DEV Community: Jitendra Singh Bisht

Spring security using OAuth2 with Microsoft AzureAD B2C

Jitendra Singh Bisht — Sun, 13 Sep 2020 09:52:20 +0000

The blog is originally published on my blog jsblogs.github.io

Introduction
Video Tutorial

Introduction

Microsoft Azure provides the capability to integrate social-logins in the application by using AzureAD B2C.
The good thing about that is you'll have a single Authorization server (Azure) and different IDP like Google, Facebook, GitHub, or any custom IDP.

To achieve this we need to create 1 B2C tenant and configure App Registration, IDP, and create UserFlow. The below video tutorial covers all these
steps and guide you on how to integrate Azure B2C with spring security.

Video Tutorial

Spring security with JWT based login [Without OAuth]

Jitendra Singh Bisht — Fri, 28 Aug 2020 14:11:27 +0000

The blog is originally published on my blog jsblogs.github.io

Introduction
Video Tutorial
Source Code

Introduction

This blog post will demonstrate the spring-security with JWT token based login without using OAuth. In some use-cases where you require stateless/token based login
but doesn't want to go with OAuth for any reason, the JWT based login is useful.

Video Tutorial

Source Code

The source code for tutorial can be found here.

Spring security using OAuth2 with AngularJs [JWT]

Jitendra Singh Bisht — Mon, 24 Aug 2020 17:01:48 +0000

The blog is originally published on my blog jsblogs.github.io

Introduction
Technologies used
Sequence Diagram of OAuth2 Flow
The JwtTokenStore

Introduction

This blog post will demonstrate the spring-security & angular JS integration using JWT token. My previous blog explains how we can configure classes to integrate
spring security with angular. I recommend you to watch my previous video tutorial because this tutorial is an addition over that video.

Spring Security using OAuth2 with Angular JS

Jitendra Singh Bisht ・ Jun 27 ・ 1 min read

#angular #tutorial #security #java

In that video tutorial I created TokenStore class to store the token which I'll re-write in this blog to generate JWT tokens.

Technologies used

Java
Spring Boot
Spring Security
Angular JS 8

Sequence Diagram of OAuth2 Flow

The JwtTokenStore

In that video tutorial I've created HashMap based token store. Now we're going to overwrite that class and will
create one JWT based implementation.

package com.demo.security.config;

import com.nimbusds.jose.JOSEObjectType;
import com.nimbusds.jose.JWSAlgorithm;
import com.nimbusds.jose.JWSHeader;
import com.nimbusds.jose.crypto.ECDSASigner;
import com.nimbusds.jose.jwk.Curve;
import com.nimbusds.jose.jwk.ECKey;
import com.nimbusds.jose.jwk.gen.ECKeyGenerator;
import com.nimbusds.jwt.JWT;
import com.nimbusds.jwt.JWTClaimsSet;
import com.nimbusds.jwt.SignedJWT;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.authority.SimpleGrantedAuthority;
import org.springframework.security.oauth2.client.authentication.OAuth2AuthenticationToken;
import org.springframework.security.oauth2.core.user.DefaultOAuth2User;
import org.springframework.stereotype.Component;

import java.security.interfaces.ECPrivateKey;
import java.time.LocalDateTime;
import java.time.ZoneId;
import java.time.temporal.ChronoUnit;
import java.time.temporal.TemporalUnit;
import java.util.Collection;
import java.util.Date;
import java.util.List;
import java.util.Map;
import java.util.stream.Collectors;

@Component
public class JwtTokenStore implements ITokenStore {
    // 1
    private final String tokenSignKey = "c5d4d70419bd4909a1e502812c6e1f2b";

    // 2
    private final String REG_ID = "clientRegistrationId";
    private final String NAMED_KEY = "namedAttributeKey";
    private final String AUTHORITIES = "authorities";
    private final String ATTRIBUTES = "attributes";

    // 3
    public String generateToken( Authentication authentication ) throws Exception {

