TP1 - Autenticación por Formulario

Objetivos del TP

En este TP, usted va a:

1. ✅ Crear una aplicación web segura con Spring Security
2. ✅ Implementar la autenticación por formulario
3. ✅ Almacenar los usuarios en base de datos
4. ✅ Gestionar los roles USER y ADMIN
5. ✅ Personalizar las páginas de login/logout

Duración estimada: 1h30

---

Contexto

Usted crea una aplicación de gestión de tareas con:

• Página de inicio pública
• Dashboard accesible para usuarios autenticados
• Página de administración reservada para administradores

---

Parte 1: Configuración del Proyecto

1.1 Crear el Proyecto

Spring Initializr con:

• Artifact: security-form-demo
• Dependencies:
  • Spring Web
  • Spring Security
  • Spring Data JPA
  • H2 Database
  • Thymeleaf
  • Lombok

1.2 Estructura

src/main/java/com/example/security/
├── config/
│   └── SecurityConfig.java
├── model/
│   ├── User.java
│   └── Role.java
├── repository/
│   ├── UserRepository.java
│   └── RoleRepository.java
├── service/
│   ├── CustomUserDetailsService.java
│   └── UserService.java
├── controller/
│   ├── HomeController.java
│   └── AdminController.java
└── SecurityFormDemoApplication.java

---

Parte 2: Entidades

2.1 Role

@Entity
@Table(name = "roles")
@Data
@NoArgsConstructor
public class Role {
    @Id
    @GeneratedValue(strategy = GenerationType.IDENTITY)
    private Long id;

    @Column(unique = true, nullable = false)
    private String name;

    public Role(String name) {
        this.name = name;
    }
}

2.2 User

@Entity
@Table(name = "users")
@Data
@NoArgsConstructor
public class User {
    @Id
    @GeneratedValue(strategy = GenerationType.IDENTITY)
    private Long id;

    @Column(unique = true, nullable = false)
    private String username;

    @Column(nullable = false)
    private String password;

    @Column(unique = true, nullable = false)
    private String email;

    private boolean enabled = true;

    @ManyToMany(fetch = FetchType.EAGER)
    @JoinTable(name = "user_roles",
        joinColumns = @JoinColumn(name = "user_id"),
        inverseJoinColumns = @JoinColumn(name = "role_id"))
    private Set<Role> roles = new HashSet<>();
}

---

Parte 3: Repositories y Servicios

3.1 Repositories

@Repository
public interface UserRepository extends JpaRepository<User, Long> {
    Optional<User> findByUsername(String username);
    boolean existsByUsername(String username);
}

@Repository
public interface RoleRepository extends JpaRepository<Role, Long> {
    Optional<Role> findByName(String name);
}

3.2 CustomUserDetailsService

@Service
@RequiredArgsConstructor
public class CustomUserDetailsService implements UserDetailsService {

    private final UserRepository userRepository;

    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        User user = userRepository.findByUsername(username)
            .orElseThrow(() -> new UsernameNotFoundException("Usuario no encontrado: " + username));

        return org.springframework.security.core.userdetails.User.builder()
            .username(user.getUsername())
            .password(user.getPassword())
            .authorities(user.getRoles().stream()
                .map(role -> new SimpleGrantedAuthority(role.getName()))
                .toList())
            .disabled(!user.isEnabled())
            .build();
    }
}

3.3 UserService

@Service
@RequiredArgsConstructor
public class UserService {

    private final UserRepository userRepository;
    private final RoleRepository roleRepository;
    private final PasswordEncoder passwordEncoder;

    @Transactional
    public User createUser(String username, String email, String password, String roleName) {
        if (userRepository.existsByUsername(username)) {
            throw new RuntimeException("Nombre de usuario ya utilizado");
        }

        Role role = roleRepository.findByName(roleName)
            .orElseThrow(() -> new RuntimeException("Rol no encontrado: " + roleName));

        User user = new User();
        user.setUsername(username);
        user.setEmail(email);
        user.setPassword(passwordEncoder.encode(password));
        user.setEnabled(true);
        user.getRoles().add(role);

        return userRepository.save(user);
    }
}

---

Parte 4: Configuración de Seguridad

4.1 SecurityConfig

@Configuration
@EnableWebSecurity
@RequiredArgsConstructor
public class SecurityConfig {

    private final CustomUserDetailsService userDetailsService;

    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        return http
            .authorizeHttpRequests(auth -> auth
                .requestMatchers("/", "/home", "/register", "/css/**", "/js/**").permitAll()
                .requestMatchers("/admin/**").hasRole("ADMIN")
                .anyRequest().authenticated()
            )
            .formLogin(form -> form
                .loginPage("/login")
                .defaultSuccessUrl("/dashboard", true)
                .failureUrl("/login?error=true")
                .permitAll()
            )
            .logout(logout -> logout
                .logoutUrl("/logout")
                .logoutSuccessUrl("/login?logout=true")
                .deleteCookies("JSESSIONID")
                .permitAll()
            )
            .userDetailsService(userDetailsService)
            .build();
    }

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }
}

---

Parte 5: Controladores

5.1 HomeController

@Controller
public class HomeController {

    @GetMapping({"/", "/home"})
    public String home() {
        return "home";
    }

    @GetMapping("/login")
    public String login() {
        return "login";
    }

    @GetMapping("/dashboard")
    public String dashboard(Model model, Principal principal) {
        model.addAttribute("username", principal.getName());
        return "dashboard";
    }

    @GetMapping("/register")
    public String registerForm(Model model) {
        model.addAttribute("user", new User());
        return "register";
    }

