moving security package and relevant files over to proprietary

proprietary/src/main/java/stirling/software/proprietary/security/CustomAuthenticationFailureHandler.java

@@ -0,0 +1,88 @@
+package stirling.software.proprietary.security;
+
+import jakarta.servlet.ServletException;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+import java.io.IOException;
+import java.util.Optional;
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.security.authentication.BadCredentialsException;
+import org.springframework.security.authentication.DisabledException;
+import org.springframework.security.authentication.InternalAuthenticationServiceException;
+import org.springframework.security.authentication.LockedException;
+import org.springframework.security.core.AuthenticationException;
+import org.springframework.security.core.userdetails.UsernameNotFoundException;
+import org.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler;
+import stirling.software.proprietary.security.model.User;
+import stirling.software.proprietary.security.service.LoginAttemptService;
+import stirling.software.proprietary.security.service.UserService;
+
+@Slf4j
+public class CustomAuthenticationFailureHandler extends SimpleUrlAuthenticationFailureHandler {
+
+    private LoginAttemptService loginAttemptService;
+
+    private UserService userService;
+
+    public CustomAuthenticationFailureHandler(
+            final LoginAttemptService loginAttemptService, UserService userService) {
+        this.loginAttemptService = loginAttemptService;
+        this.userService = userService;
+    }
+
+    @Override
+    public void onAuthenticationFailure(
+            HttpServletRequest request,
+            HttpServletResponse response,
+            AuthenticationException exception)
+            throws IOException, ServletException {
+
+        if (exception instanceof DisabledException) {
+            log.error("User is deactivated: ", exception);
+            getRedirectStrategy().sendRedirect(request, response, "/logout?userIsDisabled=true");
+            return;
+        }
+
+        String ip = request.getRemoteAddr();
+        log.error("Failed login attempt from IP: {}", ip);
+
+        if (exception instanceof LockedException) {
+            getRedirectStrategy().sendRedirect(request, response, "/login?error=locked");
+            return;
+        }
+
+        String username = request.getParameter("username");
+        Optional<User> optUser = userService.findByUsernameIgnoreCase(username);
+
+        if (username != null && optUser.isPresent() && !isDemoUser(optUser)) {
+            log.info(
+                    "Remaining attempts for user {}: {}",
+                    username,
+                    loginAttemptService.getRemainingAttempts(username));
+            loginAttemptService.loginFailed(username);
+            if (loginAttemptService.isBlocked(username) || exception instanceof LockedException) {
+                getRedirectStrategy().sendRedirect(request, response, "/login?error=locked");
+                return;
+            }
+        }
+        if (exception instanceof BadCredentialsException
+                || exception instanceof UsernameNotFoundException) {
+            getRedirectStrategy().sendRedirect(request, response, "/login?error=badCredentials");
+            return;
+        }
+        if (exception instanceof InternalAuthenticationServiceException
+                || "Password must not be null".equalsIgnoreCase(exception.getMessage())) {
+            getRedirectStrategy()
+                    .sendRedirect(request, response, "/login?error=oauth2AuthenticationError");
+            return;
+        }
+
+        super.onAuthenticationFailure(request, response, exception);
+    }
+
+    private boolean isDemoUser(Optional<User> user) {
+        return user.isPresent()
+                && user.get().getAuthorities().stream()
+                        .anyMatch(authority -> "ROLE_DEMO_USER".equals(authority.getAuthority()));
+    }
+}

proprietary/src/main/java/stirling/software/proprietary/security/CustomAuthenticationSuccessHandler.java

@@ -0,0 +1,60 @@
+package stirling.software.proprietary.security;
+
+import jakarta.servlet.ServletException;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+import jakarta.servlet.http.HttpSession;
+import java.io.IOException;
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.security.core.Authentication;
+import org.springframework.security.web.authentication.SavedRequestAwareAuthenticationSuccessHandler;
+import org.springframework.security.web.savedrequest.SavedRequest;
+import stirling.software.common.util.RequestUriUtils;
+import stirling.software.proprietary.security.service.LoginAttemptService;
+import stirling.software.proprietary.security.service.UserService;
+
+@Slf4j
+public class CustomAuthenticationSuccessHandler
+        extends SavedRequestAwareAuthenticationSuccessHandler {
+
+    private LoginAttemptService loginAttemptService;
+    private UserService userService;
+
+    public CustomAuthenticationSuccessHandler(
+            LoginAttemptService loginAttemptService, UserService userService) {
+        this.loginAttemptService = loginAttemptService;
+        this.userService = userService;
+    }
+
+    @Override
+    public void onAuthenticationSuccess(
+            HttpServletRequest request, HttpServletResponse response, Authentication authentication)
+            throws ServletException, IOException {
+
+        String userName = request.getParameter("username");
+        if (userService.isUserDisabled(userName)) {
+            getRedirectStrategy().sendRedirect(request, response, "/logout?userIsDisabled=true");
+            return;
+        }
+        loginAttemptService.loginSucceeded(userName);
+
+        // Get the saved request
+        HttpSession session = request.getSession(false);
+        SavedRequest savedRequest =
+                (session != null)
+                        ? (SavedRequest) session.getAttribute("SPRING_SECURITY_SAVED_REQUEST")
+                        : null;
+
+        if (savedRequest != null
+                && !RequestUriUtils.isStaticResource(
+                        request.getContextPath(), savedRequest.getRedirectUrl())) {
+            // Redirect to the original destination
+            super.onAuthenticationSuccess(request, response, authentication);
+        } else {
+            // Redirect to the root URL (considering context path)
+            getRedirectStrategy().sendRedirect(request, response, "/");
+        }
+
+        // super.onAuthenticationSuccess(request, response, authentication);
+    }
+}

