title: Default admin user (Spring 3, Spring Security)
body: <p>This is a Spring Security question. </p>
  
  <p>In my application, I have a User entity as a domain object. Users will be registered and will be logging in with credentials stored in the database. My User domain object contains implementation to support Spring UserDetails object. </p>
  
  <p>The challenge is that I need an ability to log into the application even before the first user is created. In other words, I need to log in as 'admin' to create the 'admin' user.</p>
  
  <p>To make sure my Spring setup is working, I'm currently returning the hardcoded admin user from SpringSecurityUserDetailsServiceImpl.loadUserByUsername(String userName).</p>
  
  <pre><code>public UserDetails loadUserByUsername(String userName) throws UsernameNotFoundException, DataAccessException {
  
      User user=null;
      try {
          if("admin".equalsIgnoreCase(userName)) {
              user=new User();
              user.setUserName("ADMIN");
              user.setPassword("adsf"); // assume there's a hash of a true password here
              user.setStatus(UserStatus.ACTIVE);
              user.setAccessLevel(UserAccessLevel.ADMINISTRATOR);
          } else {
              //user = userDAO.getUserByUserName(userName);
  
          }
  
      } catch(Throwable t) {
          throw new UsernameNotFoundException("Unable to locate User with user name \"" + userName + "\".", t);
      }
  
      return user;
  }
  </code></pre>
  
  <p>This works, so now, I'm looking for the right way to do it. One would be to define this default admin user credentials in a properties file and read that properties file within loadUserByUsername(String userName) to construct the admn user object. However, I'm hoping there is a way to do this within the Spring Security xml configuration. I tried <code>security:user name="admin" password="admin" authorities="ADMINISTRATOR"</code> but that apparently does not work when you have <code>security:authentication-provider user-service-ref="customUserDetailsService"</code></p>
  
  <p>My spring-security.xml</p>
  
  <pre><code>&lt;security:http auto-config="true" use-expressions="true" access-denied-page="/denied"&gt;
  &lt;security:intercept-url pattern="/login.html" access="permitAll"/&gt;
  &lt;security:intercept-url pattern="/style/**" access="permitAll"/&gt;
  &lt;security:intercept-url pattern="/user**" access="hasRole('ADMINISTRATOR')"/&gt;
  &lt;security:intercept-url pattern="/**" access="hasRole('AUTHOR')"/&gt;
  
  &lt;security:form-login    login-page="/login.html"
                          login-processing-url="/j_spring_security_check" 
                          authentication-failure-url="/login.html?failedAttempt=true"
                          default-target-url="/home.html"/&gt;
  
  &lt;security:logout        invalidate-session="true"
                          logout-success-url="/login"
                          logout-url="/logout"/&gt;
                          &lt;/security:http&gt;
  
  &lt;security:authentication-manager&gt;
      &lt;security:authentication-provider user-service-ref="customUserDetailsService"&gt;       
          &lt;security:password-encoder ref="passwordEncoder"/&gt;
      &lt;/security:authentication-provider&gt;
  &lt;/security:authentication-manager&gt;
  
  &lt;bean class="org.springframework.security.authentication.encoding.Md5PasswordEncoder" id="passwordEncoder"/&gt;
  
  
  &lt;bean id="customUserDetailsService" class="com.modelsite.services.impl.SpringSecurityUserDetailsServiceImpl"/&gt;
  </code></pre>
  
  <p>So the question is: how do I define a default admin user that is able to log in and do stuff. Please note, I do not want to handle this with sql imports at set up times. </p>