    @PostMapping("/register")
    public String register(@ModelAttribute User user, 
                          @RequestParam String password,
                          RedirectAttributes redirectAttributes,
                          UserService userService) {
        try {
            userService.createUser(user.getUsername(), user.getEmail(), password, "ROLE_USER");
            redirectAttributes.addFlashAttribute("success", "¡Cuenta creada! Inicie sesión.");
            return "redirect:/login";
        } catch (Exception e) {
            redirectAttributes.addFlashAttribute("error", e.getMessage());
            return "redirect:/register";
        }
    }
}

5.2 AdminController

@Controller
@RequestMapping("/admin")
@RequiredArgsConstructor
public class AdminController {

    private final UserRepository userRepository;

    @GetMapping
    public String adminDashboard(Model model) {
        model.addAttribute("users", userRepository.findAll());
        return "admin/dashboard";
    }

    @PostMapping("/users/{id}/disable")
    public String disableUser(@PathVariable Long id) {
        userRepository.findById(id).ifPresent(user -> {
            user.setEnabled(false);
            userRepository.save(user);
        });
        return "redirect:/admin";
    }
}

---

Parte 6: Plantillas Thymeleaf

6.1 home.html

<!DOCTYPE html>
<html xmlns:th="http://www.thymeleaf.org"
      xmlns:sec="http://www.thymeleaf.org/extras/spring-security">
<head>
    <title>Inicio</title>
</head>
<body>
    <h1>¡Bienvenido!</h1>
    
    <div sec:authorize="isAnonymous()">
        <p>No está autenticado.</p>
        <a href="/login">Iniciar sesión</a> | <a href="/register">Registrarse</a>
    </div>
    
    <div sec:authorize="isAuthenticated()">
        <p>Hola, <span sec:authentication="name">User</span>!</p>
        <a href="/dashboard">Dashboard</a>
        <div sec:authorize="hasRole('ADMIN')">
            <a href="/admin">Administración</a>
        </div>
        <form th:action="@{/logout}" method="post" style="display:inline;">
            <button type="submit">Cerrar sesión</button>
        </form>
    </div>
</body>
</html>

6.2 login.html

<!DOCTYPE html>
<html xmlns:th="http://www.thymeleaf.org">
<head>
    <title>Iniciar sesión</title>
</head>
<body>
    <h1>Iniciar sesión</h1>
    
    <div th:if="${param.error}" style="color:red;">
        Nombre de usuario o contraseña incorrectos.
    </div>
    <div th:if="${param.logout}" style="color:green;">
        Cierre de sesión exitoso.
    </div>
    <div th:if="${success}" style="color:green;" th:text="${success}"></div>
    
    <form th:action="@{/login}" method="post">
        <div>
            <label>Nombre de usuario:</label>
            <input type="text" name="username" required/>
        </div>
        <div>
            <label>Contraseña:</label>
            <input type="password" name="password" required/>
        </div>
        <button type="submit">Iniciar sesión</button>
    </form>
    
    <p><a href="/register">¿No tiene cuenta? Regístrese</a></p>
</body>
</html>

6.3 dashboard.html

<!DOCTYPE html>
<html xmlns:th="http://www.thymeleaf.org"
      xmlns:sec="http://www.thymeleaf.org/extras/spring-security">
<head>
    <title>Dashboard</title>
</head>
<body>
    <h1>Dashboard</h1>
    <p>Bienvenido, <span th:text="${username}">User</span>!</p>
    
    <h2>Sus roles:</h2>
    <ul sec:authentication="authorities">
        <!-- Muestra los roles -->
    </ul>
    
    <a href="/home">Inicio</a>
    <form th:action="@{/logout}" method="post" style="display:inline;">
        <button type="submit">Cerrar sesión</button>
    </form>
</body>
</html>

---

Parte 7: Datos Iniciales

DataInitializer

@Component
@RequiredArgsConstructor
public class DataInitializer implements CommandLineRunner {

    private final RoleRepository roleRepository;
    private final UserService userService;

    @Override
    @Transactional
    public void run(String... args) {
        // Crear los roles
        if (roleRepository.count() == 0) {
            roleRepository.save(new Role("ROLE_USER"));
            roleRepository.save(new Role("ROLE_ADMIN"));
        }

        // Crear un admin por defecto
        try {
            userService.createUser("admin", "admin@test.com", "admin123", "ROLE_ADMIN");
            userService.createUser("user", "user@test.com", "user123", "ROLE_USER");
        } catch (Exception ignored) {}
    }
}

---

Parte 8: Configuración

# application.properties
spring.datasource.url=jdbc:h2:mem:securitydb
spring.h2.console.enabled=true
spring.jpa.hibernate.ddl-auto=create-drop
spring.jpa.show-sql=true

logging.level.org.springframework.security=DEBUG

---

Pruebas

Lista de verificación

• Página de inicio accesible para todos
• Login con user/user123 → Dashboard
• Login con admin/admin123 → Dashboard + acceso Admin
• User no puede acceder a /admin (403)
• Logout funciona
• Registro crea un nuevo usuario

Pruebas manuales

1. http://localhost:8080 → Página de inicio
2. Clic "Iniciar sesión" → Página de login
3. Login admin/admin123 → Dashboard
4. Acceso /admin → OK
5. Logout → Regreso a login
6. Login user/user123 → Dashboard
7. Acceso /admin → 403 Forbidden

---

🎯 Próximo Paso

➡️ TP8.2: API REST con JWT

---

⬅️ Volver al Módulo 8