proprietary/src/main/java/stirling/software/proprietary/security/CustomLogoutSuccessHandler.java

@@ -0,0 +1,235 @@
+package stirling.software.proprietary.security;
+
+import com.coveo.saml.SamlClient;
+import com.coveo.saml.SamlException;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+import java.io.IOException;
+import java.security.cert.X509Certificate;
+import java.security.interfaces.RSAPrivateKey;
+import java.util.ArrayList;
+import java.util.List;
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.core.io.Resource;
+import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
+import org.springframework.security.core.Authentication;
+import org.springframework.security.oauth2.client.authentication.OAuth2AuthenticationToken;
+import org.springframework.security.saml2.provider.service.authentication.Saml2Authentication;
+import org.springframework.security.web.authentication.logout.SimpleUrlLogoutSuccessHandler;
+import stirling.software.common.configuration.AppConfig;
+import stirling.software.common.model.ApplicationProperties;
+import stirling.software.common.model.ApplicationProperties.Security.OAUTH2;
+import stirling.software.common.model.ApplicationProperties.Security.SAML2;
+import stirling.software.common.model.oauth2.KeycloakProvider;
+import stirling.software.common.util.UrlUtils;
+import stirling.software.proprietary.security.saml2.CertificateUtils;
+import stirling.software.proprietary.security.saml2.CustomSaml2AuthenticatedPrincipal;
+
+@Slf4j
+@RequiredArgsConstructor
+public class CustomLogoutSuccessHandler extends SimpleUrlLogoutSuccessHandler {
+
+    public static final String LOGOUT_PATH = "/login?logout=true";
+
+    private final ApplicationProperties applicationProperties;
+    private final AppConfig appConfig;
+
+    @Override
+    public void onLogoutSuccess(
+            HttpServletRequest request, HttpServletResponse response, Authentication authentication)
+            throws IOException {
+        if (!response.isCommitted()) {
+            if (authentication != null) {
+                if (authentication instanceof Saml2Authentication samlAuthentication) {
+                    // Handle SAML2 logout redirection
+                    getRedirect_saml2(request, response, samlAuthentication);
+                } else if (authentication instanceof OAuth2AuthenticationToken oAuthToken) {
+                    // Handle OAuth2 logout redirection
+                    getRedirect_oauth2(request, response, oAuthToken);
+                } else if (authentication instanceof UsernamePasswordAuthenticationToken) {
+                    // Handle Username/Password logout
+                    getRedirectStrategy().sendRedirect(request, response, LOGOUT_PATH);
+                } else {
+                    // Handle unknown authentication types
+                    log.error(
+                            "Authentication class unknown: {}",
+                            authentication.getClass().getSimpleName());
+                    getRedirectStrategy().sendRedirect(request, response, LOGOUT_PATH);
+                }
+            } else {
+                // Redirect to login page after logout
+                String path = checkForErrors(request);
+                getRedirectStrategy().sendRedirect(request, response, path);
+            }
+        }
+    }
+
+    // Redirect for SAML2 authentication logout
+    private void getRedirect_saml2(
+            HttpServletRequest request,
+            HttpServletResponse response,
+            Saml2Authentication samlAuthentication)
+            throws IOException {
+
+        SAML2 samlConf = applicationProperties.getSecurity().getSaml2();
+        String registrationId = samlConf.getRegistrationId();
+
+        CustomSaml2AuthenticatedPrincipal principal =
+                (CustomSaml2AuthenticatedPrincipal) samlAuthentication.getPrincipal();
+
+        String nameIdValue = principal.name();
+
+        try {
+            // Read certificate from the resource
+            Resource certificateResource = samlConf.getSpCert();
+            X509Certificate certificate = CertificateUtils.readCertificate(certificateResource);
+
+            List<X509Certificate> certificates = new ArrayList<>();
+            certificates.add(certificate);
+
+            // Construct URLs required for SAML configuration
+            SamlClient samlClient = getSamlClient(registrationId, samlConf, certificates);
+
+            // Read private key for service provider
+            Resource privateKeyResource = samlConf.getPrivateKey();
+            RSAPrivateKey privateKey = CertificateUtils.readPrivateKey(privateKeyResource);
+
+            // Set service provider keys for the SamlClient
+            samlClient.setSPKeys(certificate, privateKey);
+
+            // Redirect to identity provider for logout. todo: add relay state
+            samlClient.redirectToIdentityProvider(response, null, nameIdValue);
+        } catch (Exception e) {
+            log.error(
+                    "Error retrieving logout URL from Provider {} for user {}",
+                    samlConf.getProvider(),
+                    nameIdValue,
+                    e);
+            getRedirectStrategy().sendRedirect(request, response, LOGOUT_PATH);
+        }
+    }
