Here is the screenshot of the swagger UI as seen on visiting above URL.

6. Introducing Spring Security

If the web services that we are building require any level of authentication and authorization, it is better to understand Spring security context. Services that are properly built with security context can implement a better level of security at each method and endpoint level.
We want to handle all the security, authentication and, authorization related code in a single block so that managing it becomes easier.
The first step that we need to do is to add security dependencies in the pom.xml.

	<dependency>
	<groupId>org.springframework.boot</groupId>
	<artifactId>spring-boot-starter-security</artifactId>
	</dependency>
	<dependency>
	<groupId>org.springframework</groupId>
	<artifactId>spring-expression</artifactId>
	</dependency>
	<dependency>
	<groupId>org.springframework.security</groupId>
	<artifactId>spring-security-web</artifactId>
	</dependency>
	<dependency>
	<groupId>org.springframework.security</groupId>
	<artifactId>spring-security-config</artifactId>
	</dependency>
	<dependency>
	<groupId>log4j</groupId>
	<artifactId>log4j</artifactId>
	<version>1.2.17</version>
	</dependency>
	<dependency>
	<groupId>com.google.code.gson</groupId>
	<artifactId>gson</artifactId>
	<version>2.8.5</version>
	</dependency>

view raw security-pom.xml hosted with ❤ by GitHub

For authentication and authorization to make sense, we need to have a concept of a Role within the system. The roles are required to authorize the users for specific purposes. We define a set of roles in the form of a bitmask defined as an enum.

	package in.springframework.blog.tutorials;
	import java.util.HashSet;
	import java.util.Set;
	public enum Role {
	USER(0x01), // 0 User
	TESTER(0x01 << 1), // 1 Tester
	ADMIN(0x01 << 2), // 2 Admin
	REFRESH(0x01 << 3),
	ANONYMOUS(0x01 << 4); // 5 Only for internal use for refresh token.
	private final int mask;
	Role(int mask) {
	this.mask = mask;
	}
	public static Set<Role> createFromMask(long mask) {
	Set<Role> output = new HashSet<>();
	for (Role r : values()) {
	if ((r.mask & mask) != 0) {
	output.add(r);
	}
	}
	return output;
	}
	}

view raw Role.java hosted with ❤ by GitHub

Now that we have defined Roles, we need to add few fields in our User class. We add a field mask for holding allowed roles and two different fields for authToken and expiry. We also add an index in the User entity.

	package in.springframework.blog.tutorials;
	import javax.persistence.*;
	import java.util.Date;
	@Entity
	@Table(name = "user",
	uniqueConstraints =
	{
	@UniqueConstraint(name = "uq_email", columnNames = {"email"}),
	@UniqueConstraint(name = "uq_authToken", columnNames = {"authToken"}),
	@UniqueConstraint(name = "uq_username", columnNames = {"username"})
	})
	public class User {
	@Id
	@GeneratedValue(strategy=GenerationType.AUTO)
	private Long id;
	private String fullname;
	private String username;
	private String password;
	private String email;
	private long mask;
	private String authToken;
	private Date expiry;
	public Long getId() {
	return id;
	}
	public void setId(Long id) {
	this.id = id;
	}
	public String getFullname() {
	return fullname;
	}
	public void setFullname(String fullname) {
	this.fullname = fullname;
	}
	public String getUsername() {
	return username;
	}
	public void setUsername(String username) {
	this.username = username;
	}
	public String getPassword() {
	return password;
	}
	public void setPassword(String password) {
	this.password = password;
	}
	public String getEmail() {
	return email;
	}
	public void setEmail(String email) {
	this.email = email;
	}
	public long getMask() {
	return mask;
	}
	public void setMask(long mask) {
	this.mask = mask;
	}
	public String getAuthToken() {
	return authToken;
	}
	public void setAuthToken(String authToken) {
	this.authToken = authToken;
	}
	public Date getExpiry() {
	return expiry;
	}
	public void setExpiry(Date expiry) {
	this.expiry = expiry;
	}
	}

view raw User.java hosted with ❤ by GitHub

We also need to add a class that implements GrantedAuthority interface. An authority in the spring security system is represented by a string and we use the Role enum name as the authority in the system.

