Spring boot jwt authentication only

Question

I'm trying to implement spring boot authentication without any authorization. So simple signin,signup and profile apis where the signin and signup api has been permitted for all and profile is only for authenticated users.

Most tutorials focus on RBAC and authentication together while I just want to focus on the authentication part.

I have already created the basic structure with the help of scattered tutorials.

My AuthController:

    private final AuthService authService;

    @PostMapping("/signin")
    public ResponseEntity<?> signin(@RequestBody SigninRequest signinRequest) {
        String email = signinRequest.getEmail();
        log.info("email : {}", email);
        String password = signinRequest.getPassword();
        User user = authService.signin(email, password);
        return ResponseEntity.ok().body(user);
    }

    @PostMapping("/signup")
    public ResponseEntity<User> signup(@RequestBody User user){
        URI uri = URI.create(ServletUriComponentsBuilder.fromCurrentContextPath().path("/api/v1/auth/signup").toUriString());
        return ResponseEntity.created(uri).body(authService.signup(user));
    }

My AuthServiceImpl:

public class AuthServiceImpl implements AuthService, UserDetailsService {
    private final AuthRepository authRepository;
    private final PasswordEncoder passwordEncoder;

    @Override
    public UserDetails loadUserByUsername(String email) throws UsernameNotFoundException {
        User user = authRepository.findByEmail(email);
        if (user == null) {
            throw new UsernameNotFoundException(email);
        } else {
            log.info("User found: {}", user);
        }
        return new org.springframework.security.core.userdetails.User(user.getEmail(), user.getPassword(), new ArrayList<>());
    }

    @Override
    public User signup(User user) {
        String encodedPassword = passwordEncoder.encode(user.getPassword());
        user.setPassword(encodedPassword);
        return authRepository.save(user);
    }

    @Override
    public User signin(String email, String password) {
        // handle login ??
        return user;
    }
}

Everything was going fine until every tutorial hits the point where they send authorities or roles back to the client side. I wish to make this application authentication only.

And my security config as of now:

public class SecurityConfig extends WebSecurityConfigurerAdapter {
    private final UserDetailsService userDetailsService;
    private final BCryptPasswordEncoder bCryptPasswordEncoder;
    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.userDetailsService(userDetailsService).passwordEncoder(bCryptPasswordEncoder);
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.csrf().disable();
        http.authorizeRequests()
                .antMatchers("/api/v1/auth/signin").permitAll()
                .antMatchers("/api/v1/auth/signup").permitAll()
                .antMatchers("/api/v1/auth/profile").authenticated();
        http.httpBasic();
    }
}

My plan is simple:

1. User can register
2. User Can login
3. Upon login a access token and refresh token will be issued like usual

Answer 1

A Dockerised role based access system and advanced modifiable user-api access system

Spring Security, JWT, DB Based Authentication upon APIs

https://github.com/abhitkumardas/rbac