+
+    // Redirect for OAuth2 authentication logout
+    private void getRedirect_oauth2(
+            HttpServletRequest request,
+            HttpServletResponse response,
+            OAuth2AuthenticationToken oAuthToken)
+            throws IOException {
+        String registrationId;
+        OAUTH2 oauth = applicationProperties.getSecurity().getOauth2();
+        String path = checkForErrors(request);
+
+        String redirectUrl = UrlUtils.getOrigin(request) + "/login?" + path;
+        registrationId = oAuthToken.getAuthorizedClientRegistrationId();
+
+        // Redirect based on OAuth2 provider
+        switch (registrationId.toLowerCase()) {
+            case "keycloak" -> {
+                KeycloakProvider keycloak = oauth.getClient().getKeycloak();
+
+                boolean isKeycloak = !keycloak.getIssuer().isBlank();
+                boolean isCustomOAuth = !oauth.getIssuer().isBlank();
+
+                String logoutUrl = redirectUrl;
+
+                if (isKeycloak) {
+                    logoutUrl = keycloak.getIssuer();
+                } else if (isCustomOAuth) {
+                    logoutUrl = oauth.getIssuer();
+                }
+                if (isKeycloak || isCustomOAuth) {
+                    logoutUrl +=
+                            "/protocol/openid-connect/logout"
+                                    + "?client_id="
+                                    + oauth.getClientId()
+                                    + "&post_logout_redirect_uri="
+                                    + response.encodeRedirectURL(redirectUrl);
+                    log.info("Redirecting to Keycloak logout URL: {}", logoutUrl);
+                } else {
+                    log.info(
+                            "No redirect URL for {} available. Redirecting to default logout URL: {}",
+                            registrationId,
+                            logoutUrl);
+                }
+                response.sendRedirect(logoutUrl);
+            }
+            case "github", "google" -> {
+                log.info(
+                        "No redirect URL for {} available. Redirecting to default logout URL: {}",
+                        registrationId,
+                        redirectUrl);
+                response.sendRedirect(redirectUrl);
+            }
+            default -> {
+                log.info("Redirecting to default logout URL: {}", redirectUrl);
+                response.sendRedirect(redirectUrl);
+            }
+        }
+    }
+
+    private SamlClient getSamlClient(
+            String registrationId, SAML2 samlConf, List<X509Certificate> certificates)
+            throws SamlException {
+        String serverUrl =
+                appConfig.getBaseUrl() + ":" + appConfig.getServerPort();
+
+        String relyingPartyIdentifier =
+                serverUrl + "/saml2/service-provider-metadata/" + registrationId;
+
+        String assertionConsumerServiceUrl = serverUrl + "/login/saml2/sso/" + registrationId;
+
+        String idpSLOUrl = samlConf.getIdpSingleLogoutUrl();
+
+        String idpIssuer = samlConf.getIdpIssuer();
+
+        // Create SamlClient instance for SAML logout
+        return new SamlClient(
+                relyingPartyIdentifier,
+                assertionConsumerServiceUrl,
+                idpSLOUrl,
+                idpIssuer,
+                certificates,
+                SamlClient.SamlIdpBinding.POST);
+    }
+
+    /**
+     * Handles different error scenarios during logout. Will return a <code>String</code> containing
+     * the error request parameter.
+     *
+     * @param request the user's <code>HttpServletRequest</code> request.
+     * @return a <code>String</code> containing the error request parameter.
+     */
+    private String checkForErrors(HttpServletRequest request) {
+        String errorMessage;
+        String path = "logout=true";
+
+        if (request.getParameter("oAuth2AuthenticationErrorWeb") != null) {
+            path = "errorOAuth=userAlreadyExistsWeb";
+        } else if ((errorMessage = request.getParameter("errorOAuth")) != null) {
+            path = "errorOAuth=" + sanitizeInput(errorMessage);
+        } else if (request.getParameter("oAuth2AutoCreateDisabled") != null) {
+            path = "errorOAuth=oAuth2AutoCreateDisabled";
+        } else if (request.getParameter("oAuth2AdminBlockedUser") != null) {
+            path = "errorOAuth=oAuth2AdminBlockedUser";
+        } else if (request.getParameter("userIsDisabled") != null) {
+            path = "errorOAuth=userIsDisabled";
+        } else if ((errorMessage = request.getParameter("error")) != null) {
+            path = "errorOAuth=" + sanitizeInput(errorMessage);
+        } else if (request.getParameter("badCredentials") != null) {
+            path = "errorOAuth=badCredentials";
+        }
+
+        return path;
+    }
+
+    /**
+     * Sanitize input to avoid potential security vulnerabilities. Will return a sanitised <code>
+     * String</code>.
+     *
+     * @return a sanitised <code>String</code>
+     */
+    private String sanitizeInput(String input) {
+        return input.replaceAll("[^a-zA-Z0-9 ]", "");
+    }
+}

proprietary/src/main/java/stirling/software/proprietary/security/InitialSecuritySetup.java

