Styjun

I am using Spring boot 2.1.3 with JWT authentication.

the reference link is https://www.callicoder.com/spring-boot-spring-security-jwt-mysql-react-app-part-2/

@SpringBootApplication
public class LrimspublicApplication extends SpringBootServletInitializer implements CommandLineRunner

@Autowired
private PasswordEncoder passwordEncoder;


public static void main(String[] args) 
 SpringApplication.run(LrimspublicApplication.class, args);



@Override
protected SpringApplicationBuilder configure(SpringApplicationBuilder application) 
 return application.sources(LrimspublicApplication.class);



@Override
public void run(String... args) throws Exception 
 System.out.println(passwordEncoder.encode("devil@123"));

SpringSecurityConfig.java

@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(
 securedEnabled = true,
 jsr250Enabled = true,
 prePostEnabled = true
)
public class SecurityConfig extends WebSecurityConfigurerAdapter {

 @Autowired
 CustomUserDetailsService customUserDetailsService;

 @Autowired
 private JwtAuthenticationEntryPoint unauthorizedHandler;

 @Bean
 public JwtAuthenticationFilter jwtAuthenticationFilter() 
 return new JwtAuthenticationFilter();
 

 @Override
 public void configure(AuthenticationManagerBuilder authenticationManagerBuilder) throws Exception 
 authenticationManagerBuilder
 .userDetailsService(customUserDetailsService)
 .passwordEncoder(passwordEncoder());
 

 @Bean(BeanIds.AUTHENTICATION_MANAGER)
 @Override
 public AuthenticationManager authenticationManagerBean() throws Exception 
 return super.authenticationManagerBean();
 

 @Bean
 public PasswordEncoder passwordEncoder() 
 return PasswordEncoderFactories.createDelegatingPasswordEncoder();
 

 @Override
 protected void configure(HttpSecurity http) throws Exception 
 http
 .cors()
 .and()
 .csrf()
 .disable()
 .exceptionHandling()
 .authenticationEntryPoint(unauthorizedHandler)
 .and()
 .sessionManagement()
 .sessionCreationPolicy(SessionCreationPolicy.STATELESS)
 .and()
 .authorizeRequests()
 .antMatchers("/",
 "/favicon.ico",
 "/**/*.png",
 "/**/*.gif",
 "/**/*.svg",
 "/**/*.jpg",
 "/**/*.html",
 "/**/*.css",
 "/**/*.js")
 .permitAll()
 .antMatchers("/api/auth/**")
 .permitAll()
 .antMatchers("/app/**").permitAll()
 .antMatchers("/api/user/checkUsernameAvailability", "/api/user/checkEmailAvailability")
 .permitAll()
 .antMatchers(HttpMethod.GET, "/api/polls/**", "/api/users/**")
 .permitAll()
 .anyRequest()
 .authenticated();

 // Add our custom JWT security filter
 http.addFilterBefore(jwtAuthenticationFilter(), UsernamePasswordAuthenticationFilter.class);

 

and now i am creating new user using a post API which looks like this

@RequestMapping(value = "/app/user/create", method = RequestMethod.POST)
 @ResponseBody
 public Tbluser createUser(HttpServletRequest request, HttpServletResponse response) throws ParseException

 String district="";
 String office=null;
 String gender="";
 String firstName=""; 
 String middleName="";
 String lastName="";
 String mobileNumber="";
 String emailID="";
 String dateOfBirth="";
 String address="";
 String userName="";
 String password="";
 String employeeId="";
 List<Tbluser> users=null;
 Tbluser user=new Tbluser();
 String encryptedPassword="";
 DateFormat df = new SimpleDateFormat("yyyy-MM-dd");
 DateFormat dateformatter = new SimpleDateFormat("dd-MM-yyyy");
 Date dt_dateOfBirth = null;
 Tblrole role=new Tblrole();
 //String userTypeId="Official";
 String userTypeId="4";
 String active="1";
 String description="";
 Date createdDate;
 String createdBY=""; 
 String userId="";
 String newUserRole="";
 String secretcode="";
 String firstNameNepali="";
 String middleNameNepali ="";
 String lastNameNepali = "";

