Spring Security JDBC: How to authenticate against a database in Spring Boot

Learn how to authenticate against a database in Spring Boot. In previous tutorials, I have used an in-memory user which works great for demos and proof of concepts but doesn't work for production. What happens when you move your users to a database? You could start from scratch or use the JdbcUserDetailsManager class which is built-in to Spring Security.

🔗Resources & Links mentioned in this video:

👋🏻Connect with me:

[samkarema]

Thank you Dan! Your video, as always, so precious and helpful!!!

[happydev]

I see new Dan's video i hit the like button <3 love all contents you created, Thank You

[cemkaratas]

Thanks for the awesome videos and contents Dan! That would be great to see oauth2 - mutlitenancy videos if possible. Cheers

[monjurmorshed]

@Dan Vaga, I request you to make a tutorial on new Spring Authentication/Authorization Server, as you are creating Spring security based videos, it will be very helpful. Again thanks for the new and nice tutorial, you always show the right and efficient way to do things with spring boot.

[alexanderbrown]

Thanks for this, Dan. I really enjoy your content. However, I'm trying to use a MySQL database. How does the DataSource config change for MySQL? Also, what does it mean for a data source to be "embedded"? Like, embedded in what? I found a DataSourceBuilder which has methods available for all my DB properties configuration values, but it doesn't seem to have an addScript method like the embedded one has, so I'm just wondering if it's a simple change I'm missing.

[prabhjotsingh]

Thanks Dan.

If possible, please make a video on the following topics

1. For the Spring OAuth2 client, we have properties like If the OAuth endpoint takes any non-standard parameter like audience then how can I do that?

2. If I have 2 microservices and both of them have 1 DB table each but these 2 tables are joined with foreign key, then how can I do that in my springboot application.

[rmdev]

I had an issue accessing the H2 console using Spring Boot 3.0.1, using authorizeHttpRequests and requestMatchers. I was being redirected to the login page, even with the "/h2-console/**" patterns. If you're here looking for a solution to this, the solution that worked for me was to import toH2Console() from and use that instead of the "/h2-console/**" paths:

import static

return http.csrf(csrf ->
.authorizeHttpRequests(auth -> auth

.anyRequest().authenticated()
)
.headers(headers ->
.formLogin(withDefaults())
.build();

[hkkabir]

kindly give a video of implementation using daoauthenticationprovider

[kensaitakeso]

hi Dan! thanks for tutorial. but how we could setup datasource using Postgres? is it applicable at all or only embedded solutions are supported?

[maxjustmax]

awesome! I have to ask though! any plans to get into spring boot REST_API request exception handling?

[michelchaghoury]

@Dan Vega do you recommend using records for controllers and services in Spring Boot if we are using Java 14+ or only for DTOs and POJOs?

[andrelong]

My main problem is that I need to use a custom schema where my table names and columns are different from the default schema, I do not want to use an in-memory database. I am using an existing database. I keep getting an SQL error saying column name "enabled" doesn't exist. My application keeps trying to use the default schema instead of my custom schema. Do you have any resources for my situation?

[Mkrabs]

There is no USERS table after manually defining the datasource for me..?

@Bean
DataSource datasource() {
return new EmbeddedDatabaseBuilder()
.setType(H2)

.build();
}

[sharathkumar]

Thanks Dan for very useful video. Can you please show us how to invalidate/blacklisting of JWT token for logout proper way?

[jolskey]

Hello Dan, Great video! I have one question. If I want user to have more fields rather than username, password and roles, like first name, last name, phone number, etc. What should I do? I thought about creating separate table and referencing username as a foreign key there, but don't know if it's the best solution possible.

[wllow]

Hi Dan great series of videos do you think you could make some security tutorials or even a security course that has all best production ready practices? I have been trying to find something like that and so far I have found only one but is like 500 dollar course. I think even if I had to pay but a lesser fee that 500 dollars I would goadly pay it to get everything on spring security even confirmation passwords change passwords and all the besr practices.

[KlanBr]

you don`t use postman, i try with postman, basic authentication, but i can`t pass de default form login, can someone help me, please

[DanielDemesmaecker]

Hi Dan, awesome stuff, following your spring security tutorials I managed to succesfully secure a graphApi using a neo4j no-sql db. Question though, while using a graph, I still have rest endpoints for authentication. I've always been told to choose one or the other and the same could be achieved with querries, I guess my question is would it be best practice to loose the restendpoints?

[rupendrabandyopadhyay]

How can this API be called from Postman or from another codebase?

[christopherreif]

Just curious, what is the auth -> auth suppose to be? I also really appreciate the content! Trying to learn spring security isn't easy at all.