@@ -0,0 +1,86 @@
+package stirling.software.proprietary.security;
+
+import jakarta.annotation.PostConstruct;
+import java.sql.SQLException;
+import java.util.UUID;
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.stereotype.Component;
+import stirling.software.common.model.ApplicationProperties;
+import stirling.software.common.model.exception.UnsupportedProviderException;
+import stirling.software.common.model.enumeration.Role;
+import stirling.software.proprietary.security.service.DatabaseServiceInterface;
+import stirling.software.proprietary.security.service.UserService;
+
+@Slf4j
+@Component
+@RequiredArgsConstructor
+public class InitialSecuritySetup {
+
+    private final UserService userService;
+
+    private final ApplicationProperties applicationProperties;
+
+    private final DatabaseServiceInterface databaseService;
+
+    @PostConstruct
+    public void init() {
+        try {
+
+            if (!userService.hasUsers()) {
+                if (databaseService.hasBackup()) {
+                    databaseService.importDatabase();
+                } else {
+                    initializeAdminUser();
+                }
+            }
+
+            userService.migrateOauth2ToSSO();
+            initializeInternalApiUser();
+        } catch (IllegalArgumentException | SQLException | UnsupportedProviderException e) {
+            log.error("Failed to initialize security setup.", e);
+            System.exit(1);
+        }
+    }
+
+    private void initializeAdminUser() throws SQLException, UnsupportedProviderException {
+        String initialUsername =
+                applicationProperties.getSecurity().getInitialLogin().getUsername();
+        String initialPassword =
+                applicationProperties.getSecurity().getInitialLogin().getPassword();
+        if (initialUsername != null
+                && !initialUsername.isEmpty()
+                && initialPassword != null
+                && !initialPassword.isEmpty()
+                && userService.findByUsernameIgnoreCase(initialUsername).isEmpty()) {
+
+            userService.saveUser(initialUsername, initialPassword, Role.ADMIN.getRoleId());
+            log.info("Admin user created: {}", initialUsername);
+        } else {
+            createDefaultAdminUser();
+        }
+    }
+
+    private void createDefaultAdminUser() throws SQLException, UnsupportedProviderException {
+        String defaultUsername = "admin";
+        String defaultPassword = "stirling";
+
+        if (userService.findByUsernameIgnoreCase(defaultUsername).isEmpty()) {
+            userService.saveUser(defaultUsername, defaultPassword, Role.ADMIN.getRoleId(), true);
+            log.info("Default admin user created: {}", defaultUsername);
+        }
+    }
+
+    private void initializeInternalApiUser()
+            throws IllegalArgumentException, SQLException, UnsupportedProviderException {
+        if (!userService.usernameExistsIgnoreCase(Role.INTERNAL_API_USER.getRoleId())) {
+            userService.saveUser(
+                    Role.INTERNAL_API_USER.getRoleId(),
+                    UUID.randomUUID().toString(),
+                    Role.INTERNAL_API_USER.getRoleId());
+            userService.addApiKeyToUser(Role.INTERNAL_API_USER.getRoleId());
+            log.info("Internal API user created: {}", Role.INTERNAL_API_USER.getRoleId());
+        }
+        userService.syncCustomApiUser(applicationProperties.getSecurity().getCustomGlobalAPIKey());
+    }
+}

proprietary/src/main/java/stirling/software/proprietary/security/RateLimitResetScheduler.java

@@ -0,0 +1,18 @@
+package stirling.software.proprietary.security;
+
+import lombok.RequiredArgsConstructor;
+import org.springframework.scheduling.annotation.Scheduled;
+import org.springframework.stereotype.Component;
+import stirling.software.proprietary.security.filter.IPRateLimitingFilter;
+
+@Component
+@RequiredArgsConstructor
+public class RateLimitResetScheduler {
+
+    private final IPRateLimitingFilter rateLimitingFilter;
+
+    @Scheduled(cron = "0 0 0 * * MON") // At 00:00 every Monday TODO: configurable
+    public void resetRateLimit() {
+        rateLimitingFilter.resetRequestCounts();
+    }
+}

proprietary/src/main/java/stirling/software/proprietary/security/configuration/DatabaseConfig.java

