Spring Security: UserDetailsService

This blog post explores the UserDetailsService, its importance in Spring Security, and how to implement it with practical examples. 

Understanding UserDetailsService 

The UserDetailsService is an interface provided by Spring Security that's used during the authentication process to obtain user details. 

DaoAuthenticationProvider uses UserDetailsService to retrieve a username, a password, and other attributes for authenticating with a username and password. Spring Security provides in-memory, JDBC, and caching implementations of UserDetailsService

The Role of UserDetailsService 

User Lookup: It abstracts the process of looking up users from the data source. 

Decoupling: Decouples the authentication process from the application's user model. 

Flexibility: Offers flexibility to work with various data sources, including databases, LDAP, etc. 

Implementing UserDetailsService in Spring Security 

Implementing the UserDetailsService involves providing a concrete implementation that loads user-specific data. This section demonstrates how to implement and configure a custom UserDetailsService to manage user authentication in a Spring application. 

Example 1: Custom UserDetailsService Implementation 

Here's a simple implementation of UserDetailsService that retrieves user details from a database.

public class CustomUserDetailsService implements UserDetailsService {

    private UserRepository userRepository;

    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        User user = userRepository.findByUsername(username);
        if (user == null) {
            throw new UsernameNotFoundException("User not found with username: " + username);
        return new org.springframework.security.core.userdetails.User(user.getUsername(), user.getPassword(), getAuthorities(user));

    private Collection<? extends GrantedAuthority> getAuthorities(User user) {
        List<GrantedAuthority> authorities = new ArrayList<>();
        // Example: Fetching user roles and converting them to GrantedAuthority
        user.getRoles().forEach(role -> {
            authorities.add(new SimpleGrantedAuthority(role.getName()));
        return authorities;

In this example, CustomUserDetailsService uses a UserRepository to fetch user information based on the username. It then constructs a Spring Security User object, which implements the UserDetails interface, encapsulating the user's username, password, and authorities.

Example 2: Configuring AuthenticationManager with UserDetailsService 

After implementing UserDetailsService, you need to configure Spring Security to use it for authentication. This is typically done in your security configuration class.
public class SecurityConfig {

    private UserDetailsService userDetailsService;

	public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
			.authorizeHttpRequests((authorize) -> authorize

		return http.build();

    public AuthenticationManager authenticationManager(AuthenticationConfiguration authenticationConfiguration) throws Exception {
        return authenticationConfiguration.getAuthenticationManager();

    public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {

    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
In this configuration, AuthenticationManagerBuilder is used to specify that our custom UserDetailsService should be used for authentication. A password encoder is also defined to ensure that passwords are securely handled. 


The UserDetailsService is a cornerstone of user management in Spring Security, providing a seamless bridge between your user data and Spring Security's authentication mechanism. By implementing a custom UserDetailsService, developers gain fine-grained control over loading user details, enabling robust and flexible authentication workflows. 

Whether your application uses a traditional relational database, a NoSQL database, or an external authentication provider, UserDetailsService offers the adaptability to meet your security requirements, ensuring that user management is secure and efficient.