Authentication

🔍 What Is It?

Authentication is the process of verifying who a user is.

Spring Security authentication components:

• →UserDetails — the user object (username, password, roles)
• →UserDetailsService — loads UserDetails by username from your database
• →PasswordEncoder — hashes and verifies passwords
• →AuthenticationManager — orchestrates authentication
• →AuthenticationProvider — performs actual authentication (DaoAuthenticationProvider uses UserDetailsService)

Authentication flow for JWT:

1. Client sends username + password to /auth/login
2. Controller calls AuthenticationManager.authenticate()
3. DaoAuthenticationProvider calls UserDetailsService.loadUserByUsername()
4. Compares provided password with stored hash via PasswordEncoder
5. If valid, generate JWT and return to client
6. Client sends JWT in Authorization: Bearer <token> header on subsequent requests

🎯 Why Do We Need It?

Authentication is the foundation of application security. Without it, any user can access any resource. Spring Security's authentication framework provides a tested, extensible foundation — you implement UserDetailsService to load users from your database, and Spring handles the rest.

🏗️ What Happens in Real Projects?

Enterprise authentication patterns:

• →JWT with refresh tokens — stateless, scales horizontally
• →OAuth2/OIDC — delegated authentication to Keycloak/Auth0
• →API keys — for service-to-service authentication
• →Multi-factor authentication — via identity provider integration

⚙️ How It Works

The DaoAuthenticationProvider is Spring's default provider. It:

1. Calls UserDetailsService.loadUserByUsername(username)
2. Checks if the account is enabled, not locked, not expired
3. Calls PasswordEncoder.matches(rawPassword, encodedPassword)
4. If all checks pass, creates an authenticated Authentication object
5. Stores it in the SecurityContext

💻 Example

Complete Authentication Implementation — UserDetailsService, login endpoint, and JWT generation.

@Service
@RequiredArgsConstructor
public class CustomUserDetailsService implements UserDetailsService {

    private final UserRepository userRepository;

    @Override
    @Transactional(readOnly = true)
    public UserDetails loadUserByUsername(String username)
            throws UsernameNotFoundException {

        User user = userRepository.findByEmailWithRoles(username)
            .orElseThrow(() -> new UsernameNotFoundException(
                "User not found: " + username));

        return org.springframework.security.core.userdetails.User.builder()
            .username(user.getEmail())
            .password(user.getPasswordHash())
            .authorities(user.getRoles().stream()
                .map(role -> new SimpleGrantedAuthority("ROLE_" + role.getName()))
                .collect(Collectors.toList()))
            .accountExpired(!user.isActive())
            .accountLocked(user.isLocked())
            .credentialsExpired(false)
            .disabled(!user.isActive())
            .build();
    }
}

🤔 Common Confusions

🚨 Common Production Issues

✅ Best Practices

🏛️ Architect's Note

💬 Frequently Asked Questions

🎯 Key Takeaways

🔗 Related Topics

🎯 Practice this topic in interviews

↗ Where this topic fits