@@ -0,0 +1,144 @@
+package stirling.software.proprietary.security.configuration;
+
+import javax.sql.DataSource;
+import lombok.Getter;
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.beans.factory.annotation.Qualifier;
+import org.springframework.boot.autoconfigure.domain.EntityScan;
+import org.springframework.boot.jdbc.DataSourceBuilder;
+import org.springframework.boot.jdbc.DatabaseDriver;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.data.jpa.repository.config.EnableJpaRepositories;
+import stirling.software.common.configuration.InstallationPathConfig;
+import stirling.software.common.model.ApplicationProperties;
+import stirling.software.common.model.exception.UnsupportedProviderException;
+
+@Slf4j
+@Getter
+@Configuration
+@EnableJpaRepositories(basePackages = "stirling.software.proprietary.security.database.repository")
+@EntityScan({"stirling.software.proprietary.security.model"})
+public class DatabaseConfig {
+
+    public final String DATASOURCE_DEFAULT_URL;
+
+    public static final String DATASOURCE_URL_TEMPLATE = "jdbc:%s://%s:%4d/%s";
+    public static final String DEFAULT_USERNAME = "sa";
+
+    private final ApplicationProperties.Datasource datasource;
+    private final boolean runningProOrHigher;
+
+    public DatabaseConfig(
+            ApplicationProperties.Datasource datasource,
+            @Qualifier("runningProOrHigher") boolean runningProOrHigher) {
+        DATASOURCE_DEFAULT_URL =
+                "jdbc:h2:file:"
+                        + InstallationPathConfig.getConfigPath()
+                        + "stirling-pdf-DB-2.3.232;DB_CLOSE_DELAY=-1;DB_CLOSE_ON_EXIT=FALSE;MODE=PostgreSQL";
+        log.debug("Database URL: {}", DATASOURCE_DEFAULT_URL);
+        this.datasource = datasource;
+        this.runningProOrHigher = runningProOrHigher;
+    }
+
+    /**
+     * Creates the <code>DataSource</code> for the connection to the DB. If <code>useDefault</code>
+     * is set to <code>true</code>, it will use the default H2 DB. If it is set to <code>false
+     * </code>, it will use the user's custom configuration set in the settings.yml.
+     *
+     * @return a <code>DataSource</code> using the configuration settings in the settings.yml
+     * @throws UnsupportedProviderException if the type of database selected is not supported
+     */
+    @Bean
+    @Qualifier("dataSource")
+    public DataSource dataSource() throws UnsupportedProviderException {
+        DataSourceBuilder<?> dataSourceBuilder = DataSourceBuilder.create();
+
+        if (!runningProOrHigher) {
+            return useDefaultDataSource(dataSourceBuilder);
+        }
+
+        if (!datasource.isEnableCustomDatabase()) {
+            return useDefaultDataSource(dataSourceBuilder);
+        }
+
+        log.info("Using custom database configuration");
+
+        if (!datasource.getCustomDatabaseUrl().isBlank()) {
+            if (datasource.getCustomDatabaseUrl().contains("postgresql")) {
+                dataSourceBuilder.driverClassName(DatabaseDriver.POSTGRESQL.getDriverClassName());
+            }
+
+            dataSourceBuilder.url(datasource.getCustomDatabaseUrl());
+        } else {
+            dataSourceBuilder.driverClassName(getDriverClassName(datasource.getType()));
+            dataSourceBuilder.url(
+                    generateCustomDataSourceUrl(
+                            datasource.getType(),
+                            datasource.getHostName(),
+                            datasource.getPort(),
+                            datasource.getName()));
+        }
+        dataSourceBuilder.username(datasource.getUsername());
+        dataSourceBuilder.password(datasource.getPassword());
+
+        return dataSourceBuilder.build();
+    }
+
+    private DataSource useDefaultDataSource(DataSourceBuilder<?> dataSourceBuilder) {
+        log.info("Using default H2 database");
+
+        dataSourceBuilder.url(DATASOURCE_DEFAULT_URL)
+            .driverClassName(DatabaseDriver.H2.getDriverClassName())
+            .username(DEFAULT_USERNAME);
+
+        return dataSourceBuilder.build();
+    }
+
+    /**
+     * Generate the URL the <code>DataSource</code> will use to connect to the database
+     *
+     * @param dataSourceType the type of the database
+     * @param hostname the host name
+     * @param port the port number to use for the database
+     * @param dataSourceName the name the database to connect to
+     * @return the <code>DataSource</code> URL
+     */
+    private String generateCustomDataSourceUrl(
+            String dataSourceType, String hostname, Integer port, String dataSourceName) {
+        return DATASOURCE_URL_TEMPLATE.formatted(dataSourceType, hostname, port, dataSourceName);
+    }
+
+    /**
+     * Selects the database driver based on the type of database chosen.
+     *
+     * @param driverName the type of the driver (e.g. 'h2', 'postgresql')
+     * @return the fully qualified driver for the database chosen
+     * @throws UnsupportedProviderException when an unsupported database is selected
+     */
+    private String getDriverClassName(String driverName) throws UnsupportedProviderException {
+        try {
+            ApplicationProperties.Driver driver =
+                    ApplicationProperties.Driver.valueOf(driverName.toUpperCase());
+
+            switch (driver) {
+                case H2 -> {
+                    log.debug("H2 driver selected");
+                    return DatabaseDriver.H2.getDriverClassName();
+                }
+                case POSTGRESQL -> {
+                    log.debug("Postgres driver selected");
+                    return DatabaseDriver.POSTGRESQL.getDriverClassName();
+                }
+                default -> {
+                    log.warn("{} driver selected", driverName);
+                    throw new UnsupportedProviderException(
+                            driverName + " is not currently supported");
+                }
+            }
+        } catch (IllegalArgumentException e) {
+            log.warn("Unknown driver: {}", driverName);
+            throw new UnsupportedProviderException(driverName + " is not currently supported");
+        }
+    }
+}

