Chapitre 2: Authentification Basique

Introduction

Ce chapitre vous apprend à configurer les méthodes d'authentification les plus courantes: Form Login et HTTP Basic. Vous apprendrez également à stocker les utilisateurs en base de données avec des mots de passe sécurisés.

---

🎯 Objectifs du Chapitre

À la fin de ce chapitre, vous saurez:

1. ✅ Configurer l'authentification par formulaire
2. ✅ Configurer HTTP Basic pour les API
3. ✅ Implémenter UserDetailsService avec la base de données
4. ✅ Utiliser BCrypt pour encoder les mots de passe
5. ✅ Personnaliser les pages login/logout

---

1. Configuration de Base

Dépendances

<!-- pom.xml -->
<dependencies>
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-security</artifactId>
    </dependency>
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-web</artifactId>
    </dependency>
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-data-jpa</artifactId>
    </dependency>
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-thymeleaf</artifactId>
    </dependency>
    <!-- Pour les extras Thymeleaf + Security -->
    <dependency>
        <groupId>org.thymeleaf.extras</groupId>
        <artifactId>thymeleaf-extras-springsecurity6</artifactId>
    </dependency>
</dependencies>

Configuration Minimale

@Configuration
@EnableWebSecurity
public class SecurityConfig {

    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        return http
            .authorizeHttpRequests(auth -> auth
                .requestMatchers("/", "/home", "/css/**", "/js/**").permitAll()
                .requestMatchers("/admin/**").hasRole("ADMIN")
                .anyRequest().authenticated()
            )
            .formLogin(form -> form
                .loginPage("/login")
                .defaultSuccessUrl("/dashboard")
                .permitAll()
            )
            .logout(logout -> logout
                .logoutSuccessUrl("/login?logout")
                .permitAll()
            )
            .build();
    }

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }
}

---

2. Utilisateurs en Mémoire (Test)

Pour le Développement Uniquement

@Configuration
@EnableWebSecurity
public class SecurityConfig {

    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        return http
            .authorizeHttpRequests(auth -> auth
                .anyRequest().authenticated()
            )
            .formLogin(Customizer.withDefaults())
            .build();
    }

    @Bean
    public UserDetailsService userDetailsService(PasswordEncoder encoder) {
        UserDetails user = User.builder()
            .username("user")
            .password(encoder.encode("password"))
            .roles("USER")
            .build();

        UserDetails admin = User.builder()
            .username("admin")
            .password(encoder.encode("admin123"))
            .roles("ADMIN", "USER")
            .build();

        return new InMemoryUserDetailsManager(user, admin);
    }

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }
}

attention

InMemoryUserDetailsManager est uniquement pour les tests et le développement. En production, utilisez une base de données!

---

3. Utilisateurs en Base de Données

3.1 Entité User

@Entity
@Table(name = "users")
@Data
@NoArgsConstructor
@AllArgsConstructor
public class User {

    @Id
    @GeneratedValue(strategy = GenerationType.IDENTITY)
    private Long id;

    @Column(unique = true, nullable = false)
    private String username;

    @Column(nullable = false)
    private String password;

    @Column(unique = true, nullable = false)
    private String email;

    private boolean enabled = true;

    @ManyToMany(fetch = FetchType.EAGER)
    @JoinTable(
        name = "user_roles",
        joinColumns = @JoinColumn(name = "user_id"),
        inverseJoinColumns = @JoinColumn(name = "role_id")
    )
    private Set<Role> roles = new HashSet<>();
}

3.2 Entité Role

@Entity
@Table(name = "roles")
@Data
@NoArgsConstructor
@AllArgsConstructor
public class Role {

    @Id
    @GeneratedValue(strategy = GenerationType.IDENTITY)
    private Long id;

    @Column(unique = true, nullable = false)
    private String name;  // ROLE_USER, ROLE_ADMIN

    public Role(String name) {
        this.name = name;
    }
}

3.3 Repository

@Repository
public interface UserRepository extends JpaRepository<User, Long> {
    Optional<User> findByUsername(String username);
    boolean existsByUsername(String username);
    boolean existsByEmail(String email);
}

@Repository
public interface RoleRepository extends JpaRepository<Role, Long> {
    Optional<Role> findByName(String name);
}

