spring-security

Migrating UserDetailsByNameServiceWrapper from SpringSecurity 3 to 4


According to https://docs.spring.io/spring-security/site/migrate/current/3-to-4/html5/migrate-3-to-4-xml.html#m3to4-deprecations-core-udsw

UserDetailsServiceWrapper was deprecated in favor of using RoleHierarchyAuthoritiesMapper

Given the following snippet from applicationContext-security.xml file, what does the following need to be migrated to?:

    <bean id="preauthAuthProvider"
            class="org.springframework.security.web.authentication.preauth.PreAuthenticatedAuthenticationProvider">
        <property name="preAuthenticatedUserDetailsService">
            <bean id="userDetailsServiceWrapper"
                    class="org.springframework.security.core.userdetails.UserDetailsByNameServiceWrapper">
                <property name="userDetailsService" ref="userLogic"/>
            </bean>
        </property>
    </bean>

Solution

  • You should directly configure the UserDetailsService, and optionally use the RoleHierarchyAuthoritiesMapper as follows:

    <bean id="roleHierarchy"  class="org.springframework.security.access.hierarchicalroles.RoleHierarchyImpl">
        <property name="hierarchy">
            <value>
                ROLE_ADMIN > ROLE_USER
                ROLE_USER > ROLE_GUEST
            </value>
        </property>
    </bean>
    
    <bean id="roleHierarchyAuthoritiesMapper"         class="org.springframework.security.access.hierarchicalroles.RoleHierarchyAuthoritiesMapper"> <constructor-arg ref="roleHierarchy"/></bean>
    
    <bean id="preauthAuthProvider"        class="org.springframework.security.web.authentication.preauth.PreAuthenticatedAuthenticationProvider">
        <property name="userDetailsService" ref="userLogic"/>
        <property name="authoritiesMapper" ref="roleHierarchyAuthoritiesMapper"/>
    </bean>