proprietary/src/main/java/stirling/software/proprietary/security/configuration/MailConfig.java

@@ -0,0 +1,53 @@
+package stirling.software.proprietary.security.configuration;
+
+import java.util.Properties;
+
+import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.mail.javamail.JavaMailSender;
+import org.springframework.mail.javamail.JavaMailSenderImpl;
+
+import lombok.AllArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+import stirling.software.common.model.ApplicationProperties;
+
+/**
+ * This configuration class provides the JavaMailSender bean, which is used to send emails. It reads
+ * email server settings from the configuration (ApplicationProperties) and configures the mail
+ * client (JavaMailSender).
+ */
+@Configuration
+@Slf4j
+@AllArgsConstructor
+@ConditionalOnProperty(value = "mail.enabled", havingValue = "true", matchIfMissing = false)
+public class MailConfig {
+
+    private final ApplicationProperties applicationProperties;
+
+    @Bean
+    public JavaMailSender javaMailSender() {
+
+        ApplicationProperties.Mail mailProperties = applicationProperties.getMail();
+
+        // Creates a new instance of JavaMailSenderImpl, which is a Spring implementation
+        JavaMailSenderImpl mailSender = new JavaMailSenderImpl();
+        mailSender.setHost(mailProperties.getHost());
+        mailSender.setPort(mailProperties.getPort());
+        mailSender.setUsername(mailProperties.getUsername());
+        mailSender.setPassword(mailProperties.getPassword());
+        mailSender.setDefaultEncoding("UTF-8");
+
+        // Retrieves the JavaMail properties to configure additional SMTP parameters
+        Properties props = mailSender.getJavaMailProperties();
+
+        // Enables SMTP authentication
+        props.put("mail.smtp.auth", "true");
+
+        // Enables STARTTLS to encrypt the connection if supported by the SMTP server
+        props.put("mail.smtp.starttls.enable", "true");
+
+        // Returns the configured mail sender, ready to send emails
+        return mailSender;
+    }
+}

proprietary/src/main/java/stirling/software/proprietary/security/configuration/SecurityConfiguration.java