        OAuth2AuthenticationToken token = ( OAuth2AuthenticationToken ) authentication;
        DefaultOAuth2User userDetails = ( DefaultOAuth2User ) token.getPrincipal();

        // 4
        List<String> auths = userDetails.getAuthorities()
                .stream()
                .map( GrantedAuthority::getAuthority )
                .collect( Collectors.toList());
        // 5
        JWTClaimsSet claimsSet = new JWTClaimsSet.Builder()
                .subject(  userDetails.getAttribute("id").toString())
                .expirationTime( getDate( 5, ChronoUnit.HOURS ) )
                .claim( NAMED_KEY, "name" )
                .claim( ATTRIBUTES, userDetails.getAttributes() )
                .claim( AUTHORITIES, auths )
                .claim( REG_ID, token.getAuthorizedClientRegistrationId() )
                .build();

        // 6
        ECKey key = new ECKeyGenerator( Curve.P_256 ).keyID( tokenSignKey ).generate();
        JWSHeader h = new JWSHeader.Builder( JWSAlgorithm.ES256 )
                .type( JOSEObjectType.JWT )
                .keyID( key.getKeyID() )
                .build();
        SignedJWT jwt = new SignedJWT( h, claimsSet );
        // 7
        jwt.sign( new ECDSASigner( ( ECPrivateKey ) key.toPrivateKey() ) );
        return jwt.serialize();
    }

    // 8
    public Authentication getAuth( String jwt ) throws Exception {
        SignedJWT signedJWT = SignedJWT.parse( jwt );
        // 9
        validateJwt( signedJWT );

        JWTClaimsSet claimsSet = signedJWT.getJWTClaimsSet();

        // 10
        String clientRegistrationId = (String ) claimsSet.getClaim( REG_ID );
        String namedAttributeKey = (String) claimsSet.getClaim( NAMED_KEY );
        Map<String, Object> attributes = (Map<String, Object>)claimsSet.getClaim( ATTRIBUTES );
        Collection<? extends GrantedAuthority > authorities =( (List<String> ) claimsSet.getClaim( AUTHORITIES ))
                .stream().map( SimpleGrantedAuthority::new ).collect( Collectors.toSet());

        // 11
        return new OAuth2AuthenticationToken(
                new DefaultOAuth2User( authorities, attributes, namedAttributeKey ),
                authorities,
                clientRegistrationId
        );
    }

    private static Date getDate( long amount, TemporalUnit unit ) {
        return Date.from(
                LocalDateTime.now()
                .plus( amount, unit )
                .atZone( ZoneId.systemDefault() )
                .toInstant()
        );
    }

    private void validateJwt( JWT jwt ) throws Exception {
        // 12
        if(jwt.getJWTClaimsSet().getExpirationTime().before( new Date() )){
            throw new RuntimeException("Token Expired!!");
        }

        // Add validation logic here..
    }
}

In the above code base I have added comment numbers which I am going to explain here.

Token sign key will be used to sign the JWT. You can use your own key.
Attributes which I'm going to get from Authentication object and will put them in the JWT which I'll be using later on to construct the Authentication Object.
The generateToken method will accept Authentication object and build JWT token from that.
Collecting all the authorities name.
Preparing JWT claims with values like Subject, Authorities, Attributes, NamedAttributeKey (required by DefaultOAuth2User), and token expire time
Prepare Sign key to Sign the JWT token.
Sign the token and return.
The getAuth method takes JWT token and prepares the Authentication object from the valid token.
Validating the JWT token currently I'm validating the expireTime only, but you can add your custom validation logic.
Get required objects from JWT claims which will be used to prepare Authentication token.
Prepare and return the valid OAuth2AuthenticationToken.
Validating the expirationTime with current time.

The running code can be found here.

