|
| 1 | +# 🔧 Login Issue Fix - Empty Roles in JWT Token |
| 2 | + |
| 3 | +## 🎯 Problem Summary |
| 4 | + |
| 5 | +**Symptom**: User can login successfully but gets `403 Forbidden` when accessing `/api/v1/users/me` |
| 6 | + |
| 7 | +**Root Cause**: The JWT token contains `"roles":[]` (empty array) because the user in the database has no roles assigned in the `user_roles` table. |
| 8 | + |
| 9 | +**Error in logs**: |
| 10 | +``` |
| 11 | +Access denied: Access Denied |
| 12 | +AuthorizationDeniedException: Access Denied |
| 13 | +``` |
| 14 | + |
| 15 | +## 🔍 Diagnosis |
| 16 | + |
| 17 | +Your JWT token shows: |
| 18 | +```json |
| 19 | +{ |
| 20 | + "roles": [], // <-- EMPTY! This is the problem |
| 21 | + "sub": "customer", |
| 22 | + "iat": 1762805825, |
| 23 | + "exp": 1762892225 |
| 24 | +} |
| 25 | +``` |
| 26 | + |
| 27 | +The endpoint requires: |
| 28 | +```java |
| 29 | +@PreAuthorize("hasRole('CUSTOMER') or hasRole('EMPLOYEE') or hasRole('ADMIN') or hasRole('SUPER_ADMIN')") |
| 30 | +``` |
| 31 | + |
| 32 | +Since the roles array is empty, Spring Security denies access. |
| 33 | + |
| 34 | +## ✅ Solution Options |
| 35 | + |
| 36 | +### Option 1: Fix via SQL (Immediate Fix) |
| 37 | + |
| 38 | +Connect to your database and run: |
| 39 | + |
| 40 | +```bash |
| 41 | +# Connect to MySQL/MariaDB |
| 42 | +mysql -u root -p techtorque |
| 43 | + |
| 44 | +# Or connect to PostgreSQL |
| 45 | +# psql -U postgres -d techtorque |
| 46 | +``` |
| 47 | + |
| 48 | +Then execute: |
| 49 | +```sql |
| 50 | +-- Check current user roles |
| 51 | +SELECT u.username, u.email, r.name as role_name |
| 52 | +FROM users u |
| 53 | +LEFT JOIN user_roles ur ON u.id = ur.user_id |
| 54 | +LEFT JOIN roles r ON ur.role_id = r.id |
| 55 | +WHERE u.username = 'customer'; |
| 56 | + |
| 57 | +-- Assign CUSTOMER role if missing |
| 58 | +INSERT INTO user_roles (user_id, role_id) |
| 59 | +SELECT u.id, r.id |
| 60 | +FROM users u, roles r |
| 61 | +WHERE u.username = 'customer' |
| 62 | + AND r.name = 'CUSTOMER' |
| 63 | + AND NOT EXISTS ( |
| 64 | + SELECT 1 FROM user_roles ur |
| 65 | + WHERE ur.user_id = u.id AND ur.role_id = r.id |
| 66 | + ); |
| 67 | + |
| 68 | +-- Verify fix |
| 69 | +SELECT u.username, r.name as role_name |
| 70 | +FROM users u |
| 71 | +INNER JOIN user_roles ur ON u.id = ur.user_id |
| 72 | +INNER JOIN roles r ON ur.role_id = r.id |
| 73 | +WHERE u.username = 'customer'; |
| 74 | +``` |
| 75 | + |
| 76 | +**Quick script included**: Run `Authentication/fix_user_roles.sql` |
| 77 | + |
| 78 | +### Option 2: Delete and Recreate Users (Clean Slate) |
| 79 | + |
| 80 | +If you want to start fresh: |
| 81 | + |
| 82 | +```sql |
| 83 | +-- Delete all users (roles and other tables will be preserved) |
| 84 | +DELETE FROM user_roles; |
| 85 | +DELETE FROM users; |
| 86 | + |
| 87 | +-- Restart your Authentication service to trigger DataSeeder |
| 88 | +# The DataSeeder will recreate all default users with proper roles |
| 89 | +``` |
| 90 | + |
| 91 | +Then restart the Authentication service: |
| 92 | +```bash |
| 93 | +cd Authentication/auth-service |
| 94 | +mvn spring-boot:run |
| 95 | +``` |
| 96 | + |
| 97 | +### Option 3: Use Admin Endpoint to Assign Role |
| 98 | + |
| 99 | +If you have access to an admin account with a valid token: |
| 100 | + |
| 101 | +```bash |
| 102 | +ADMIN_TOKEN="your-admin-jwt-token" |
| 103 | + |
| 104 | +curl -X POST "http://localhost:8081/users/customer/roles" \ |
| 105 | + -H "Authorization: Bearer $ADMIN_TOKEN" \ |
| 106 | + -H "Content-Type: application/json" \ |
| 107 | + -d '{ |
| 108 | + "role": "CUSTOMER", |
| 109 | + "action": "ASSIGN" |
| 110 | + }' |
| 111 | +``` |
| 112 | + |
| 113 | +## 🧪 Verify the Fix |
| 114 | + |
| 115 | +After applying the fix: |
| 116 | + |
| 117 | +### 1. Login Again |
| 118 | +```bash |
| 119 | +curl -X POST http://localhost:8081/login \ |
| 120 | + -H "Content-Type: application/json" \ |
| 121 | + -d '{ |
| 122 | + "username": "customer", |
| 123 | + "password": "cust123" |
| 124 | + }' | jq |
| 125 | +``` |
| 126 | + |
| 127 | +### 2. Check JWT Token |
