How do I set up a custom login with Spring Boot?

Question
How do I set up a custom login with Spring Boot? I need to use the same connection method of a legacy app I have.

Things to know before I explain

• I have a javafx App that connects to a data base using a php website
  as proxy/Login Obviously, this javafx app has the User class already
  defined.
• The Database is separated by company(group of users), the login process basically retrieves the user object and to which database it should connect.
• The javafx application logs in with the web service and retrieves
  the database URL for that specific user.
• The javafx application uses the database URL to access a database
  directly.

Or, to simplify: The user put the login and password and click LOGIN -> The app, goes to the webhost, sends the data to a certain php file and requests the database url and data that comes ENCRYPTED through JASPYR and it also comes through https. Once the data is returned, we decrypt it and login to the database directly.

• Im building a SpringBoot application to work with this legacy app.

Where Am I stuck?

I have built a Spring boot maven project and im reading a lot about Spring boot. My first step is to create a login page that behaves as the legacy app.

Currently, Im using a InMemorySecurityConfig as follows:

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
 
@Configuration
public class InMemorySecurityConfig {
     
    @Autowired
    public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
        auth.inMemoryAuthentication()
                .withUser("user").password("{noop}123").roles("USER")
                .and()
                .withUser("admin").password("{noop}123").roles("ADMIN");
    }
}

I dont know how to start. I think I have to find away to define the correct User model and then use a class to login that actually allows me to manually login.

Here is the legacy class that I use on my javafx App below.

public JSONObject login(String usuario, String senha) throws MalformedURLException, IOException {
        int timeout = 10;
        RequestConfig config = RequestConfig.custom()
                .setConnectTimeout(timeout * 1000)
                .setConnectionRequestTimeout(timeout * 1000)
                .setContentCompressionEnabled(true)
                .setAuthenticationEnabled(true)
                .setSocketTimeout(timeout * 1000)
                .build();
 
        CloseableHttpClient httpclient = HttpClientBuilder.create().setDefaultRequestConfig(config).build();
        HttpPost httppost = new HttpPost(Settings.LOGIN_URL);
 
        int CONNECTION_TIMEOUT_MS = timeout * 1000; // Timeout in millis.
        RequestConfig requestConfig = RequestConfig.custom()
                .setConnectionRequestTimeout(CONNECTION_TIMEOUT_MS)
                .setConnectTimeout(CONNECTION_TIMEOUT_MS)
                .setContentCompressionEnabled(true)
                .setAuthenticationEnabled(true)
                .setSocketTimeout(CONNECTION_TIMEOUT_MS)
                .build();
 
        httppost.setConfig(requestConfig);
 
        // Request parameters and other properties.
        ArrayList<NameValuePair> params = new ArrayList<NameValuePair>(2);
        params.add(new BasicNameValuePair("usuario", usuario)); // user
        params.add(new BasicNameValuePair("senha", senha)); // password
        httppost.setEntity(new UrlEncodedFormEntity(params, "UTF-8"));
 
        CloseableHttpResponse execute = null;
 
        try {
            execute = httpclient.execute(httppost);
        } catch (Exception ex) {
 
            try {
                httppost.abort();
                if (execute != null) {
                    execute.close();
                }
            } catch (Exception x) {
                ErrorLogger.log(x);
            }
            throw ex;
 
        }
        HttpEntity entity = execute.getEntity();
 
        if (entity != null) {
            JSONObject json = JsonTools.readJson(entity.getContent());
            
            return json;
        }
 
        return null;
    }

@Override
    protected Task<JSONObject> createTask() {
 
        return new Task<JSONObject>() {
            @Override
            protected JSONObject call() throws InterruptedException, IOException {
                StringProperty usuario = getUserName();
                StringProperty senha = getPassword();
 
                LoginDAO loginDAO = new LoginDAO();
                JSONObject login = loginDAO.login(MyTools.encodeToBase64(usuario.get()), MyTools.encodeToBase64(senha.get()));
 
                String db_url = login.getString("db_url");
                String db_username = login.getString("db_username");
                String db_password = login.getString("db_password");
                String nomeEmpresa = login.getString("nomeEmpresa");
 
                int idUsuario = login.getInt("idUsuario");
                String nomeDoUsuario = login.getString("nomeUsuario");
                int idTunnel = login.getInt("idTunnel");
 
                Settings.setDb_password(db_password);
                Settings.setDb_username(db_username);
                Settings.setDb_url(db_url);
                Settings.setDb_empresa(nomeEmpresa);
 
                //Connect to the data base 
                HibernateUtil.init();
 
 
                return login;
            }
        };
 
    }

How do I start? Any tips on how to start is greatly appreciated.

Im expecting that I have to somehow tell spring boot which User class to use, to tell spring to NOT instantly connect to the database and wait for the database info to be retrieved by the login page, and a way to login using spring.

Spring Boot base on http endpoints like this:

@RestController
@RequestMapping("/api/login")
public class LoginController {

    private final LoginService loginService;

    @GetMapping
    public ObjectYouWantReturn returnDatabaseURL(@RequestBody DtoCredentials dto) {
        return loginService.returnDatabaseURL(dto.getUsername, dto.getPassword);
    }
}

Your client must send DtoCredentials to https://your.host/api/login. Then server will return secured data to your client. You need to implement mechanism to validation credentials from a user.

This class will load a UserDetailsImpl by username. You can use below class for load data from a database or simply create a List or something with users.

@Service
public class UserDetailsServiceImpl implements UserDetailsService {

    @Override
    public UserDetailsImpl loadUserByUsername(String username) {
        //here you have to create mechanism returning user credentials in UserDetails
    }
}

UserDetails is basic DTO, look at the documentation

public class UserDetailsImpl implements UserDetails {
    //implement here methods specified by UserDetails
}

And this is Service. In Spring Boot a good practice is separating logic from controllers. In method returnDatabaseURL() we are checking are the credentials correctly. If they are, the server returns data to client, or if not, we can throw ResponseStatusException(HttpStatus.NOT_FOUND) of anything else.

@Service
public class LoginService {

    /*Spring Boot should automatically inject UserDetailsServiceImpl because we 
    annotated it by @Service annotation*/
    private final UserDetailsServiceImpl userDetails;

    public LoginService(UserDetailsServiceImpl userDetails) {
        this.userDetails = userDetails;
    }
    
    public ObjectYouWantReturn returnDatabaseURL(String username, String password) {
        if (userDetails.loadUserByUsername(username) != null &&
            userDetails.loadUserByUsername(username).getPassword().equals(password)) {
            return new ObjectYouWantReturn(/*URL to database or anything you want to 
                                           return to user*/); 
        }
    }
}

Validating users in the service is not the best way, it is recommended that validate user in filter. But filters is a little bit more advanced issue.

Basic implementation of DtoCredentials:

public class DtoUsernamePassword implements Serializable {

    @NotBlank
    private final String username;

    @NotBlank
    private final String password;

    public DtoUsernamePassword(@JsonProperty("username") @NotBlank String username,
                               @JsonProperty("password") @NotBlank String password) {
        this.username = username;
        this.password = password;
    }

    public String getUsername() {
        return username;
    }

    public String getPassword() {
        return password;
    }
}

Needed Jackson dependency:

<dependency>
    <groupId>com.fasterxml.jackson.core</groupId>
    <artifactId>jackson-core</artifactId>
    <version>2.11.2</version>
</dependency>

I hope that after read it you will understand Spring Boot a bit more (because as I see you are new in Spring Boot). It's not a completely implementation. If my answer don't satisfying you, treat it as a loose attempt to explain how does Spring Boot work.