3.4 CustomUserDetails

public class CustomUserDetails implements UserDetails {

    private final User user;

    public CustomUserDetails(User user) {
        this.user = user;
    }

    @Override
    public Collection<? extends GrantedAuthority> getAuthorities() {
        return user.getRoles().stream()
            .map(role -> new SimpleGrantedAuthority(role.getName()))
            .collect(Collectors.toList());
    }

    @Override
    public String getPassword() {
        return user.getPassword();
    }

    @Override
    public String getUsername() {
        return user.getUsername();
    }

    @Override
    public boolean isAccountNonExpired() {
        return true;
    }

    @Override
    public boolean isAccountNonLocked() {
        return true;
    }

    @Override
    public boolean isCredentialsNonExpired() {
        return true;
    }

    @Override
    public boolean isEnabled() {
        return user.isEnabled();
    }

    // Pour accéder à l'entité User complète
    public User getUser() {
        return user;
    }
}

3.5 CustomUserDetailsService

@Service
@RequiredArgsConstructor
public class CustomUserDetailsService implements UserDetailsService {

    private final UserRepository userRepository;

    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        User user = userRepository.findByUsername(username)
            .orElseThrow(() -> new UsernameNotFoundException(
                "Utilisateur non trouvé: " + username
            ));

        return new CustomUserDetails(user);
    }
}

3.6 Configuration avec la BDD

@Configuration
@EnableWebSecurity
@RequiredArgsConstructor
public class SecurityConfig {

    private final CustomUserDetailsService userDetailsService;

    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        return http
            .authorizeHttpRequests(auth -> auth
                .requestMatchers("/", "/register", "/css/**", "/js/**").permitAll()
                .requestMatchers("/admin/**").hasRole("ADMIN")
                .anyRequest().authenticated()
            )
            .formLogin(form -> form
                .loginPage("/login")
                .defaultSuccessUrl("/dashboard")
                .permitAll()
            )
            .logout(logout -> logout
                .logoutSuccessUrl("/login?logout")
                .deleteCookies("JSESSIONID")
                .permitAll()
            )
            .userDetailsService(userDetailsService)
            .build();
    }

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }

    @Bean
    public AuthenticationManager authenticationManager(
            AuthenticationConfiguration config) throws Exception {
        return config.getAuthenticationManager();
    }
}

---

4. Service d'Inscription

UserService

@Service
@RequiredArgsConstructor
public class UserService {

    private final UserRepository userRepository;
    private final RoleRepository roleRepository;
    private final PasswordEncoder passwordEncoder;

    @Transactional
    public User registerUser(String username, String email, String password) {
        // Vérifications
        if (userRepository.existsByUsername(username)) {
            throw new RuntimeException("Ce nom d'utilisateur existe déjà");
        }
        if (userRepository.existsByEmail(email)) {
            throw new RuntimeException("Cet email est déjà utilisé");
        }

        // Créer l'utilisateur
        User user = new User();
        user.setUsername(username);
        user.setEmail(email);
        user.setPassword(passwordEncoder.encode(password));  // ← Encodage!
        user.setEnabled(true);

        // Assigner le rôle USER par défaut
        Role userRole = roleRepository.findByName("ROLE_USER")
            .orElseThrow(() -> new RuntimeException("Rôle ROLE_USER non trouvé"));
        user.getRoles().add(userRole);

        return userRepository.save(user);
    }

    @Transactional
    public void promoteToAdmin(Long userId) {
        User user = userRepository.findById(userId)
            .orElseThrow(() -> new RuntimeException("Utilisateur non trouvé"));

        Role adminRole = roleRepository.findByName("ROLE_ADMIN")
            .orElseThrow(() -> new RuntimeException("Rôle ROLE_ADMIN non trouvé"));

        user.getRoles().add(adminRole);
        userRepository.save(user);
    }
}

---

5. HTTP Basic pour API

Configuration

@Configuration
@EnableWebSecurity
public class SecurityConfig {

    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        return http
            .csrf(csrf -> csrf.disable())  // Désactiver pour API REST
            .authorizeHttpRequests(auth -> auth
                .requestMatchers("/api/public/**").permitAll()
                .requestMatchers("/api/admin/**").hasRole("ADMIN")
                .requestMatchers("/api/**").authenticated()
            )
            .httpBasic(Customizer.withDefaults())  // ← HTTP Basic
            .sessionManagement(session -> session
                .sessionCreationPolicy(SessionCreationPolicy.STATELESS)
            )
            .build();
    }
}

Test avec cURL

# Sans authentification
curl http://localhost:8080/api/users
# 401 Unauthorized

# Avec authentification
curl -u user:password http://localhost:8080/api/users
# 200 OK + données

# Avec header explicite
curl -H "Authorization: Basic dXNlcjpwYXNzd29yZA==" http://localhost:8080/api/users

attention

HTTP Basic envoie les credentials encodés en Base64 (PAS chiffrés!). Utilisez TOUJOURS HTTPS en production!

