UserDetails is the Spring Security contract for representing a user during authentication and authorization. An application class implements it so the framework can understand that user. section 3.2 section 3.2.1
Implement the contract through these responsibilities:
- Return the username and password used during authentication. section 3.2.1
- Return one or more GrantedAuthority instances representing permitted actions or roles. section 3.2.1 section 7.1
- Report whether the account, credentials, and user account are expired, locked, or enabled. section 3.2.1
- Return true for the four status methods when the application does not implement expiration, locking, or disabling rules. section 3.2.1
UserDetails supplies the user object that UserDetailsService retrieves by username. After authentication, its authorities support authorization decisions, while UserDetailsManager adds user-management operations around the retrieval contract. section 3.1 section 3.4
A practical user implementation
A SimpleUser stores username and password in constructor fields, returns them from the matching methods, supplies authorities through getAuthorities(), and implements the four status methods. A minimal DummyUser can represent bill with password 12345 and READ authority, but a parameterized class supports multiple users. section 3.2.3
Listing 3.1 The UserDetails interface
public interface UserDetails extends Serializable {
String getUsername(); #1
String getPassword();
Collection<? extends GrantedAuthority> getAuthorities(); #2
boolean isAccountNonExpired(); #3
boolean isAccountNonLocked();
boolean isCredentialsNonExpired();
boolean isEnabled();
}
Inspect the complete UserDetails interface, including authentication values, authorities, and account-status methods. section 3.2.1
