jhipster-security

JHipster Security

Configure and customize security in JHipster applications using JWT, OAuth2/Keycloak, role-based access control, and method-level security.

When to Use

• When protecting REST endpoints by role
• When creating custom roles and authorities
• When configuring JWT or OAuth2/Keycloak
• When adding method-level security (@PreAuthorize)
• When setting up CORS, CSRF, or rate limiting

Available Operations

1. Configure endpoint security by role
2. Create custom roles and authorities
3. Add method-level security annotations
4. Configure OAuth2 with Keycloak
5. Apply security checklist

Multi-Step Workflow

Step 1: Configure Endpoint Protection

@Configuration
public class SecurityConfiguration {

    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http
            .authorizeHttpRequests(auth -> auth
                .requestMatchers("/api/public/**").permitAll()
                .requestMatchers("/api/admin/**").hasAuthority(AuthoritiesConstants.ADMIN)
                .requestMatchers("/api/demands/**").hasAnyAuthority(
                    AuthoritiesConstants.USER, AuthoritiesConstants.ADMIN)
                .requestMatchers("/api/agents/**").hasAuthority("ROLE_AGENT")
                .requestMatchers("/api/**").authenticated()
            );
        return http.build();
    }
}

Step 2: Define Custom Roles

public final class AuthoritiesConstants {
    public static final String ADMIN = "ROLE_ADMIN";
    public static final String USER = "ROLE_USER";
    public static final String AGENT = "ROLE_AGENT";        // AI Agents
    public static final String TECH_LEAD = "ROLE_TECH_LEAD"; // Merge approver
}

Add roles to Liquibase data:

# Edit authority.csv to add new roles
cat src/main/resources/config/liquibase/data/authority.csv

Step 3: Add Method-Level Security

@Service
public class DemandServiceImpl implements DemandService {

    @PreAuthorize("hasAuthority('ROLE_TECH_LEAD')")
    public void approveMerge(Long demandId) {
        // Only tech lead can approve merge
    }

    @PreAuthorize("#login == authentication.name or hasAuthority('ROLE_ADMIN')")
    public DemandDTO findByUser(String login) {
        // User sees only their demands, admin sees all
    }
}