 try 
 trydistrict = ServletRequestUtils.getRequiredStringParameter(request, "ddlAddUserDistrict");catch(Exception ex)
 tryoffice = ServletRequestUtils.getRequiredStringParameter(request, "ddlAddUserOffice");catch(Exception ex) 
 trygender=ServletRequestUtils.getRequiredStringParameter(request, "ddlAddUserGender");catch(Exception ex) 
 tryfirstName=ServletRequestUtils.getRequiredStringParameter(request, "txtAddUserUserFirstName");catch(Exception ex) 
 trymiddleName = ServletRequestUtils.getRequiredStringParameter(request, "txtAddUserUserMiddleName");catch(Exception ex)
 trylastName = ServletRequestUtils.getRequiredStringParameter(request, "txtAddUserUserLastName"); catch(Exception ex)
 trymobileNumber = ServletRequestUtils.getRequiredStringParameter(request, "txtAddUserMobileNumber");catch(Exception ex)
 tryemailID = ServletRequestUtils.getRequiredStringParameter(request, "txtAddUserEmailID"); catch(Exception ex) 
 trydateOfBirth = ServletRequestUtils.getRequiredStringParameter(request, "hidUserDateOfBirth");catch(Exception ex) 
 tryaddress = ServletRequestUtils.getRequiredStringParameter(request, "txtAddUserAddress"); catch(Exception ex) 
 tryuserName = ServletRequestUtils.getRequiredStringParameter(request, "txtAddUserUserName");catch(Exception ex)
 trypassword = ServletRequestUtils.getRequiredStringParameter(request, "txtAddUserPassword");catch(Exception ex)
 tryemployeeId = ServletRequestUtils.getRequiredStringParameter(request, "txtAddUserEmployeeId");catch(Exception ex) 
 trysecretcode= ServletRequestUtils.getRequiredStringParameter(request, "txtAddUserSecretCode");catch(Exception ex)
 if (!dateOfBirth.isEmpty() && dateOfBirth!=null)
 
 //dt_dateOfBirth = df.parse(dateOfBirth); 
 dt_dateOfBirth = dateformatter.parse(dateOfBirth); 
 
 trydescription = ServletRequestUtils.getRequiredStringParameter(request, "txtAddUserDescription"); catch(Exception ex) 
 trycreatedBY= ServletRequestUtils.getRequiredStringParameter(request, "hid-createdBy");catch(Exception ex) 
 tryuserId=ServletRequestUtils.getRequiredStringParameter(request, "hid-userId");catch(Exception ex)
 trynewUserRole=ServletRequestUtils.getRequiredStringParameter(request, "user_roles");catch(Exception ex) 

 tryfirstNameNepali=ServletRequestUtils.getRequiredStringParameter(request, "txtAddUserUserFirstNameNepali");catch(Exception ex) 
 trymiddleNameNepali = ServletRequestUtils.getRequiredStringParameter(request, "txtAddUserUserMiddleNameNepali");catch(Exception ex)
 trylastNameNepali = ServletRequestUtils.getRequiredStringParameter(request, "txtAddUserUserLastNameNepali");catch(Exception ex)



 //*To save Biometric and Image data*//*
 try
 String imagedata = ServletRequestUtils.getRequiredStringParameter(request, "imagedataForSeller");
 String leftthumbimage = ServletRequestUtils.getRequiredStringParameter(request, "hidUserInformationLeftThumbImpressionImage");
 String leftthumbdata = ServletRequestUtils.getRequiredStringParameter(request, "hidUserInformationLeftThumbImpressionData");
 String rightthumbimage = ServletRequestUtils.getRequiredStringParameter(request, "hidUserInformationRightThumbImpressionImage");
 String rightthumbdata = ServletRequestUtils.getRequiredStringParameter(request, "hidUserInformationRightThumbImpressionData");
 String signaturedata = ServletRequestUtils.getRequiredStringParameter(request, "hidOldSellerSignatureImage");

 if(user.getSignature() == null 
 catch(Exception ex)

 tryuser.setTbldistrict(districtService.findDistirctById(Long.parseLong(district)));catch(Exception ex)
 tryuser.setTbloffice(officeService.findOfficeById(Long.parseLong(office)));catch(Exception ex)
 tryuser.setTblgender(genderService.findGenderById(Long.parseLong(gender)));catch(Exception ex)
 tryuser.setAddress(address);catch(Exception ex)
 tryuser.setUsername(userName);catch(Exception ex)
 tryuser.setPassword(passwordEncoder.encode(password));catch (Exception ex)

 role=roleService.findRoleByID(Long.parseLong(newUserRole));

