Question

What is best practise in Spring when creating a new user with custom attributes…to extend org.springframework.security.core.userdetails.User or to create the User in the UserDetailsService (this is the approach taken in the IceFaces tutorial).

public UserDetails loadUserByUsername(String username)
        throws UsernameNotFoundException, DataAccessException {
    AppUser user = userDAO.findUser(username);
    if (user == null)
        throw new UsernameNotFoundException("User not found: " + username);
    else {
        return makeUser(user);
    }
}

private User makeUser(AppUser user) {
    return new User(user.getLogin(), user
            .getPassword(), true, true, true, true,
            makeGrantedAuthorities(user));
}

Answer 1

If your user permissions fit into the context of the Spring Security User class then simply writing your own UserDetails service is fine. But if your Users have other attributes that are not encapsulated in the available fields in the default Userclass then you will need to do both. There’s not really a “best practice” – both are fine options it really depends on your use case.