Spring Security using OAuth2 with Angular JS

Jitendra Singh Bisht — Sat, 27 Jun 2020 04:55:54 +0000

The blog is originally published on my blog jsblogs.github.io

Sequence diagram of OAuth2 Flow

Video Tutorial

Spring security using OAuth2 with Microsoft AzureAD

Jitendra Singh Bisht — Sat, 11 Apr 2020 13:06:22 +0000

The blog is originally published on my blog jsblogs.github.io

How to execute code on Spring application start-up

Jitendra Singh Bisht — Tue, 25 Feb 2020 06:42:39 +0000

The blog is originally published on my blog jsblogs.github.io

Introduction
Technologies used
Application Events
ApplicationRunner

Introduction

Have you ever encountered a situation where you've to perform some tasks immediately after the Spring/SpringBoot application starts. i.e.
Initialize some data into database, initialize application level constants, make an API call, etc.

There are several ways to achieve it. Here I'm gonna discuss about:

Application events
ApplicationRunner

Technologies used

Java 11
Spring Boot 2.2.4
Gradle 6.0.1

Application events

The Spring framework triggers various events. For our use case we'll be more interested in ContextStartedEvent and ContextRefreshedEvent.
ContextStartedEvent event triggered at the time of context gets started.
ContextRefreshedEvent event triggered at the time of context gets started or refreshed.

@Component
public class EventHandler {
    @EventListener(ContextStartedEvent.class)
    public void handleContextStartEvent(ContextStartedEvent e) {
        // Write your code here
    }

    @EventListener(ContextRefreshedEvent.class)
    public void handleContextRefreshEvent(ContextRefreshedEvent e) {
        // Write your code here
    }
    // Or you can handle both the events in 1 method  

    @EventListener({ContextStartedEvent.class, ContextRefreshedEvent.class})
    public void handleBoth(ApplicationContextEvent e) {
        if (e instanceof ContextStartedEvent) {

        } else {

        }
    }
}

ApplicationRunner

SpringBoot provides an interface called ApplicationRunner, any bean implementing this interface should run when that contained in the SpringApplication.

@Component
public class DBInitializer implements ApplicationRunner {

    private final UserRepository userRepository;

    private DBInitializer(UserRepository userRepository) {
        this.userRepository = userRepository;
    }

    @Override
    public void run(ApplicationArguments args) throws Exception {
        // Initialize user here
    }
}

or the above can be used

@Configuration
public class Config {

@Bean
    public ApplicationRunner initializeUser(UserRepository userRepository) {
        return args -> {
            // Initialize user here
        };
    }
}

ApplicationRunner provides ApplicationArguments in the run method which is used to get command line arguments by invoking getSourceArgs().
You can also get the parsed arguments using this class. i.e.

Let's say you've passed command line arguments like
--source /usr/local --print-only --target /tmp/local

So the method call to

getOptionNames() in ApplicationArguments will return set of arguments - ['source', 'print-only', 'target']
containsOption(String name) checks if argument contains
getOptionValues(name) returns list of option values. getOptionValues('source') will return list - ['/usr/local']

Custom Auto-Configuration in SpringBoot

Jitendra Singh Bisht — Tue, 18 Feb 2020 03:17:27 +0000

The blog is originally published on my blog jsblogs.github.io

Introduction
Technologies used
Project Structure
Create config classes

Introduction

The goal of this blog is to understand the autoconfiguration provided by SpringBoot. I'll be creating a logging library for demo purpose and that will include Auto-Configuration class to create all required beans for that library.

Technologies used

Java 11
Spring Boot 2.2.4
Gradle 6.0.1

Project Structure

I'm using a Gradle multi-module project. The module logging-library will be a shared library that will be used in the service module.

Create config classes

Now It's time to create required config classes. I've created a config class called LoggingAutoConfiguration and marked as @Configuration and created one conditional bean.

@Configuration
public class LoggingAutoConfiguration {

    // We can define beans here

    @ConditionalOnMissingBean(Logger.class)
    @Bean
    public Logger getLogger() {
        return new ConsoleLogger();
    }
}

As of now this class is just a normal spring configuration and to make it auto-configuration class we need to follow 2 steps:

Step 1: Create spring.factories file

Create a file inlogging-library with name spring.factories under resources\META-INF\ directory.