---

6. Pages de Login Personnalisées

Controller

@Controller
public class AuthController {

    @GetMapping("/login")
    public String loginPage() {
        return "login";  // templates/login.html
    }

    @GetMapping("/register")
    public String registerPage(Model model) {
        model.addAttribute("user", new RegisterRequest());
        return "register";
    }

    @PostMapping("/register")
    public String register(@Valid @ModelAttribute("user") RegisterRequest request,
                          BindingResult result,
                          RedirectAttributes redirectAttributes) {
        if (result.hasErrors()) {
            return "register";
        }

        try {
            userService.registerUser(
                request.getUsername(),
                request.getEmail(),
                request.getPassword()
            );
            redirectAttributes.addFlashAttribute("success", "Inscription réussie!");
            return "redirect:/login";
        } catch (Exception e) {
            result.rejectValue("username", "error", e.getMessage());
            return "register";
        }
    }
}

Template Login (Thymeleaf)

<!-- templates/login.html -->
<!DOCTYPE html>
<html xmlns:th="http://www.thymeleaf.org">
<head>
    <title>Connexion</title>
    <link rel="stylesheet" th:href="@{/css/style.css}">
</head>
<body>
    <div class="login-container">
        <h1>Connexion</h1>
        
        <!-- Messages -->
        <div th:if="${param.error}" class="alert alert-danger">
            Nom d'utilisateur ou mot de passe incorrect.
        </div>
        <div th:if="${param.logout}" class="alert alert-info">
            Vous avez été déconnecté.
        </div>
        <div th:if="${success}" class="alert alert-success" th:text="${success}"></div>
        
        <!-- Formulaire -->
        <form th:action="@{/login}" method="post">
            <div class="form-group">
                <label for="username">Nom d'utilisateur</label>
                <input type="text" id="username" name="username" required>
            </div>
            
            <div class="form-group">
                <label for="password">Mot de passe</label>
                <input type="password" id="password" name="password" required>
            </div>
            
            <div class="form-group">
                <label>
                    <input type="checkbox" name="remember-me"> Se souvenir de moi
                </label>
            </div>
            
            <button type="submit">Se connecter</button>
        </form>
        
        <p>Pas encore de compte? <a th:href="@{/register}">S'inscrire</a></p>
    </div>
</body>
</html>

Configuration Remember-Me

@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
    return http
        // ... autres configs
        .rememberMe(remember -> remember
            .key("uniqueAndSecretKey")  // Clé de signature
            .tokenValiditySeconds(86400 * 7)  // 7 jours
            .userDetailsService(userDetailsService)
        )
        .build();
}

---

7. Accéder à l'Utilisateur Connecté

Dans un Controller

@RestController
@RequestMapping("/api")
public class ProfileController {

    // Méthode 1: Principal
    @GetMapping("/me")
    public String getCurrentUser(Principal principal) {
        return "Connecté en tant que: " + principal.getName();
    }

    // Méthode 2: Authentication
    @GetMapping("/profile")
    public Map<String, Object> getProfile(Authentication authentication) {
        CustomUserDetails userDetails = (CustomUserDetails) authentication.getPrincipal();
        User user = userDetails.getUser();

        return Map.of(
            "username", user.getUsername(),
            "email", user.getEmail(),
            "roles", authentication.getAuthorities()
        );
    }

    // Méthode 3: @AuthenticationPrincipal
    @GetMapping("/details")
    public User getDetails(@AuthenticationPrincipal CustomUserDetails userDetails) {
        return userDetails.getUser();
    }

    // Méthode 4: SecurityContextHolder (n'importe où)
    @GetMapping("/static")
    public String getFromContext() {
        Authentication auth = SecurityContextHolder.getContext().getAuthentication();
        return auth.getName();
    }
}

Dans Thymeleaf

<!-- Avec thymeleaf-extras-springsecurity6 -->
<html xmlns:th="http://www.thymeleaf.org"
      xmlns:sec="http://www.thymeleaf.org/extras/spring-security">
      