@@ -0,0 +1,320 @@
+package stirling.software.proprietary.security.configuration;
+
+import java.util.Optional;
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.beans.factory.annotation.Qualifier;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.context.annotation.DependsOn;
+import org.springframework.context.annotation.Lazy;
+import org.springframework.security.authentication.ProviderManager;
+import org.springframework.security.authentication.dao.DaoAuthenticationProvider;
+import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity;
+import org.springframework.security.config.annotation.web.builders.HttpSecurity;
+import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
+import org.springframework.security.config.http.SessionCreationPolicy;
+import org.springframework.security.core.authority.mapping.GrantedAuthoritiesMapper;
+import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
+import org.springframework.security.crypto.password.PasswordEncoder;
+import org.springframework.security.saml2.provider.service.authentication.OpenSaml4AuthenticationProvider;
+import org.springframework.security.saml2.provider.service.registration.RelyingPartyRegistrationRepository;
+import org.springframework.security.saml2.provider.service.web.authentication.OpenSaml4AuthenticationRequestResolver;
+import org.springframework.security.web.SecurityFilterChain;
+import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
+import org.springframework.security.web.authentication.rememberme.PersistentTokenRepository;
+import org.springframework.security.web.csrf.CookieCsrfTokenRepository;
+import org.springframework.security.web.csrf.CsrfTokenRequestAttributeHandler;
+import org.springframework.security.web.savedrequest.NullRequestCache;
+import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
+import stirling.software.common.configuration.AppConfig;
+import stirling.software.common.model.ApplicationProperties;
+import stirling.software.proprietary.security.CustomAuthenticationFailureHandler;
+import stirling.software.proprietary.security.CustomAuthenticationSuccessHandler;
+import stirling.software.proprietary.security.CustomLogoutSuccessHandler;
+import stirling.software.proprietary.security.database.repository.JPATokenRepositoryImpl;
+import stirling.software.proprietary.security.database.repository.PersistentLoginRepository;
+import stirling.software.proprietary.security.filter.FirstLoginFilter;
+import stirling.software.proprietary.security.filter.IPRateLimitingFilter;
+import stirling.software.proprietary.security.filter.UserAuthenticationFilter;
+import stirling.software.proprietary.security.model.User;
+import stirling.software.proprietary.security.oauth2.CustomOAuth2AuthenticationFailureHandler;
+import stirling.software.proprietary.security.oauth2.CustomOAuth2AuthenticationSuccessHandler;
+import stirling.software.proprietary.security.saml2.CustomSaml2AuthenticationFailureHandler;
+import stirling.software.proprietary.security.saml2.CustomSaml2AuthenticationSuccessHandler;
+import stirling.software.proprietary.security.saml2.CustomSaml2ResponseAuthenticationConverter;
+import stirling.software.proprietary.security.service.CustomOAuth2UserService;
+import stirling.software.proprietary.security.service.CustomUserDetailsService;
+import stirling.software.proprietary.security.service.LoginAttemptService;
+import stirling.software.proprietary.security.service.UserService;
+import stirling.software.proprietary.security.session.SessionPersistentRegistry;
+
+@Slf4j
+@Configuration
+@EnableWebSecurity
+@EnableMethodSecurity
+@DependsOn("runningProOrHigher")
+public class SecurityConfiguration {
+
+    private final CustomUserDetailsService userDetailsService;
+    private final UserService userService;
+    private final boolean loginEnabledValue;
+    private final boolean runningProOrHigher;
+
+    private final ApplicationProperties applicationProperties;
+    private final AppConfig appConfig;
+    private final UserAuthenticationFilter userAuthenticationFilter;
+    private final LoginAttemptService loginAttemptService;
+    private final FirstLoginFilter firstLoginFilter;
+    private final SessionPersistentRegistry sessionRegistry;
+    private final PersistentLoginRepository persistentLoginRepository;
+    private final GrantedAuthoritiesMapper oAuth2userAuthoritiesMapper;
+    private final RelyingPartyRegistrationRepository saml2RelyingPartyRegistrations;
+    private final OpenSaml4AuthenticationRequestResolver saml2AuthenticationRequestResolver;
+
+    public SecurityConfiguration(
+        PersistentLoginRepository persistentLoginRepository,
+        CustomUserDetailsService userDetailsService,
+        @Lazy UserService userService,
+        @Qualifier("loginEnabled") boolean loginEnabledValue,
+        @Qualifier("runningProOrHigher") boolean runningProOrHigher,
+        AppConfig appConfig,
+        ApplicationProperties applicationProperties,
+        UserAuthenticationFilter userAuthenticationFilter,
+        LoginAttemptService loginAttemptService,
+        FirstLoginFilter firstLoginFilter,
+        SessionPersistentRegistry sessionRegistry,
+        @Autowired(required = false) GrantedAuthoritiesMapper oAuth2userAuthoritiesMapper,
+        @Autowired(required = false)
+        RelyingPartyRegistrationRepository saml2RelyingPartyRegistrations,
+        @Autowired(required = false)
+        OpenSaml4AuthenticationRequestResolver saml2AuthenticationRequestResolver) {
+        this.userDetailsService = userDetailsService;
+        this.userService = userService;
+        this.loginEnabledValue = loginEnabledValue;
+        this.runningProOrHigher = runningProOrHigher;
+        this.appConfig = appConfig;
+        this.applicationProperties = applicationProperties;
+        this.userAuthenticationFilter = userAuthenticationFilter;
+        this.loginAttemptService = loginAttemptService;
+        this.firstLoginFilter = firstLoginFilter;
+        this.sessionRegistry = sessionRegistry;
+        this.persistentLoginRepository = persistentLoginRepository;
+        this.oAuth2userAuthoritiesMapper = oAuth2userAuthoritiesMapper;
+        this.saml2RelyingPartyRegistrations = saml2RelyingPartyRegistrations;
+        this.saml2AuthenticationRequestResolver = saml2AuthenticationRequestResolver;
+    }
+
+    @Bean
+    public PasswordEncoder passwordEncoder() {
+        return new BCryptPasswordEncoder();
+    }
+
+    @Bean
+    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
+        if (applicationProperties.getSecurity().getCsrfDisabled() || !loginEnabledValue) {
+            http.csrf(csrf -> csrf.disable());
+        }
+
+        if (loginEnabledValue) {
+            http.addFilterBefore(
+                userAuthenticationFilter, UsernamePasswordAuthenticationFilter.class);
+            if (!applicationProperties.getSecurity().getCsrfDisabled()) {
