Security concepts
- Principal – user, device or system that performs an action
- Authentication – establishing that a principal’s credentials are valid
- Authorization – deciding if a principal is allowed to access a resource
- Authority – Permission or credential enabling access
- Secured Resource – Resource that is being secured
Architecture
![](https://springboot.kitboga.net/wp-content/uploads/2024/06/image-26.png)
SecurityContextHolder – The SecurityContextHolder is where Spring Security stores the details of who is authenticated.
SecurityContext – is obtained from the SecurityContextHolder and contains the Authentication of the currently authenticated user.
Authentication – Can be the input to AuthenticationManager to provide the credentials a user has provided to authenticate or the current user from the SecurityContext.
GrantedAuthority – An authority that is granted to the principal on the Authentication (i.e. roles, scopes, etc.)
AuthenticationManager – the API that defines how Spring Security’s Filters perform authentication.
ProviderManager – the most common implementation of AuthenticationManager.
AuthenticationProvider – used by ProviderManager to perform a specific type of authentication.
Request Credentials with AuthenticationEntryPoint – used for requesting credentials from a client (i.e. redirecting to a log in page, sending a WWW-Authenticate response, etc.)
AbstractAuthenticationProcessingFilter – a base Filter used for authentication. This also gives a good idea of the high level flow of authentication and how pieces work together.1
https://docs.spring.io/spring-security/reference/servlet/authentication/architecture.html
![](https://springboot.kitboga.net/wp-content/uploads/2024/06/image-20.png)
![](https://springboot.kitboga.net/wp-content/uploads/2024/06/image-16.png)
Authentication
Authentication is the core object that stores authentication details, it will be stored in thread local local security managed by SecurityContextHolder. Authentication extends Principal.
![](https://springboot.kitboga.net/wp-content/uploads/2024/06/image-21.png)
Security Flow
![](https://springboot.kitboga.net/wp-content/uploads/2024/06/image-22.png)
![](https://springboot.kitboga.net/wp-content/uploads/2024/06/image-28.png)
DaoAuthenticationProvider
DaoAuthenticationProvider is an AuthenticationProvider implementation that uses a UserDetailsService and PasswordEncoder to authenticate a username and password.
UserDetailsService (loadUserByUsername) is used by DaoAuthenticationProvider for retrieving a username, a password, and other attributes for authenticating with a username and password. Spring Security provides in-memory, JDBC, and caching implementations of UserDetailsService.
![](https://springboot.kitboga.net/wp-content/uploads/2024/06/image-24.png)
Password Storage
Each of the supported mechanisms for reading a username and password can use any of the supported storage mechanisms:
- Simple Storage with In-Memory Authentication (InMemoryUserDetailsManager)
- Relational Databases with JDBC Authentication (JdbcUserDetailsManager )
- LDAP storage with LDAP Authentication (LdapUserDetailsManager)
![](https://springboot.kitboga.net/wp-content/uploads/2024/06/image-25.png)