UserDetailsManager is the Spring Security contract for applications that must manage users, not merely retrieve them during authentication. It extends UserDetailsService and adds operations for creating users, updating users, deleting users, changing passwords, and checking whether a user exists. section 3.0 section 3.3.3
public interface UserDetailsManager extends UserDetailsService {
void createUser(UserDetails user);
void updateUser(UserDetails user);
void deleteUser(String username);
void changePassword(String oldPassword, String newPassword);
boolean userExists(String username);
}
The interface listing makes the separation concrete: authentication requires UserDetailsService, while user administration uses the additional UserDetailsManager operations. section 3.3.3
Choose the contract that matches the application’s responsibility:
- Use UserDetailsService when the application only needs to retrieve a user by username for authentication. section 3.1
- Use UserDetailsManager when the application also adds, modifies, deletes, or checks users. section 3.1 section 3.3.3
- Use InMemoryUserDetailsManager for in-memory users, JdbcUserDetailsManager for SQL-backed users, or LdapUserDetailsManager for LDAP-backed users. section 3.3.3 section 3.4
Persisting users with JDBC
Register JdbcUserDetailsManager as the UserDetailsService bean and provide a DataSource. With its default queries, it expects users and authorities tables; custom queries can adapt it to different table names or schemas. A protected /hello endpoint can then be tested with curl using a stored username and password. section 3.3 section 3.3.3