Step 2: Register the auto-config class

Now add your configuration class into the spring.factories.

org.springframework.boot.autoconfigure.EnableAutoConfiguration=tutorials.logging.LoggingAutoConfiguration

That's it!!!

Now we can inject the module in service and we don't need to specify any package to scan from logging-library our auto-configuration class will take care of that.

You can find the running code here

Getting started with GraphQL (Java)

Jitendra Singh Bisht — Tue, 23 Jul 2019 04:00:00 +0000

GraphQL is query language for your Rest APIs and gives client power to select exactly what they need. It also provides server side runtime to execute the queries.

GraphQL has 3 major parts

GraphQL server
GraphQL Schema
Client

GraphQL Server

GraphQL server is responsible to validate & execute the queries and returns the response as per client’s need. The client can select the fields as per need and server will return only those selected fields.

GraphQL Schema

GraphQL has a specific language called GraphQL Schema language to define schema. GraphQL schema consist of the queries and types. As a API owner we can decide what queries & types will be available to the consumer. The schema has default root object type called Query which contains all the queries. An example schema is

#The root object
type Query {
    hello: String
    greet(name: String): String
}
 #Defined Type
type User{
    name: String
    age: Int
}

In above schema root object is Query and it has one field called hello and a method greet and both are returning String type. The greet has an input argument name which is a type of String. This means client can pass any string type argument while querying greet.

The User type is defined type which has 2 fields name and age. GraphQL supports several built-in types like String, Int, Float, Boolean, etc. Click here to read more about graphql schema and types.

For every field or query in the Query Type will have corresponding resolver which will be running at GraphQL Server.

Client

The clients are the consumer. Since GraphQL works over Rest so any rest client can query the graphql. There are few tools which are great for testing. These tools gives the auto-completion features and we can view all possible queries and types. Some of the tools are GraphiQL , insomnia.

GraphQL-Java in Action

Below code will demonstrate you how to integrate GraphQL in Spring application. So let’s start with the GraphQL schema file.

The code structure will look like

Define schema file users.graphql

type Query {
    hello: String
    users(name: String): User
}

type User {
    name: String
    age: Int
    address: String
}

Now well start configuring the GraphQL Java objects along with resolvers for the queries (hello & user).

Step 1: Read & parse schema file

Filename: GraphQLSchema.java

private TypeDefinitionRegistry readAndParseSchemaFile() throws Exception {
        String schemaString = ResourceUtils.readClasspathResourceContent("users.graphql");

        SchemaParser schemaParser = new SchemaParser();

        // parsing schema file and creating typeDefRegistery
        return schemaParser.parse(schemaString);
    }

Step 2: Configure Resolvers

private RuntimeWiring buildRuntimeWiring() {
        return RuntimeWiring.newRuntimeWiring()
                .type("Query", builder -> builder.dataFetchers(buildDataFetchers()))
                .build();
    }

    private Map<String, DataFetcher> buildDataFetchers() {
        Map<String, DataFetcher> dataFetchers = new HashMap<>();
        dataFetchers.put("hello", new StaticDataFetcher("Welcome to GraphQL world."));
        dataFetchers.put("users", env -> User.of("John", 28, "India"));
        return dataFetchers;
    }

Step 3: Prepare GraphQL object and execute query

private void setup() throws Exception {
        // We need to create GraphQLSchema Object but before that we need to configure resolvers 
        GraphQLSchema graphQLSchema = new SchemaGenerator().makeExecutableSchema(readAndParseSchemaFile(), buildRuntimeWiring());
        graphQL = GraphQL.newGraphQL(graphQLSchema).build();
    }

    public ExecutionResult executeQuery(String graphQLQuery) {
        return graphQL.execute(graphQLQuery);
    }

