5. Entities and DAO

We will create a User entity and a Role entity, and corresponding repositories for database access. Also create an enum to represent available roles.

Next let’s look into the security related classes having JWT specific changes.

6. JwtUtils

Let’s create this component for JWT related utilities like generating the token, getting username and validating it. When generating the token, we get the username using user details. Also we get help from io.jsonwebtoken library.

7. AuthenticationTokenFilter

In this filter class extending OncePerRequestFilter abstract class, we will implement the doFilterInternal method in order to filter all the incoming requests. We get the JWT token from the Authorisation header and validate it. Then we get the user details from UserDetailsService and populate authentication in security context.

8. User details

JwtUserDetailsService will retrieve the user from users table and build a UserDetailsImpl object which implements UserDetails class. It will contain user information like id, username, email, password and authorities.

In UserDetailsImpl we are populating details of the user. Check the build method that get the name of each role and map to an authority. Check this article to get a clear idea about role and authority.

9. Register/ login — AuthenticationController

During "register", user’s details should be collected and persisted in the users table. Also their roles should be mapped.

Further to that, during each login process, a JWT token should be generated (with the help of JwtUtils) and passed to the client in order to send in subsequent requests.

10. TestController

Let’s introduce a new controller to simulate the API access by clients. Users having different roles will call different URLs to execute several operations. As discussed in step 7, AuthenticationTokenFilter will filter and permit only the requests containing valid JWT tokens.

In TestController we will allow calling a certain URL only if the user has the corresponding role privilege. We use spring security provided @PreAuthorize annotation for this purpose. Public APIs will not contain this annotation and will allow any authenticated user in.

11. Running the application

In order to keep this blog post concise and clear, I have provided only the important code snippers above. But you can check the full code here and fill the missing parts in the project you implemented now. Also you can directly checkout and run the full code if you prefer.

Let’s use postman to send requests. Create a request containing username and password and call the login API. In the response you will get the JWT token, roles and other user information.

Then let’s call the /user API which permits our user in, because the allowed roles with @PreAuthorize annotation matches roles entitled to the user. Don’t forget to put the received JWT token in the Authorisation header. We get the dummy response as expected.

Then we’ll try to access the /admin path which should not be allowed to our user. We get the Forbidden (403) response.

12. Conclusion