|
| 1 | +[[servlet-authentication-caching-user-details]] |
| 2 | += Caching `UserDetails` |
| 3 | + |
| 4 | +Spring Security provides support for caching `UserDetails` with <<servlet-authentication-caching-user-details-service,`CachingUserDetailsService`>>. |
| 5 | +Alternatively, you can use Spring Framework's <<servlet-authentication-caching-user-details-cacheable,`@Cacheable`>> annotation. |
| 6 | +In either case, you will need to <<servlet-authentication-caching-user-details-credential-erasure,disable credential erasure>> in order to validate passwords retrieved from the cache. |
| 7 | + |
| 8 | +[[servlet-authentication-caching-user-details-service]] |
| 9 | +== `CachingUserDetailsService` |
| 10 | + |
| 11 | +Spring Security's `CachingUserDetailsService` implements xref:servlet/authentication/passwords/user-details-service.adoc#servlet-authentication-userdetailsservice[UserDetailsService] to provide support for caching `UserDetails`. |
| 12 | +`CachingUserDetailsService` provides caching support for `UserDetails` by delegating to the provided `UserDetailsService`. |
| 13 | +The result is then stored in a `UserCache` to reduce computation in subsequent calls. |
| 14 | + |
| 15 | +The following example simply defines a `@Bean` that encapsulates a concrete implementation of `UserDetailsService` and a `UserCache` for caching the `UserDetails`: |
| 16 | + |
| 17 | +.Provide a `CachingUserDetailsService` `@Bean` |
| 18 | +[tabs] |
| 19 | +====== |
| 20 | +Java:: |
| 21 | ++ |
| 22 | +[source,java,role="primary"] |
| 23 | +---- |
| 24 | +@Bean |
| 25 | +public CachingUserDetailsService cachingUserDetailsService(UserCache userCache) { |
| 26 | + UserDetailsService delegate = ...; |
| 27 | + CachingUserDetailsService service = new CachingUserDetailsService(delegate); |
| 28 | + service.setUserCache(userCache); |
| 29 | + return service; |
| 30 | +} |
| 31 | +---- |
| 32 | +
|
| 33 | +Kotlin:: |
| 34 | ++ |
| 35 | +[source,kotlin,role="secondary"] |
| 36 | +---- |
| 37 | +@Bean |
| 38 | +fun cachingUserDetailsService(userCache: UserCache): CachingUserDetailsService { |
| 39 | + val delegate: UserDetailsService = ... |
| 40 | + val service = CachingUserDetailsService(delegate) |
| 41 | + service.userCache = userCache |
| 42 | + return service |
| 43 | +} |
| 44 | +---- |
| 45 | +====== |
| 46 | + |
| 47 | +[[servlet-authentication-caching-user-details-cacheable]] |
| 48 | +== `@Cacheable` |
| 49 | + |
| 50 | +An alternative approach would be to use Spring Framework's {spring-framework-reference-url}integration.html#cache-annotations-cacheable[`@Cacheable`] in your `UserDetailsService` implementation to cache `UserDetails` by `username`. |
| 51 | +The benefit to this approach is simpler configuration, especially if you are already using caching elsewhere in your application. |
| 52 | + |
| 53 | +The following example assumes caching is already configured, and annotates the `loadUserByUsername` with `@Cacheable`: |
| 54 | + |
| 55 | +.`UserDetailsService` annotated with `@Cacheable` |
| 56 | +[tabs] |
| 57 | +====== |
| 58 | +Java:: |
| 59 | ++ |
| 60 | +[source,java,role="primary"] |
| 61 | +---- |
| 62 | +@Service |
| 63 | +public class MyCustomUserDetailsImplementation implements UserDetailsService { |
| 64 | +
|
| 65 | + @Override |
| 66 | + @Cacheable |
| 67 | + public UserDetails loadUserByUsername(String username) { |
| 68 | + // some logic here to get the actual user details |
| 69 | + return userDetails; |
| 70 | + } |
| 71 | +} |
| 72 | +---- |
| 73 | +
|
| 74 | +Kotlin:: |
| 75 | ++ |
| 76 | +[source,kotlin,role="secondary"] |
| 77 | +---- |
| 78 | +@Service |
| 79 | +class MyCustomUserDetailsImplementation : UserDetailsService { |
| 80 | +
|
| 81 | + @Cacheable |
| 82 | + override fun loadUserByUsername(username: String): UserDetails { |
| 83 | + // some logic here to get the actual user details |
| 84 | + return userDetails |
| 85 | + } |
| 86 | +} |
| 87 | +---- |
| 88 | +====== |
| 89 | + |
| 90 | +[[servlet-authentication-caching-user-details-credential-erasure]] |
| 91 | +== Disable Credential Erasure |
| 92 | + |
| 93 | +Whether you use <<servlet-authentication-caching-user-details-service,`CachingUserDetailsService`>> or <<servlet-authentication-caching-user-details-cacheable,`@Cacheable`>>, you will need to disable xref:servlet/authentication/architecture.adoc#servlet-authentication-providermanager-erasing-credentials[credential erasure] so that the `UserDetails` will contain a `password` to be validated when retrieved from the cache. |
| 94 | +The following example disables credential erasure for the global `AuthenticationManager` by configuring the `AuthenticationManagerBuilder` provided by Spring Security: |
| 95 | + |
| 96 | +.Disable credential erasure for the global `AuthenticationManager` |
| 97 | +[tabs] |
| 98 | +===== |
| 99 | +Java:: |
| 100 | ++ |
| 101 | +[source,java,role="primary"] |
| 102 | +---- |
| 103 | +@Configuration |
| 104 | +@EnableWebSecurity |
| 105 | +public class SecurityConfig { |
| 106 | +
|
| 107 | + @Bean |
| 108 | + public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception { |
| 109 | + // ... |
| 110 | + return http.build(); |
| 111 | + } |
| 112 | +
|
| 113 | + @Bean |
| 114 | + public UserDetailsService userDetailsService() { |
| 115 | + // Return a UserDetailsService that caches users |
| 116 | + // ... |
| 117 | + } |
| 118 | +
|
| 119 | + @Autowired |
| 120 | + public void configure(AuthenticationManagerBuilder builder) { |
| 121 | + builder.eraseCredentials(false); |
| 122 | + } |
| 123 | +
|
| 124 | +} |
| 125 | +---- |
| 126 | +
|
| 127 | +Kotlin:: |
| 128 | ++ |
| 129 | +[source,kotlin,role="secondary"] |
| 130 | +---- |
| 131 | +import org.springframework.security.config.annotation.web.invoke |
| 132 | +
|
| 133 | +@Configuration |
| 134 | +@EnableWebSecurity |
| 135 | +class SecurityConfig { |
| 136 | +
|
| 137 | + @Bean |
| 138 | + fun securityFilterChain(http: HttpSecurity): SecurityFilterChain { |
| 139 | + // ... |
| 140 | + return http.build() |
| 141 | + } |
| 142 | +
|
| 143 | + @Bean |
| 144 | + fun userDetailsService(): UserDetailsService { |
| 145 | + // Return a UserDetailsService that caches users |
| 146 | + // ... |
| 147 | + } |
| 148 | +
|
| 149 | + @Autowired |
| 150 | + fun configure(builder: AuthenticationManagerBuilder) { |
| 151 | + builder.eraseCredentials(false) |
| 152 | + } |
| 153 | +
|
| 154 | +} |
| 155 | +---- |
| 156 | +===== |
0 commit comments