Step 4: Serve user queries on the endpoint (/graphql)

@RestController
    public class GraphQLController {

        private final GraphQLService graphQLService;

        @Autowired
        public GraphQLController(GraphQLService graphQLService) {
            this.graphQLService = graphQLService;
        }

        @PostMapping("/graphql")
        public Map<String, Object> executeQuery(@RequestBody GraphQLRequest request) {
            return graphQLService.executeQuery(request.getQuery()).toSpecification();
        }
    }

Step 5: User GraphiQL or Rest to execute graphql query

GraphiQL resource links

Add your /graphql controller’s endpoint in GraphiQL and start executing query

We can ask the response fields and graphql will serve only selected fields.

Query users for name only

Query users for all fields

We can ask for multiple queries in single request

Even same query with multiple times with alias

You can find complete code here

Happy Coding 😀😀😀 !!!

Whats new in Java 10

Jitendra Singh Bisht — Wed, 21 Mar 2018 04:00:00 +0000

So finally wait is over, Java 10 is in GA now. The cool feature of this build has already been in discussions. Yes, I’m talking about the var. In this blog, I’ll discuss some of the new features along with the almighty var.

1. Optional#orElseThrow()

Synonym for Optional.get() but more intuitive. It will throw java.util.NoSuchElementException same as get() but with the clear understanding that if the value isn’t there the method may throw an Exception, so the developer will think to handle the exceptional case as well.

class OptionalDemo {
    public void perform() {
        Optional<String> result = calculate();
        // It'll throw the exception 
        String result1 = result.get();

        // It'll also throw the exception but by it's name
        // developer might think of handling the exception
        String result1 = result.orElseThrow();
    }

    public Optional<String> calculate() {
        return Optional.empty();
    }
}

2. copyOf() in List, Set and Map

Added copyOf() in List, Set and Map to create unmodifiableCollections() from the given collection. This method checks if collection is already is type of java.util.ImmutableCollections.AbstractImmutableMap then simply return that otherwise create a new ImmutableCollection from the given.

class UnmodifiableCollectionDemo {

    public void usingList() {
        List<Integer> list = List.of(1, 2, 3, 4, 5);

        // already ImmutableCollection so simply returns
        List<Integer> unmodifiable1 = List.copyOf(list); 

        List<Integer> list1 = new ArrayList();
        list1.add(1);
        list1.add(2);

        // Creates new ImmutableCollection and returns
        List<Integer> unmodifiable = List.copyOf(list1); 
    } 
}

3. New methods added in Collectors

To collect stream result as Unmodifiable collection, 3 new methods added in java.util.stream.Collectors class.

toUnmodifiableList
toUnmodifiableSet
toUnmodifiableMap

class StreamsDemo {
    public void convertToUnmodifiableCollections(List<String> input) {

        // List demo
        List<String> list = input.stream()
                                .map(String::toUpperCase)
                                .collect(Collectors.toUnmodifiableList());

        // Set demo
        Set<String> set = input.stream()
                                .map(String::toUpperCase)
                                .collect(Collectors.toUnmodifiableSet());

        // Map demo
        Map<String, Integer> map = input.stream()
                                .map(String::toUpperCase)
                                .collect(Collectors.totoUnmodifiableMap(String::toString, String::length));
    }
}

4. var - Local Variable Type Inference

Type inference was introduced with lambdas. Now in Java 10 a new keyword var introduced for local variable type inference. This will remove the ceremony code to initialize local variables and maintain the java’s static typing. The type will be inferred by the compiler at compilation time.

public void varDemo() {
    int i = 10;
    List<String> list = new ArrayList<>();
    Map<String, Integer> map = new HashMap<>();

    // With var above code can be written as

    var i = 10; 
    var list = new ArrayList<String>();
    var map = new HashMap<String, Integer>();
}

Type inference can only be used with local variables and once the type is inferred then cannot be changed.

public void demo() {
    var name = "Jitendra";
    name = 3; // Not allowed
}

All the methods of the target type will be accessed with the declared variable.

public void demo() {
    var list = new ArrayList<String>();
    list.add("Jitendra");
    list.add("Singh");
}

Happy Coding 😀😀😀 !!! If you have any feedback please comment down below.