| 128 | +Decode the token at https://jwt.io and verify it now shows: |
| 129 | +```json |
| 130 | +{ |
| 131 | + "roles": ["CUSTOMER"], // <-- Should have role now! |
| 132 | + "sub": "customer", |
| 133 | + ... |
| 134 | +} |
| 135 | +``` |
| 136 | + |
| 137 | +### 3. Test /users/me Endpoint |
| 138 | +```bash |
| 139 | +TOKEN="your-new-jwt-token" |
| 140 | + |
| 141 | +curl -X GET http://localhost:8081/users/me \ |
| 142 | + -H "Authorization: Bearer $TOKEN" | jq |
| 143 | +``` |
| 144 | + |
| 145 | +**Expected**: Should return `200 OK` with user profile |
| 146 | + |
| 147 | +### 4. Test via API Gateway |
| 148 | +```bash |
| 149 | +curl -X GET http://localhost:8080/api/v1/users/me \ |
| 150 | + -H "Authorization: Bearer $TOKEN" | jq |
| 151 | +``` |
| 152 | + |
| 153 | +## 🔧 Prevention - Ensure Data Seeder Works |
| 154 | + |
| 155 | +Check your `application.properties` or `application.yml`: |
| 156 | + |
| 157 | +```properties |
| 158 | +# Make sure dev profile is active for development |
| 159 | +spring.profiles.active=dev |
| 160 | + |
| 161 | +# Or set environment variable |
| 162 | +# SPRING_PROFILES_ACTIVE=dev |
| 163 | +``` |
| 164 | + |
| 165 | +The `DataSeeder` only creates test users in `dev` profile. Make sure it's active: |
| 166 | + |
| 167 | +```bash |
| 168 | +# Check if seeder ran on startup |
| 169 | +# Look for these logs when starting the service: |
| 170 | +# "Starting data seeding..." |
| 171 | +# "Created role: CUSTOMER" |
| 172 | +# "Created user: customer with role CUSTOMER" |
| 173 | +# "Data seeding completed successfully!" |
| 174 | +``` |
| 175 | + |
| 176 | +## 📊 Database Schema Reference |
| 177 | + |
| 178 | +Correct structure for user-role assignment: |
| 179 | + |
| 180 | +``` |
| 181 | +users table: |
| 182 | ++----+----------+-------------------+ |
| 183 | +| id | username | email | |
| 184 | ++----+----------+-------------------+ |
| 185 | +| 1 | customer | customer@... | |
| 186 | ++----+----------+-------------------+ |
| 187 | +
|
| 188 | +roles table: |
| 189 | ++----+----------+ |
| 190 | +| id | name | |
| 191 | ++----+----------+ |
| 192 | +| 1 | CUSTOMER | |
| 193 | ++----+----------+ |
| 194 | +
|
| 195 | +user_roles table (join table): |
| 196 | ++---------+---------+ |
| 197 | +| user_id | role_id | |
| 198 | ++---------+---------+ |
| 199 | +| 1 | 1 | <-- This row MUST exist! |
| 200 | ++---------+---------+ |
| 201 | +``` |
| 202 | + |
| 203 | +## 🚨 Common Causes |
| 204 | + |
| 205 | +1. **DataSeeder didn't run** - Not in dev profile |
| 206 | +2. **Database was reset** - Roles exist but user_roles table is empty |
| 207 | +3. **Manual user creation** - User created without assigning roles |
| 208 | +4. **Transaction rollback** - Role assignment failed during user creation |
| 209 | + |
| 210 | +## 📞 Still Having Issues? |
| 211 | + |
| 212 | +Check Authentication service logs for: |
| 213 | +``` |
| 214 | +Hibernate: select r1_0.user_id ... from user_roles r1_0 ... where r1_0.user_id=? |
| 215 | +``` |
| 216 | + |
| 217 | +If this query returns 0 rows, the user has no roles assigned. |
| 218 | + |
| 219 | +Enable debug logging in `application.properties`: |
| 220 | +```properties |
| 221 | +logging.level.com.techtorque.auth_service=DEBUG |
| 222 | +logging.level.org.hibernate.SQL=DEBUG |
| 223 | +logging.level.org.springframework.security=DEBUG |
| 224 | +``` |
| 225 | + |
| 226 | +## ✅ Summary Checklist |
| 227 | + |
| 228 | +- [ ] User exists in database |
| 229 | +- [ ] Roles exist in database (CUSTOMER, EMPLOYEE, ADMIN, SUPER_ADMIN) |
| 230 | +- [ ] User-role mapping exists in `user_roles` table |
| 231 | +- [ ] JWT token contains roles array with at least one role |
| 232 | +- [ ] Can access `/users/me` endpoint with 200 response |
| 233 | +- [ ] DataSeeder ran successfully on service startup |
| 234 | + |
| 235 | +--- |
| 236 | + |
| 237 | +**Created**: 2025-11-11 |
| 238 | +**Issue**: Empty roles in JWT causing 403 Forbidden on authenticated endpoints |
| 239 | +**Resolution**: Ensure user has roles assigned in user_roles table |
0 commit comments