title: Changing password using Spring security
body: <p>I use, </p>
  
  <ul>
  <li>Spring Framework 4.0.0 RELEASE (GA)</li>
  <li>Spring Security 3.2.0 RELEASE (GA)</li>
  <li>Struts 2.3.16</li>
  </ul>
  
  <p>in which I use,</p>
  
  <pre><code>org.springframework.security.authentication.dao.DaoAuthenticationProvider
  </code></pre>
  
  <p>for authentication. My <code>spring-security.xml</code> file looks like the following.</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;beans:beans xmlns="http://www.springframework.org/schema/security"
               xmlns:beans="http://www.springframework.org/schema/beans"
               xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
               xsi:schemaLocation="http://www.springframework.org/schema/beans
             http://www.springframework.org/schema/beans/spring-beans-4.0.xsd
             http://www.springframework.org/schema/security
             http://www.springframework.org/schema/security/spring-security-3.2.xsd"&gt;
  
      &lt;http pattern="/Login.jsp*" security="none"&gt;&lt;/http&gt;
  
      &lt;http auto-config='true' use-expressions="true" disable-url-rewriting="true" authentication-manager-ref="authenticationManager"&gt;
          &lt;session-management session-fixation-protection="newSession"&gt;
              &lt;concurrency-control max-sessions="1" error-if-maximum-exceeded="true" /&gt;
          &lt;/session-management&gt;
  
          &lt;csrf/&gt;
  
          &lt;headers&gt;
              &lt;xss-protection /&gt;
              &lt;frame-options /&gt;
              &lt;!--&lt;cache-control /&gt;--&gt;
              &lt;!--&lt;hsts /&gt;--&gt;
              &lt;content-type-options /&gt; &lt;!--content sniffing--&gt;
          &lt;/headers&gt;
  
          &lt;intercept-url pattern="/admin_side/**" access="hasRole('ROLE_ADMIN')" requires-channel="any"/&gt;
  
          &lt;form-login login-page="/admin_login/Login.action" authentication-success-handler-ref="loginSuccessHandler" authentication-failure-handler-ref="authenticationFailureHandler"/&gt;
          &lt;logout logout-success-url="/admin_login/Login.action" invalidate-session="true" delete-cookies="JSESSIONID"/&gt;
      &lt;/http&gt;
  
      &lt;beans:bean id="encoder" class="org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder"/&gt;
  
      &lt;beans:bean id="daoAuthenticationProvider" class="org.springframework.security.authentication.dao.DaoAuthenticationProvider"&gt;
          &lt;beans:property name="userDetailsService" ref="userDetailsService"/&gt;
          &lt;beans:property name="passwordEncoder" ref="encoder" /&gt;
      &lt;/beans:bean&gt;
  
      &lt;beans:bean id="authenticationManager" class="org.springframework.security.authentication.ProviderManager"&gt;
          &lt;beans:property name="providers"&gt;
              &lt;beans:list&gt;
                  &lt;beans:ref bean="daoAuthenticationProvider" /&gt;
              &lt;/beans:list&gt;
          &lt;/beans:property&gt;
      &lt;/beans:bean&gt;
  
      &lt;authentication-manager&gt;
          &lt;authentication-provider user-service-ref="userDetailsService"/&gt;            
      &lt;/authentication-manager&gt;
  
      &lt;beans:bean id="loginSuccessHandler" class="loginsuccesshandler.LoginSuccessHandler"/&gt;
      &lt;beans:bean id="authenticationFailureHandler" class="loginsuccesshandler.AuthenticationFailureHandler" /&gt;
  
      &lt;global-method-security secured-annotations="enabled" proxy-target-class="false" authentication-manager-ref="authenticationManager"&gt;
          &lt;protect-pointcut expression="execution(* admin.dao.*.*(..))" access="ROLE_ADMIN"/&gt;
      &lt;/global-method-security&gt;
  &lt;/beans:beans&gt;
  </code></pre>
  
  <p>The implementation of <code>UserDetailsService</code> is as follows.</p>
  
  <pre><code>@Service(value="userDetailsService")
  public final class UserDetailsImpl implements UserDetailsService {
  
      @Autowired
      private final transient UserService userService = null;
      @Autowired
      private final transient AssemblerService assemblerService = null;
  
      @Override
      @Transactional(readOnly = true, propagation = Propagation.REQUIRED)
      public UserDetails loadUserByUsername(String userName) throws UsernameNotFoundException {
          UserTable userTable = userService.findUserByName(userName);
  
          if (userTable == null) {
              throw new UsernameNotFoundException("User name not found.");
          } else if (!userTable.getEnabled()) {
              throw new DisabledException("The user is disabled.");
          } else if (!userTable.getVarified()) {
              throw new LockedException("The user is locked.");
          }
  
          //Password expiration and other things may also be implemented as and when required.
          return assemblerService.buildUserFromUserEntity(userTable);
      }
  }
  </code></pre>
  
  <p>And the following is just a helper service that converts a user entity which is to be used by a Spring <code>User</code> object.</p>
  
  <pre><code>@Service(value="assembler")
  @Transactional(readOnly = true, propagation=Propagation.REQUIRED)
  public final class AssemblerDAO implements AssemblerService {
  
      @Override
      public User buildUserFromUserEntity(UserTable userTable) {
          String username = userTable.getEmailId();
          String password = userTable.getPassword();
          boolean active = userTable.getEnabled();
          boolean enabled = active;
          boolean accountNonExpired = active;
          boolean credentialsNonExpired = active;
          boolean accountNonLocked = userTable.getVarified();
          Collection&lt;GrantedAuthority&gt; authorities = new ArrayList&lt;GrantedAuthority&gt;();
  
          for (UserRoles role : userTable.getUserRolesSet()) {
              authorities.add(new SimpleGrantedAuthority(role.getAuthority()));
          }
  
          return new User(username, password, enabled, accountNonExpired, credentialsNonExpired, accountNonLocked, authorities);
      }
  }
  </code></pre>
  
  <p>There is no need to refer to these classes.</p>
  
  <hr>
  
  <p>My question is that while using, </p>
  
  <pre><code>org.springframework.security.provisioning.JdbcUserDetailsManager
  </code></pre>
  
  <p><code>UserDetailsManager</code> can be injected into a controller and its </p>
  
  <pre><code>public void changePassword(String oldPassword, String newPassword) throws AuthenticationException {
      //...
  }
  </code></pre>
  
  <p>method can be used to change the password. I never tried this but it may roughly be implemented like the following.</p>
  
  <pre><code>&lt;bean id="jdbcUserService" class="org.springframework.security.provisioning.JdbcUserDetailsManager"&gt;
      &lt;property name="dataSource" ref="datasource" /&gt;
      &lt;property name="authenticationManager" ref="authenticationManager" /&gt;
  &lt;/bean&gt;
  </code></pre>
  
  <p>and in a controller, it should be injected as follows.</p>
  
  <pre><code>@Autowired
  @Qualifier("jdbcUserService")
  public UserDetailsManager userDetailsManager;
  </code></pre>
  
  <hr>
  
  <p>Is there any facility provided by Spring security in the approach I'm using or just a simple method of my own in a DAO to change the password of the current logged-in user is sufficient? Kindly suggest, if I'm doing something wrong anywhere!</p>
  
  <p><sub>This contents may be too big to answer this question but I'm asking this because it is something quite experimental.</sub></p>