Optional to stream in java 9

Jitendra Singh Bisht — Thu, 08 Mar 2018 04:00:00 +0000

Last year Java 9 launched with tons of new features. In this blog post, I’m going to explain streams in Optional (introduced in Java8). Now you can get streams to form Optional which I think is a good feature.

Below example shows how to get a stream from Optional in Java 8 & Java 9.

package com.jbisht.blogs.java9.usingoptional;

import java.util.Optional;
import java.util.stream.Stream;

public class OptionalDemo {

    public static void main(String[] args) {
        // Java 9 style
        getPerson().stream()
                .map(Person::getName)
                .map("Java 9 "::concat)
                .forEach(System.out::println);

        getEmptyPerson().stream()
                .map(Person::getName)
                .map("Java 9 "::concat)
                .forEach(System.out::println);

        // Java 8 Style
        getPerson()
                .map(Stream::of).orElseGet(Stream::empty)
                .map(Person::getName)
                .map("Java 8 - "::concat)
                .forEach(System.out::println);
    }

    private static Optional<Person> getEmptyPerson() {
        return Optional.empty();
    }

    private static Optional<Person> getPerson() {
        return Optional.of(new Person("JITENDRA SINGH"));
    }

    static class Person {

        private String name;

        public Person(String name) {
            this.name = name;
        }

        public String getName() {
            return name;
        }

        public void setName(String name) {
            this.name = name;
        }
    }
}

Happy Coding 😀😀😀 !!! If you have any feedback please comment down below.

How Dispatcher servlet gets registered in Spring java based config

Jitendra Singh Bisht — Mon, 28 Aug 2017 04:00:00 +0000

A few days ago my colleague asks me about how Spring Dispatcher servlet gets registered in Java-based config, as there is no XML used in the configuration. One thing I was (actually we both were) sure about that the class AbstractAnnotationConfigDispatcherServletInitializer registers those servlet and all the configuration. But the question was How?

In order to understand that we will be going back to the servlet world. According to Servlet Java Doc, ServletContainerInitializer is the interface which is used to register servlets, filters and other related stuff.

So any implementation of ServletContainerInitializer will be notified of the web application’s startup phase using a callback method

public void onStartup(Set<Class<?>> c, ServletContext ctx) throws ServletException {

}

In above method, you’ll notice there is a parameter c of type Set<Class<?> >. You probably thinking about why it’s there. So here is another part of the magic, there is an annotation called @HandlesTypes used alongside ServletContainerInitializer. The annotation accepts an array of Class as an input argument.

public @interface HandlesTypes {

    Class<?>[] value();
}

So any class (and its subclasses), which is passed as an argument to that annotation (HandlesTypes) will be scanned by the container and finally, the collection of those class will be passed to ServletContainerInitializer#onStartup() during the startup time.

Now you might be thinking, how the implementation of ServletContainerInitializer gets picked by the container? So the answer to that question is:

According to the Java Docs

Implementations of this interface must be declared by a JAR file resource located inside the META-INF/services directory and named for the fully qualified class name of this interface and will be discovered using the runtime’s service provider lookup mechanism or a container-specific mechanism that is semantically equivalent to it. In either case, ServletContainerInitializer services from web-fragment JAR files excluded from an absolute ordering must be ignored, and the order in which these services are discovered must follow the application’s classloading delegation model.

Now come back to the Spring Era and check the spring-web*.jar (just extract the jar) and look for the file javax.servlet.ServletContainerInitializer. Inside that file, you’ll find a fully qualified class name as org.springframework.web.SpringServletContainerInitializer.

That’s it, you’ve solved the mystery!!

