CODEWITHSUNDEEP
javaspring-securityspring-boot
Master Mind
Master Mind

Reputation: 3084

Spring security : User class without UserRole (roles). Authentication only no authorization needed

I'm using Spring-security with Spring-boot. My Application is a POC, for the moment there is no need to have Role.

I was wondering if it is possible to have a Custom UserDetailsService which return UserDetails in loadUserByUsername method but without the GrantedAuthority nor UserRole class.

I have googled all the day long for an example but I always get them with the UserRole.

Thanks in advance

Upvotes: 4

Views: 6988

Answers (1)

Sanjay
Sanjay

Reputation: 8965

This should work:

  1. Let UserDetails return an empty collection in getAuthorities():

    public class User implements UserDetails {
    ...
    @Override
    public Collection<? extends GrantedAuthority> getAuthorities() {        
        return new HashSet<GrantedAuthority>();
    }
}

  2. Use just authenticated() while configuring security

    http.authorizeRequests()
    ...
    .antMatchers("/foo").authenticated()
    ...

Upvotes: 7

Related Questions