spring authorization

Question

I have some problems with authorization. I don't want to use Spring Security, just simple authorization form (with two fields: UserName, Password and submit button). Then user can work with application data (data representation depends on UserName). But I don't know, how to save UserName of authorized user for any further manipulations (in session scope. for example to show only authorized user data).

Also I want to protect application in a such way: if user somehow knew about addresses of my pages (e.g. /addRataPage, /deleteDataPage, and so on...), but tries to go there without authorization, he should be redirected to some page (for example, again to the authorization page).

Could you help me?

• guigui42: why dont you want to use Spring Security ? it does exactly what you are asking ...
• ring bearer: Looks like the term "authorization" here is misleading. The process here is authentication(login) not authorization. Authorization has more to it such as role based access to various resources etc.

Answer 1

Why not use Spring Security? It looks like it would solve your problems perfectly, as it would manage the authorisation for you, keep the username in scope, and allow only authorised users to access protected URLs. What's your objection to using it?

• Ilnur: I have two HSQLDB tables: owners, things.
• GaryF: Why would that stop you using Spring Security?
• Ilnur: Owners loks like this: ID, Name. And I want to join owners and system users, so that when user enters to the system, he can manipulate only with his things (things.id_user). I don't want to make another table (users) and connect it with owners table
• guigui42: You can customize Spring Security to use your own table 'OWNERS'. Dont need to create another table
• Ilnur: Thanks to all! I found how to join Useres and Owners tables.