Now check the source code of that class (go to the GitHub), you’ll notice a class WebApplicationInitializer inside @HandlesTypes which is the parent class of most of the Spring’s initializers (AbstractAnnotationConfigDispatcherServletInitializer, AbstractSecurityWebApplicationInitializer).

Now you know how to create your own initializer.

Cheers!!! Happy coding.

Please share your thoughts. ☺ ☺

Spring-Session Grails Plugin (Part 3)

Jitendra Singh Bisht — Thu, 30 Mar 2017 04:00:00 +0000

Hi Folks, hope you’re doing well!

I was quite busy since my last blog post. So this post is part of Spring-Session Grails Plugin blog series which will cover JDBC as your datastore.

In this blog post, I’ll explain how you can use JDBC as your session store. To use JDBC as your datastore you need to create two tables in your database. Spring Session doesn’t use any type of ORM tool. You’ll need to create two tables one is for the session and other for session attributes and the format will be like <SESSION TABLE> and <SESSION TABLE>_ATTRIBUTES ”.

CREATE TABLE SPRING_SESSION (
  SESSION_ID CHAR(36),
  CREATION_TIME BIGINT NOT NULL,
  LAST_ACCESS_TIME BIGINT NOT NULL,
  MAX_INACTIVE_INTERVAL INT NOT NULL,
  PRINCIPAL_NAME VARCHAR(100),
  CONSTRAINT SPRING_SESSION_PK PRIMARY KEY (SESSION_ID)
);

CREATE INDEX SPRING_SESSION_IX1 ON SPRING_SESSION (LAST_ACCESS_TIME);

CREATE TABLE SPRING_SESSION_ATTRIBUTES (
 SESSION_ID CHAR(36),
 ATTRIBUTE_NAME VARCHAR(200),
 ATTRIBUTE_BYTES BYTEA,
 CONSTRAINT SPRING_SESSION_ATTRIBUTES_PK PRIMARY KEY (SESSION_ID, ATTRIBUTE_NAME),
 CONSTRAINT SPRING_SESSION_ATTRIBUTES_FK FOREIGN KEY (SESSION_ID) REFERENCES SPRING_SESSION(SESSION_ID) ON DELETE CASCADE
);

CREATE INDEX SPRING_SESSION_ATTRIBUTES_IX1 ON SPRING_SESSION_ATTRIBUTES (SESSION_ID);

To change datastore you need to add a property in your Config.groovy.

springsession.sessionStore=SessionStore.JDBC

This will set JDBC as your datastore. By default, it’ll try to connect H2 Database. Let’s check out some config properties with their default values.

Note: Some of the common properties explained in part 1. Those will work the same for JDBC datastore.

springsession.jdbc.driverClassName="org.h2.Driver" // Driver class default is H2 driver
springsession.jdbc.url="jdbc:h2:~/test" // JDBC Connection string
springsession.jdbc.username="" // JDBC username. Default is "".
springsession.jdbc.password="" // JDBC password. Default is "".
springsession.jdbc.tableName="SessionData" // table name to store sessions

springsession.jdbc.pool.maxActive=10 // Connection pool max active
springsession.jdbc.pool.maxTotal=20 // Connection pool max total
springsession.jdbc.pool.minIdle=3 // Connection pool min idle
springsession.jdbc.pool.maxWaitMillis=10000 // Connection wait time
springsession.jdbc.pool.defaultAutoCommit=true // autocommit true by default
springsession.jdbc.pool.defaultReadOnly=false // read only sessions
springsession.jdbc.pool.defaultTransactionIsolation=Connection.TRANSACTION_READ_COMMITTED // transaction isolation  
springsession.jdbc.pool.validationQuery="SELECT 1" // Validate connection query

By default, it uses Java serialization. To use JSON Serialization please visit first blog of this series. First 2 steps will be same but in 3^rd step Register my module class with spring-session plugin you will have to use JDBC specific jackson.modules property.

springsession.jdbc.jackson.modules = ['demo.SimpleModule']