 //* Role mapping *//*

 Set<Tblrole> roleSet = new HashSet<Tblrole>();
 roleSet.add(role);
 user.setTblroles(roleSet);

 user= userService.saveUser(user);
 catch(Exception ex)
 logger.error(ex);
 
 return user;

 

The user create api successfully creates/inserts the user into database. now when i try to login it fails and says bad credentials:

my login controller is

@PostMapping("/signin")
 public ResponseEntity<?> authenticateUser(@Valid @RequestBody LoginRequest loginRequest) 

 Authentication authentication = authenticationManager.authenticate(
 new UsernamePasswordAuthenticationToken(
 loginRequest.getUsernameOrEmail(),
 loginRequest.getPassword()
 )
 );

 //Tbluser user = userRepository.findByUsername(loginRequest.getUsernameOrEmail());
 Optional<Tbluser> user = userRepository.findByUsername(loginRequest.getUsernameOrEmail());

 Tbluser u = new Tbluser();
 if(user.isPresent())
 u = user.get();
 

 Tbluser uu =new Tbluser() ;
// UserPojo userPojo =

 Map<String ,Object> map = new HashMap<>();
 Set<Tblrole> roleList = uu.getTblroles();


 SecurityContextHolder.getContext().setAuthentication(authentication);

 UserPrincipal userPrincipal = (UserPrincipal) authentication.getPrincipal();

 String accessToken = tokenProvider.generateToken(authentication);
 String refreshToken = tokenProvider.generateRefreshToken();

 //saveRefreshToken(userPrincipal, refreshToken);

 StringBuilder builder = new StringBuilder();
 String combinedToken =builder.append(accessToken).append(",").append(refreshToken).toString();

 return ResponseEntity.ok().header("Authorization",combinedToken).body(map);
 

UPDATED:-

@Service
public class CustomUserDetailsService implements UserDetailsService 

 @Autowired
 UserRepository userRepository;

 @Override
 @Transactional
 public UserDetails loadUserByUsername(String usernameOrEmail)
 throws UsernameNotFoundException 
 // Let people login with either username or email
 Tbluser user = userRepository.findByUsername(usernameOrEmail)
 .orElseThrow(() ->
 new UsernameNotFoundException("User not found with username or email : " + usernameOrEmail)
 );

 return UserPrincipal.create(user);
 

 @Transactional
 public UserDetails loadUserById(Long id) 
 Tbluser user = userRepository.findById(id).orElseThrow(
 () -> new ResourceNotFoundException("User", "id", id)
 );

 return UserPrincipal.create(user);
 

and UserPrincipal is:-

public class UserPrincipal implements UserDetails 
 private Long id;

 private String name;

 private String username;

 @JsonIgnore
 private String email;

 @JsonIgnore
 private String password;

 private Collection<? extends GrantedAuthority> authorities;

 public UserPrincipal(Long id, String name, String username, String email, String password, Collection<? extends GrantedAuthority> authorities) 
 this.id = id;
 this.name = name;
 this.username = username;
 this.email = email;
 this.password = password;
 this.authorities = authorities;
 

 public static UserPrincipal create(Tbluser user) 
 List<GrantedAuthority> authorities = user.getTblroles().stream().map(role ->
 new SimpleGrantedAuthority(role.getRolename())
 ).collect(Collectors.toList());

 return new UserPrincipal(
 user.getUserid(),
 user.getFirstname(),
 user.getUsername(),
 user.getEmailid(),
 user.getPassword(),
 authorities
 );
 

//getter setter excluded

now the interesting part is whenever i replace my password in database with the password generated on console (from commandlinerunner implementation) it successfully generates token.

and now when i see /app/create/user api to create user i see nothing wrong in creating the user.

what have i been missing ? pointing an error will really be a massive help to me.