	package in.springframework.blog.tutorials;
	import org.springframework.security.core.GrantedAuthority;
	import java.util.ArrayList;
	import java.util.List;
	import java.util.Set;
	import java.util.stream.Collectors;
	public class UserAuthority implements GrantedAuthority {
	private final String authority;
	public UserAuthority(String authority) {
	this.authority = authority;
	}
	@Override
	public String getAuthority() {
	return authority;
	}
	public static Set<UserAuthority> getAuthoritiesFromRoles(List<Role> roles) {
	return roles.stream().map(r -> new UserAuthority(r.name())).collect(Collectors.toSet());
	}
	public static Set<UserAuthority> getAuthoritiesFromRoles(long mask) {
	return Role.createFromMask(mask).stream().map(r -> new UserAuthority(r.name())).collect(Collectors.toSet());
	}
	}

view raw UserAuthority.java hosted with ❤ by GitHub

We probably need to have two different types of authentication and authorization within the server. The first authentication and authorization will work with username and password and the second one will work with the token. Spring security requires two different entities to be defined for authentication and authorization. We need a Principal and a Provider class each for username and token authentication and authorization. Let's first look at the class required for authentication using username and password.  A principal is nothing but the abstraction of credentials that is flowing through spring security. We define it as below.

	package in.springframework.blog.tutorials;
	import java.security.Principal;
	import java.util.Optional;
	/**
	* Created by vinay on 2/3/16.
	*/
	public class UsernamePasswordPrincipal implements Principal {
	public UsernamePasswordPrincipal(Optional<String> username, Optional<String> password) {
	this.username = username;
	this.password = password;
	}
	@Override
	public String getName() {
	return username.get();
	}
	public Optional<String> getUsername() {
	return username;
	}
	public Optional<String> getPassword() {
	return password;
	}
	private final Optional<String> username;
	private final Optional<String> password;
	}

view raw UsernamePasswordPrincipal.java hosted with ❤ by GitHub

A provider is a class that provides the authentication and authorization functionality for a particular type. The username and password provider is defined as below. As we can see, the provider class extracts the credentials from the Principal and then makes sure the password is correct for the username. It also populates the list of roles granted to the user in the form of Authority.

	package in.springframework.blog.tutorials;
	import org.apache.log4j.Logger;
	import org.springframework.beans.factory.annotation.Autowired;
	import org.springframework.security.authentication.AuthenticationProvider;
	import org.springframework.security.authentication.BadCredentialsException;
	import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
	import org.springframework.security.core.Authentication;
	import org.springframework.security.core.AuthenticationException;
	import javax.transaction.Transactional;
	import java.util.Calendar;
	import java.util.Date;
	import java.util.Optional;
	import java.util.UUID;
	public class UsernamePasswordAuthenticationProvider implements AuthenticationProvider {
	private final static Logger logger = Logger.getLogger(UsernamePasswordAuthenticationProvider.class);
	@Autowired
	private UserRepository userRepository;
	@Override
	@Transactional
	public Authentication authenticate(Authentication authentication) throws AuthenticationException {
	UsernamePasswordPrincipal principal = (UsernamePasswordPrincipal) authentication.getPrincipal();
	Optional<User> userOptional = userRepository.findUserByEmailOrUsername(principal.getName());
	if (userOptional.isPresent()) {
	User user = userOptional.get();
	if (PasswordManager.INSTANCE.matches(principal.getPassword(), user.getPassword())) {
	user = userRepository.findById(user.getId()).get();
	user.setAuthToken(UUID.randomUUID().toString() + "-" + UUID.randomUUID());
	Calendar calendar = Calendar.getInstance();
	calendar.setTime(new Date());
	calendar.add(Calendar.HOUR, 24);
	user.setExpiry(calendar.getTime());
	RequestContext.currentUser.set(user);
	return new UsernamePasswordAuthenticationToken(principal, null, UserAuthority.getAuthoritiesFromRoles(user.getMask()));
	}
	else {
	throw new BadCredentialsException(String.format("User %s doesn't exist.", principal.getName()));
	}
	}
	else {
	throw new BadCredentialsException(String.format("User %s doesn't exist.", principal.getName()));
	}
	}
	@Override
	public boolean supports(Class<?> authentication) {
	return authentication.equals(UsernamePasswordAuthenticationToken.class);
	}
	}

view raw UsernamePasswordAuthenticationProvider.java hosted with ❤ by GitHub

Similarly, we define a Token principal. This principal just contains the token value that is received from the user.

