Hey techies. I'm learning Spring Security. I saw somewhere being advised to

Question

Hey techies. I'm learning Spring Security. I saw somewhere being advised to

separate User.java from an implementation of UserDetails, say, MyUserDetails.java

My question is, say I have attributes: enabled, credentialsNonExpired, accountNonLocked, etc, do I need to persist these in the database?

And how would I 'link' my User.java with my MyUserDetails.java?

I know I may be 'overengineering' but I just want to wrap my head around this and get done with it.

0

15.03.2024

9 ответов

35 просмотров

626d Автор вопроса

Edwing123
What was the reason for introducing that separatio...

The S in SOLID. Single responsibility. User.java for user attributes. The other one for user-security-related.

0

8 месяцев назад

Dmytro Buryak

> separate User from impl of UserDetails You may end up with changing auth mechanism to a different one (for example token-based), where you don't even need UserDetails at all. So you can throw it away. But you still need User to represent what info of a user is stored in DB.

0

8 месяцев назад

626d Автор вопроса

Dmytro Buryak
> separate User from impl of UserDetails You may ...

Thanks @dburyak Just a little more on this. Should I persist the userdetails in the database? That is, isEnabled, isCrendetialsExpired, etc? If so, how would you advise handling of identifiers? userId in User, and, say, userId as foreign key in UserDetails?

0

8 месяцев назад

Dmytro Buryak

> My question is, say I have attributes: enabled, credentialsNonExpired, accountNonLocked, etc, do I need to persist these in the database? If you don't know what you're doing, then better just persist them in DB. It's a safer and future proof option. I highly recommend you to learn spring-security with some guidance and not by blindly trying something. Best resource I ever found about it was this book: https://www.manning.com/books/spring-security-in-action-second-edition Or any other form you like, but pick some *guided* tutorial. Something, where author knows what to explain, and in which order.

0

8 месяцев назад

Dmytro Buryak

626d
Thanks @dburyak Just a little more on this. Shou...

We may have misunderstanding here. Under "User" I mean a domain object that you persist in database, which contains necessary information about the user. And under "UserDetails" an impl of an interface of spring-security concept, not related to any databases or anything. It's actually a part of something like "DaoAuthProvider" or something, but still, you don't necessarily have to store it anywhere. Hence, User - is for your domain, specific to whatever you develop. UserDetails - is an interface to make your domain work with spring-security

0

8 месяцев назад

626d Автор вопроса

Dmytro Buryak
> My question is, say I have attributes: enabled, ...

Thanks again You made a good point. Because most tutorials I've been watching/reading hardly go in depth on some nitty gritties. They all just hardcoded those values to true. Meaning, enabled is always true, credentialsNonExpired is always true. Made me wonder what if I want to implement logic where an admin would disable a user account. And hence my question.

0

8 месяцев назад

626d Автор вопроса

626d
Thanks again You made a good point. Because most ...

Alternatively, there may be a disconnect in my understanding vs how Spring actually handles those values. I'll reference the book you suggested for better understanding.

0

8 месяцев назад

Dmytro Buryak

626d
Thanks @dburyak Just a little more on this. Shou...

I highly recommend to never use DB-specific ids in your business logic code. If you decide to change DB, and that DB uses something else for ids, then you'll have to rewrite TONS of code. Moreover, I guess your'e using SQL db at the moment, which is responsible of genearating IDs on its side. I.e. id generation is centralized. It's a huge obstacle for future development of the system. If you decide to eventually use decentralized IDs, you'll face the same problem - you're referencing objects by native centralized DB ids everywhere, and you'll have to rewrite tons of code.

0

8 месяцев назад

Edwing123 · Accepted Answer

Edwing123

What was the reason for introducing that separation?

0

8 месяцев назад

Похожие чаты

Hey techies. I'm learning Spring Security. I saw somewhere being advised to

9 ответов

Похожие вопросы