<commit_before>## Project Structure
The Login project sample has the following structure:

```text
- src
-- main
---- java
------ com
-------- auth0
---------- example
------------ mvc
-------------- CallbackController.java
-------------- ErrorController.java
-------------- HomeController.java
-------------- LoginController.java
-------------- LogoutController.java
------------ security
-------------- AppConfig.java
-------------- TokenAuthentication.java
------------ App.java
---- resources
------ application.properties
------ auth0.properties
---- webapp
------ WEB-INF
-------- jsp
---------- home.jsp
- build.gradle
```

The project contains a single JSP: the `home.jsp` which will display the user information associated to the token after a successful login and provide the option to logout.

The access control is handled by the Spring Security framework. A few rules in the `AppConfig.java` class will suffice to check for existing tokens before giving the user access to our protected `/portal/*` path. If the tokens don't exist, the request will be redirected by the `ErrorController` to the `LoginController`.

The project contains also five Controllers:
- `LoginController.java`: Invoked when the user attempts to login. The controller uses the `client_id` and `domain` parameters to create a valid Authorize URL and redirects the user there.
- `CallbackController.java`: The controller captures requests to our Callback URL and processes the data to obtain the credentials. After a successful login, the credentials are then saved to the request's HttpSession.
- `HomeController.java`: The controller reads the previously saved tokens and shows them on the `home.jsp` resource.
- `LogoutController.java`: Invoked when the user clicks the logout link. The controller invalidates the user session and redirects the user to the login page, handled by the `LoginController`.
- `ErrorController.java`: The controller triggers upon any non-handled exception and redirects the user to the `/login` path.

Lastly, the project defines an Authentication class to hold this status: the `TokenAuthentication.java`. This class will parse the user's *id_token* to check for expiration and also extract the "granted authorities" from a custom claim we can set. We will see more regarding authorization in a next tutorial.


## Authenticate the User

Let's begin by making your Auth0 credentials available on the App. In the `AppConfig` class we tell Spring to map the properties defined in the `auth0.properties` file to the corresponding fields by using the `@Configuration` and `@Value` annotations.

```java

@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class AppConfig extends WebSecurityConfigurerAdapter {

    @Value(value = "${com.auth0.domain}")
    private String domain;
    @Value(value = "${com.auth0.clientId}")
    private String clientId;
    @Value(value = "${com.auth0.clientSecret}")
    private String clientSecret;
<commit_msg>escape spring framework syntax<commit_after>## Project Structure
The Login project sample has the following structure:

```text
- src
-- main
---- java
------ com
-------- auth0
---------- example
------------ mvc
-------------- CallbackController.java
-------------- ErrorController.java
-------------- HomeController.java
-------------- LoginController.java
-------------- LogoutController.java
------------ security
-------------- AppConfig.java
-------------- TokenAuthentication.java
------------ App.java
---- resources
------ application.properties
------ auth0.properties
---- webapp
------ WEB-INF
-------- jsp
---------- home.jsp
- build.gradle
```

The project contains a single JSP: the `home.jsp` which will display the user information associated to the token after a successful login and provide the option to logout.

The access control is handled by the Spring Security framework. A few rules in the `AppConfig.java` class will suffice to check for existing tokens before giving the user access to our protected `/portal/*` path. If the tokens don't exist, the request will be redirected by the `ErrorController` to the `LoginController`.

The project contains also five Controllers:
- `LoginController.java`: Invoked when the user attempts to login. The controller uses the `client_id` and `domain` parameters to create a valid Authorize URL and redirects the user there.
- `CallbackController.java`: The controller captures requests to our Callback URL and processes the data to obtain the credentials. After a successful login, the credentials are then saved to the request's HttpSession.
- `HomeController.java`: The controller reads the previously saved tokens and shows them on the `home.jsp` resource.
- `LogoutController.java`: Invoked when the user clicks the logout link. The controller invalidates the user session and redirects the user to the login page, handled by the `LoginController`.
- `ErrorController.java`: The controller triggers upon any non-handled exception and redirects the user to the `/login` path.

Lastly, the project defines an Authentication class to hold this status: the `TokenAuthentication.java`. This class will parse the user's *id_token* to check for expiration and also extract the "granted authorities" from a custom claim we can set. We will see more regarding authorization in a next tutorial.


## Authenticate the User

Let's begin by making your Auth0 credentials available on the App. In the `AppConfig` class we tell Spring to map the properties defined in the `auth0.properties` file to the corresponding fields by using the `@Configuration` and `@Value` annotations.

```java

@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class AppConfig extends WebSecurityConfigurerAdapter {

    @Value(value = "<%= "${com.auth0.domain}" %>")
    private String domain;
    @Value(value = "<%= "${com.auth0.clientId}" %>")
    private String clientId;
    @Value(value = "<%= "${com.auth0.clientSecret}" %>")
    private String clientSecret;

{'fraction_non_alphanumeric': 0.1299238662694472, 'fraction_numerical': 0.0023171135385633896, 'mean_word_length': 3.385341074020319, 'pattern_counts': {'":': 0, '<': 6, '<?xml version=': 0, '>': 6, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '3437673', 'n_tokens_mistral': 1447, 'n_tokens_neox': 1400, 'n_words': 699}