	package in.springframework.blog.tutorials;
	import java.security.Principal;
	import java.util.Optional;
	/**
	* Created by vinay on 2/3/16.
	*/
	public class TokenPrincipal implements Principal {
	public TokenPrincipal(Optional<String> token) {
	this.name = (token.isPresent() ? token.get() : "None");
	this.token = token;
	}
	public Optional<String> getToken() {
	return token;
	}
	public void setToken(Optional<String> token) {
	this.token = token;
	}
	public void setName(String name) {
	this.name = name;
	}
	@Override
	public String getName() {
	return name;
	}
	private String name;
	private Optional<String> token;
	}

view raw TokenPrincipal.java hosted with ❤ by GitHub

We also define a token provider. The token provider looks up the user from the database by querying it from token and authenticates the user. In this example, we are making an implicit assumption that a token will be unique across all the users. If that were not to be the case, we will also have to pass the username or some other identifier for the user along with the token during authentication.

	package in.springframework.blog.tutorials;
	import com.google.gson.Gson;
	import org.apache.log4j.Logger;
	import org.springframework.beans.factory.annotation.Autowired;
	import org.springframework.security.authentication.AuthenticationProvider;
	import org.springframework.security.authentication.BadCredentialsException;
	import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
	import org.springframework.security.core.Authentication;
	import org.springframework.security.core.AuthenticationException;
	import org.springframework.security.web.authentication.preauth.PreAuthenticatedAuthenticationToken;
	import java.io.IOException;
	import java.util.*;
	public class TokenAuthenticationProvider implements AuthenticationProvider {
	private final static Logger logger = Logger.getLogger(TokenAuthenticationProvider.class);
	@Autowired
	private UserRepository userRepository;
	@Override
	public Authentication authenticate(Authentication authentication) throws AuthenticationException {
	TokenPrincipal principal = (TokenPrincipal) authentication.getPrincipal();
	Optional<User> userOptional = userRepository.findUserByAuthToken(principal.getName());
	if (userOptional.isPresent()) {
	User user = userOptional.get();
	if (user.getExpiry() != null && user.getExpiry().after(new Date())) {
	RequestContext.currentUser.set(user);
	return new PreAuthenticatedAuthenticationToken(principal, null, UserAuthority.getAuthoritiesFromRoles(user.getMask()));
	}
	else {
	throw new BadCredentialsException(String.format("User %s doesn't exist.", principal.getName()));
	}
	}
	else {
	throw new BadCredentialsException(String.format("User %s doesn't exist.", principal.getName()));
	}
	}
	@Override
	public boolean supports(Class<?> authentication) {
	return authentication.equals(PreAuthenticatedAuthenticationToken.class);
	}
	}

view raw TokenAuthenticationProvider.java hosted with ❤ by GitHub

We also define a class RequestContext that will contain a set of thread local variables so that once authenticated, we will not need to look up the user details from the database. We will only need to hit the database in cases where we need to update the record in the User table.

	package in.springframework.blog.tutorials;
	public class RequestContext {
	public static final ThreadLocal<User> currentUser = new ThreadLocal();
	}

view raw RequestContext.java hosted with ❤ by GitHub

We can see in both provider classes, after successful authentication of the user, the User is set into the thread local so that we can use it within the thread boundaries of that request.
Now the providers and principals are in place, we need to start using them. Rather than using them on a case to case basis, the best way is to define a filter which applies on each request and authentication and authorization can be done on all requests.