<!-- Afficher le nom d'utilisateur -->
<p>Bienvenue, <span sec:authentication="name">Utilisateur</span>!</p>

<!-- Afficher selon le rôle -->
<div sec:authorize="hasRole('ADMIN')">
    <a href="/admin">Administration</a>
</div>

<div sec:authorize="hasRole('USER')">
    <a href="/profile">Mon Profil</a>
</div>

<!-- Afficher si authentifié -->
<div sec:authorize="isAuthenticated()">
    <form th:action="@{/logout}" method="post">
        <button type="submit">Déconnexion</button>
    </form>
</div>

<!-- Afficher si NON authentifié -->
<div sec:authorize="isAnonymous()">
    <a href="/login">Connexion</a>
</div>

---

8. Gestion des Erreurs

AccessDeniedHandler Personnalisé

@Component
public class CustomAccessDeniedHandler implements AccessDeniedHandler {

    @Override
    public void handle(HttpServletRequest request,
                      HttpServletResponse response,
                      AccessDeniedException ex) throws IOException {
        
        // Pour API REST
        if (request.getRequestURI().startsWith("/api/")) {
            response.setContentType("application/json");
            response.setStatus(HttpServletResponse.SC_FORBIDDEN);
            response.getWriter().write("{\"error\": \"Accès refusé\"}");
        } else {
            // Pour les pages web
            response.sendRedirect("/access-denied");
        }
    }
}

Configuration

@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
    return http
        // ... autres configs
        .exceptionHandling(ex -> ex
            .accessDeniedHandler(customAccessDeniedHandler)
            .authenticationEntryPoint((request, response, authException) -> {
                if (request.getRequestURI().startsWith("/api/")) {
                    response.setContentType("application/json");
                    response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
                    response.getWriter().write("{\"error\": \"Non authentifié\"}");
                } else {
                    response.sendRedirect("/login");
                }
            })
        )
        .build();
}

---

9. Données Initiales

DataInitializer

@Component
@RequiredArgsConstructor
public class DataInitializer implements CommandLineRunner {

    private final RoleRepository roleRepository;
    private final UserRepository userRepository;
    private final PasswordEncoder passwordEncoder;

    @Override
    @Transactional
    public void run(String... args) {
        // Créer les rôles si absents
        if (roleRepository.count() == 0) {
            roleRepository.save(new Role("ROLE_USER"));
            roleRepository.save(new Role("ROLE_ADMIN"));
            roleRepository.save(new Role("ROLE_MANAGER"));
        }

        // Créer un admin par défaut si aucun utilisateur
        if (userRepository.count() == 0) {
            Role adminRole = roleRepository.findByName("ROLE_ADMIN").orElseThrow();
            Role userRole = roleRepository.findByName("ROLE_USER").orElseThrow();

            User admin = new User();
            admin.setUsername("admin");
            admin.setEmail("admin@example.com");
            admin.setPassword(passwordEncoder.encode("admin123"));
            admin.setEnabled(true);
            admin.setRoles(Set.of(adminRole, userRole));
            
            userRepository.save(admin);
        }
    }
}

---

10. Résumé

Points Clés

Concept	Description
Form Login	Authentification par formulaire web
HTTP Basic	Header Authorization pour API
UserDetailsService	Interface pour charger les utilisateurs
PasswordEncoder	Encodage des mots de passe (BCrypt)
CustomUserDetails	Adapter User à UserDetails

Configuration Type

@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
    return http
        .authorizeHttpRequests(auth -> auth
            .requestMatchers("/public/**").permitAll()
            .requestMatchers("/admin/**").hasRole("ADMIN")
            .anyRequest().authenticated()
        )
        .formLogin(form -> form
            .loginPage("/login")
            .permitAll()
        )
        .logout(logout -> logout.permitAll())
        .build();
}

Checklist

✅ Encoder les mots de passe avec BCrypt
✅ Implémenter UserDetailsService pour la BDD
✅ Créer CustomUserDetails si besoin
✅ Configurer les pages login/logout
✅ Gérer les erreurs d'accès
✅ Créer les rôles et utilisateurs initiaux

---

🎯 Prochaine Étape

L'authentification par session est parfaite pour les applications web, mais pour les API REST modernes, JWT est le standard.

➡️ Chapitre 3: JWT (JSON Web Tokens)

---

⬅️ Retour au Module 8