3. Authentication on BeamFoundry Rays Web Security

UserDetails Interface

Mon, 01 Jan 0001 00:00:00 +0000

1. The `UserDetails` Interface

First, adapt your domain model to fulfill the framework’s UserDetails interface, located in pkg/core.

Note that the framework provides a convenient Authority string alias to easily generate GrantedAuthority slice elements.

package models

import . "github.com/BeamFoundry/rays-web-security/pkg/core"

type User struct {
 ID uint
 Email string
 PasswordHash string
 Role string
}

// Implement the UserDetails interface
func (u *User) GetUsername() string { return u.Email }
func (u *User) GetPassword() string { return u.PasswordHash }
func (u *User) GetAuthorities() []GrantedAuthority {
 return []GrantedAuthority{ Authority("ROLE_" + u.Role) }
}

// These return false when the account is active and unrestricted
func (u *User) IsExpired() bool { return false }
func (u *User) IsCredentialExpired() bool { return false }
func (u *User) IsDisabled() bool { return false }
func (u *User) IsLocked() bool { return false }

UserDetailsService

Mon, 01 Jan 0001 00:00:00 +0000

2. Implementing `UserDetailsService`

Next, create a Service that implements UserDetailsService. The framework will automatically detect this Beam and use it during the login process.

If the user cannot be found, you simply return nil, and the framework will handle the failed authentication safely.

package security

import (
 . "github.com/BeamFoundry/rays-web-security/pkg/core"
 . "github.com/BeamFoundry/rays/pkg/core"
 . "github.com/BeamFoundry/rays/pkg/lang"
)

type DomainUserDetailsService struct {
 Service
 userRepo *UserRepository `@:"Inject"`
}

func (s *DomainUserDetailsService) LoadUserByUsername(username string) UserDetails {
 userOpt := s.userRepo.FindByEmail(username)

 // Return the user if found
 if user, ok := userOpt.Get(); ok {
 return user
 }

 // Return nil if the user does not exist
 return nil
}

Password Encoding

Mon, 01 Jan 0001 00:00:00 +0000

3. Password Encoding

Never store plain-text passwords. When you boot the application, internal/autoconfig automatically registers a highly secure, upgradeable default PasswordEncoder.

The Delegating Password Encoder

To support seamless algorithm migrations over time (a best practice from Spring Security), the default encoder is a DelegatingPasswordEncoder.

It automatically wraps a BCryptPasswordEncoder (with a cost of 10) mapped to the “bcrypt” prefix. This means your hashed passwords will automatically be formatted with a prefix, looking something like this: {bcrypt}$2a$10$wN1FzZ2...

Remember Me

Mon, 01 Jan 0001 00:00:00 +0000

4. Remember Me Services

To keep users logged in across browser sessions without relying solely on long-lived session cookies, you can leverage the RememberMeService interface.

The framework provides a TokenBasedRememberMeService in pkg/rememberme. For a robust enterprise configuration, you should avoid hardcoding secrets and instead use Rays’ ConfigurationProperties to load your configuration from YAML.

Configuration Options & Defaults

The TokenBasedRememberMeService provides several fluent builder methods to customize its behavior:

Method	Default Value	Description
`WithParameter()`	“remember-me”	The HTML form input checked to determine if the cookie should be set.
`WithCookieName()`	“remember-me”	The name of the cookie sent to the browser.
`WithCookieDomain()`	""	The domain restriction for the cookie.
`WithCookieSecure()`	false	Whether the secure (HTTPS-only) bit should be set on the cookie.
`WithValidity()`	1209600 (14 days)	How long, in seconds, the cookie will be valid.

Example: Externalized Configuration

First, define your YAML configuration. We explicitly provide the default values here for reference:

3. Authentication on BeamFoundry Rays Web Security

UserDetails Interface

1. The UserDetails Interface

UserDetailsService

2. Implementing UserDetailsService

Password Encoding

3. Password Encoding

The Delegating Password Encoder

Remember Me

4. Remember Me Services

Configuration Options & Defaults

Example: Externalized Configuration

1. The `UserDetails` Interface

2. Implementing `UserDetailsService`