	package in.springframework.blog.tutorials;
	import com.google.gson.Gson;
	import org.apache.log4j.Level;
	import org.apache.log4j.Logger;
	import org.springframework.http.HttpStatus;
	import org.springframework.security.authentication.AuthenticationManager;
	import org.springframework.security.authentication.BadCredentialsException;
	import org.springframework.security.authentication.InternalAuthenticationServiceException;
	import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
	import org.springframework.security.core.Authentication;
	import org.springframework.security.core.AuthenticationException;
	import org.springframework.security.core.context.SecurityContextHolder;
	import org.springframework.security.web.authentication.preauth.PreAuthenticatedAuthenticationToken;
	import org.springframework.web.filter.GenericFilterBean;
	import javax.servlet.FilterChain;
	import javax.servlet.ServletException;
	import javax.servlet.ServletRequest;
	import javax.servlet.ServletResponse;
	import javax.servlet.http.HttpServletRequest;
	import javax.servlet.http.HttpServletResponse;
	import java.io.IOException;
	import java.util.Optional;
	/**
	* Created by vinay on 2/3/16.
	*/
	public class AuthenticationFilter extends GenericFilterBean {
	public static final String TOKEN_SESSION_KEY = "token";
	public static final String USER_SESSION_KEY = "user";
	private final static Logger logger = Logger.getLogger(AuthenticationFilter.class);
	private AuthenticationManager authenticationManager;
	public AuthenticationFilter(AuthenticationManager authenticationManager) {
	this.authenticationManager = authenticationManager;
	}
	/**
	* Entry point into the authentication filter. We check if the token and token cache is present, we do token based
	* authentication. Otherwise we assume it to be username and password based authentication.
	* @param request
	* @param response
	* @param chain
	* @throws IOException
	* @throws ServletException
	*/
	@Override
	public void doFilter(ServletRequest request,
	ServletResponse response,
	FilterChain chain) throws IOException, ServletException {
	HttpServletResponse httpResponse = asHttp(response);
	try {
	HttpServletRequest httpRequest = asHttp(request);
	if (httpRequest.getRequestURI().toString().equals("/authenticate") && httpRequest.getMethod().equals("POST")) {
	Optional<String> username = getOptionalHeader(httpRequest,"username");
	Optional<String> password = getOptionalHeader(httpRequest,"password");
	UsernamePasswordPrincipal usernamePasswordPrincipal = new UsernamePasswordPrincipal(username, password);
	processUsernameAuthentication(usernamePasswordPrincipal);
	}
	else {
	Optional<String> token = getOptionalHeader(httpRequest,"token");
	TokenPrincipal authTokenPrincipal = new TokenPrincipal(token);
	processTokenAuthentication(authTokenPrincipal);
	}
	chain.doFilter(request, response);
	} catch (InternalAuthenticationServiceException e) {
	SecurityContextHolder.clearContext();
	handleExceptions(e, asHttp(response));
	logger.error("Internal authentication service exception", e);
	} catch (AuthenticationException e) {
	SecurityContextHolder.clearContext();
	handleExceptions(e, asHttp(response));
	} catch(Exception e) {
	handleExceptions(e, asHttp(response));
	}
	finally {
	}
	}
	private HttpServletRequest asHttp(ServletRequest request) {
	return (HttpServletRequest) request;
	}
	private HttpServletResponse asHttp(ServletResponse response) {
	return (HttpServletResponse) response;
	}
	private void processUsernameAuthentication(UsernamePasswordPrincipal usernamePasswordPrincipal) {
	Authentication resultOfAuthentication = tryToAuthenticateWithUsername(usernamePasswordPrincipal);
	SecurityContextHolder.getContext().setAuthentication(resultOfAuthentication);
	}
	private Authentication tryToAuthenticateWithUsername(UsernamePasswordPrincipal usernamePasswordPrincipal) {
	UsernamePasswordAuthenticationToken requestAuthentication
	= new UsernamePasswordAuthenticationToken(usernamePasswordPrincipal, usernamePasswordPrincipal.getPassword());
	return tryToAuthenticate(requestAuthentication);
	}
	private void processTokenAuthentication(TokenPrincipal tokenPrincipal) {
	Authentication resultOfAuthentication = tryToAuthenticateWithToken(tokenPrincipal);
	SecurityContextHolder.getContext().setAuthentication(resultOfAuthentication);
	}
	private Authentication tryToAuthenticateWithToken(TokenPrincipal tokenPrincipal) {
	PreAuthenticatedAuthenticationToken requestAuthentication
	= new PreAuthenticatedAuthenticationToken(tokenPrincipal, null);
	return tryToAuthenticate(requestAuthentication);
	}
	private Authentication tryToAuthenticate(Authentication requestAuthentication) {
	Authentication responseAuthentication = authenticationManager.authenticate(requestAuthentication);
	if (responseAuthentication == null || !responseAuthentication.isAuthenticated()) {
	throw new InternalAuthenticationServiceException("Unable to authenticate Domain User for provided credentials");
	}
	logger.debug("User successfully authenticated");
	return responseAuthentication;
	}
	private void handleExceptions(Exception ex, HttpServletResponse response) {
	try {
	if (ex instanceof EntityAlreadyExistsException) {
	EntityAlreadyExistsException e = (EntityAlreadyExistsException) ex;
	handleExceptionMsg(HttpStatus.UNPROCESSABLE_ENTITY.value(), e.getErrorCode(), response, e);
	} else if (ex instanceof NotFoundException) {
	NotFoundException e = (NotFoundException) ex;
	handleExceptionMsg(HttpStatus.NOT_FOUND.value(), e.getErrorCode(), response, e);
	} else {
	handleExceptionMsg(HttpStatus.UNAUTHORIZED.value(), HttpStatus.UNAUTHORIZED.value(), response, ex);
	}
	}
	catch(Exception jsonex) {
	logger.log(Level.ERROR, "Error during error generation", jsonex);
	}
	}
	private void handleExceptionMsg(int status, int errorCode, HttpServletResponse response, Exception e)
	throws IOException {
	ExceptionResponse er
	= new ExceptionResponseBuilder()
	.setStatus(status)
	.setCode(errorCode)
	.setMessage(e.getMessage())
	.setMoreInfo(String.format(SanjnanConstants.EXCEPTION_URL,errorCode))
	.createExceptionResponse();
	response.setStatus(status);
	Gson gson = new Gson();
	String tokenJsonResponse = gson.toJson(er);
	response.addHeader("Content-Type", "application/json");
	response.getWriter().print(tokenJsonResponse);
	if (e instanceof BadRequestException ||
	e instanceof BadCredentialsException ) {
	// these are repetitive exceptions and having stacktrace in the logs does not help us..
	// rather log becomes too big.
	// Log only the message so we can keep track
	logger.error(e.getMessage());
	} else {
	// log the entire details.. we need the stack trace here...
	logger.error(tokenJsonResponse, e);
	}
	}
	private Optional<String> getOptionalParameter(HttpServletRequest httpRequest, String parameterName) {
	String[] values = httpRequest.getParameterValues(parameterName);
	if (values.length == 0) {
	return Optional.of((String)null);
	}
	return Optional.of(values[0]);
	}
	private Optional<String> getOptionalHeader(HttpServletRequest httpRequest, String headerName) {
	return Optional.of(httpRequest.getHeader(headerName));
	}
	}

view raw AuthenticationFilter.java hosted with ❤ by GitHub

AuthenticationFilter provides the doFilter method which is called for each incoming request. As we can see within the doFilter method, if we receive a POST request to /authenticate URL we assume that to be a username and password authentication and we process it as a username and password authentication, in all other cases, it is assumed to be a token-based authentication. All the three parameters, username, password, and token are expected to be passed as headers.
Now we need to plug everything in so that it is called by the system. For that, we need to define a security configuration.

	package in.springframework.blog.tutorials;
	import org.springframework.context.annotation.Bean;
	import org.springframework.context.annotation.Configuration;
	import org.springframework.scheduling.annotation.EnableScheduling;
	import org.springframework.security.authentication.AuthenticationProvider;
	import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
	import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
	import org.springframework.security.config.annotation.web.builders.HttpSecurity;
	import org.springframework.security.config.annotation.web.builders.WebSecurity;
	import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
	import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
	import org.springframework.security.config.http.SessionCreationPolicy;
	import org.springframework.security.web.AuthenticationEntryPoint;
	import org.springframework.security.web.authentication.www.BasicAuthenticationFilter;
	import javax.servlet.http.HttpServletResponse;
	/**
	* Created by vinay on 1/27/16.
	*/
	@Configuration
	@EnableWebSecurity
	@EnableScheduling
	@EnableGlobalMethodSecurity(prePostEnabled = true)
	public class SecurityConfiguration extends WebSecurityConfigurerAdapter {
	@Override
	protected void configure(AuthenticationManagerBuilder auth) throws Exception {
	auth.authenticationProvider(tokenAuthenticationProvider());
	auth.authenticationProvider(usernamePasswordAuthenticationProvider());
	}
	@Override
	public void configure(WebSecurity web) throws Exception {
	web.ignoring().antMatchers("/manage/health");
	web.ignoring().antMatchers("/swagger-ui.html");
	web.ignoring().antMatchers("/webjars/**");
	web.ignoring().antMatchers("/v2/api-docs/**");
	web.ignoring().antMatchers("/error");
	web.ignoring().antMatchers("/swagger-resources/**");
	}
	@Override
	protected void configure(HttpSecurity http) throws Exception {
	http.csrf().disable().
	sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS).
	and().
	authorizeRequests().
	antMatchers(actuatorEndpoints()).hasAuthority(Role.ADMIN.name()).
	anyRequest().authenticated().
	and().
	anonymous().disable().
	exceptionHandling().authenticationEntryPoint(unauthorizedEntryPoint());;
	http.addFilterBefore(new AuthenticationFilter(authenticationManager()), BasicAuthenticationFilter.class);
	}
	private String[] actuatorEndpoints() {
	return new String[]{
	SanjnanConstants.AUTOCONFIG_ENDPOINT,
	SanjnanConstants.BEANS_ENDPOINT,
	SanjnanConstants.CONFIGPROPS_ENDPOINT,
	SanjnanConstants.ENV_ENDPOINT,
	SanjnanConstants.MAPPINGS_ENDPOINT,
	SanjnanConstants.METRICS_ENDPOINT,
	SanjnanConstants.SHUTDOWN_ENDPOINT
	};
	}
	@Bean
	public AuthenticationEntryPoint unauthorizedEntryPoint() {
	return (request, response, authException) -> response.sendError(HttpServletResponse.SC_UNAUTHORIZED);
	}
	@Bean
	public AuthenticationProvider tokenAuthenticationProvider() {
	return new TokenAuthenticationProvider();
	}
	@Bean
	public AuthenticationProvider usernamePasswordAuthenticationProvider() {
	return new UsernamePasswordAuthenticationProvider();
	}
	}

view raw SecurityConfiguration.java hosted with ❤ by GitHub

The SecurityConfiguration class is defined by extending WebSecurityConfigurerAdapter class. We override a few sets of methods. The first method defines a set of authentication providers that are available to the system.

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.authenticationProvider(tokenAuthenticationProvider());
        auth.authenticationProvider(usernamePasswordAuthenticationProvider());
    }

The second method defines a set of URLs that would be ignored by the security system.

    @Override
    public void configure(WebSecurity web) throws Exception {
        web.ignoring().antMatchers("/manage/health");
        web.ignoring().antMatchers("/swagger-ui.html");
        web.ignoring().antMatchers("/webjars/**");
        web.ignoring().antMatchers("/v2/api-docs/**");
        web.ignoring().antMatchers("/error");
        web.ignoring().antMatchers("/swagger-resources/**");
    }

The third method defines the security rules for all the requests.

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.csrf().disable().
                sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS).
                and().
                authorizeRequests().
                antMatchers(actuatorEndpoints()).hasAuthority(Role.ADMIN.name()).
                anyRequest().authenticated().
                and().
                anonymous().disable().
                exceptionHandling().authenticationEntryPoint(unauthorizedEntryPoint());;

        http.addFilterBefore(new AuthenticationFilter(authenticationManager()), BasicAuthenticationFilter.class);
    }

The configuration first disables CSRF and then sets a session management policy. After that, it declares that all the actuator endpoints need to be authenticated by a user having the ADMIN roles. Then all other users need to be authenticated. With this, every request coming into the system will be automatically authenticated and authorized. Now we can annotate our endpoints with specific roles so that unauthorized users can not make the calls. For example, we add the following annotation to our endpoint that we had defined earlier.

@PreAuthorize("hasAuthority('USER')")

This annotation implies that a user with the role of USER can only call this endpoint. Any other user would not be able to call this endpoint.

	package in.springframework.blog.tutorials;
	import org.springframework.beans.factory.annotation.Autowired;
	import org.springframework.http.MediaType;
	import org.springframework.security.access.prepost.PreAuthorize;
	import org.springframework.web.bind.annotation.*;
	import javax.transaction.Transactional;
	@RestController
	@RequestMapping("/authenticate")
	public class AuthenticateEndpoint {
	@Autowired
	private UserRepository userRepository;
	@PreAuthorize(SanjnanConstants.ANNOTATION_ROLE_USER)
	@RequestMapping(method = RequestMethod.POST, produces = MediaType.APPLICATION_JSON_VALUE)
	public LoginResponse login(@RequestBody LoginRequest loginRequest) {
	User user = RequestContext.currentUser.get();
	return new LoginResponse(user.getAuthToken(), user.getExpiry());
	}
	@RequestMapping(method = RequestMethod.DELETE, produces = MediaType.APPLICATION_JSON_VALUE)
	@Transactional
	public LoginResponse logout(@RequestBody LoginRequest loginRequest) {
	User user = RequestContext.currentUser.get();
	user = userRepository.findById(user.getId()).get();
	user.setAuthToken(null);
	user.setExpiry(null);
	RequestContext.currentUser.remove();
	return new LoginResponse(user.getAuthToken(), user.getExpiry());
	}
	}

view raw AuthenticationEndpoint.java hosted with ❤ by GitHub

This is also our AuthenticationEndpoint. This will need to be called when a user wants to login using username and password. This now provides us with a functioning service with spring security enabled. In future posts, we will provide more details on it.  The complete code for this post is available in github repository with version 1.0. Click here to download it.