+                CookieCsrfTokenRepository cookieRepo =
+                    CookieCsrfTokenRepository.withHttpOnlyFalse();
+                CsrfTokenRequestAttributeHandler requestHandler =
+                    new CsrfTokenRequestAttributeHandler();
+                requestHandler.setCsrfRequestAttributeName(null);
+                http.csrf(
+                    csrf ->
+                        csrf.ignoringRequestMatchers(
+                                request -> {
+                                    String apiKey = request.getHeader("X-API-KEY");
+                                    // If there's no API key, don't ignore CSRF
+                                    // (return false)
+                                    if (apiKey == null || apiKey.trim().isEmpty()) {
+                                        return false;
+                                    }
+                                    // Validate API key using existing UserService
+                                    try {
+                                        Optional<User> user =
+                                            userService.getUserByApiKey(apiKey);
+                                        // If API key is valid, ignore CSRF (return
+                                        // true)
+                                        // If API key is invalid, don't ignore CSRF
+                                        // (return false)
+                                        return user.isPresent();
+                                    } catch (Exception e) {
+                                        // If there's any error validating the API
+                                        // key, don't ignore CSRF
+                                        return false;
+                                    }
+                                })
+                            .csrfTokenRepository(cookieRepo)
+                            .csrfTokenRequestHandler(requestHandler));
+            }
+            http.addFilterBefore(rateLimitingFilter(), UsernamePasswordAuthenticationFilter.class);
+            http.addFilterAfter(firstLoginFilter, UsernamePasswordAuthenticationFilter.class);
+            http.sessionManagement(
+                sessionManagement ->
+                    sessionManagement
+                        .sessionCreationPolicy(SessionCreationPolicy.IF_REQUIRED)
+                        .maximumSessions(10)
+                        .maxSessionsPreventsLogin(false)
+                        .sessionRegistry(sessionRegistry)
+                        .expiredUrl("/login?logout=true"));
+            http.authenticationProvider(daoAuthenticationProvider());
+            http.requestCache(requestCache -> requestCache.requestCache(new NullRequestCache()));
+            http.logout(
+                logout ->
+                    logout.logoutRequestMatcher(new AntPathRequestMatcher("/logout"))
+                        .logoutSuccessHandler(
+                            new CustomLogoutSuccessHandler(applicationProperties, appConfig))
+                        .clearAuthentication(true)
+                        .invalidateHttpSession(true)
+                        .deleteCookies("JSESSIONID", "remember-me"));
+            http.rememberMe(
+                rememberMeConfigurer -> // Use the configurator directly
+                    rememberMeConfigurer
+                        .tokenRepository(persistentTokenRepository())
+                        .tokenValiditySeconds( // 14 days
+                            14 * 24 * 60 * 60)
+                        .userDetailsService( // Your existing UserDetailsService
+                            userDetailsService)
+                        .useSecureCookie( // Enable secure cookie
+                            true)
+                        .rememberMeParameter( // Form parameter name
+                            "remember-me")
+                        .rememberMeCookieName( // Cookie name
+                            "remember-me")
+                        .alwaysRemember(false));
+            http.authorizeHttpRequests(
+                authz ->
+                    authz.requestMatchers(
+                            req -> {
+                                String uri = req.getRequestURI();
+                                String contextPath = req.getContextPath();
+                                // Remove the context path from the URI
+                                String trimmedUri =
+                                    uri.startsWith(contextPath)
+                                        ? uri.substring(
+                                        contextPath.length())
+                                        : uri;
+                                return trimmedUri.startsWith("/login")
+                                    || trimmedUri.startsWith("/oauth")
+                                    || trimmedUri.startsWith("/saml2")
+                                    || trimmedUri.endsWith(".svg")
+                                    || trimmedUri.startsWith("/register")
+                                    || trimmedUri.startsWith("/error")
+                                    || trimmedUri.startsWith("/images/")
+                                    || trimmedUri.startsWith("/public/")
+                                    || trimmedUri.startsWith("/css/")
+                                    || trimmedUri.startsWith("/fonts/")
+                                    || trimmedUri.startsWith("/js/")
+                                    || trimmedUri.startsWith(
+                                    "/api/v1/info/status");
+                            })
+                        .permitAll()
+                        .anyRequest()
+                        .authenticated());
+            // Handle User/Password Logins
+            if (applicationProperties.getSecurity().isUserPass()) {
+                http.formLogin(
+                    formLogin ->
+                        formLogin
+                            .loginPage("/login")
+                            .successHandler(
+                                new CustomAuthenticationSuccessHandler(
+                                    loginAttemptService, userService))
+                            .failureHandler(
+                                new CustomAuthenticationFailureHandler(
+                                    loginAttemptService, userService))
+                            .defaultSuccessUrl("/")
+                            .permitAll());
+            }
+            // Handle OAUTH2 Logins
+            if (applicationProperties.getSecurity().isOauth2Active()) {
+                http.oauth2Login(
+                    oauth2 ->
+                        oauth2.loginPage("/oauth2")
+                            /*
+                            This Custom handler is used to check if the OAUTH2 user trying to log in, already exists in the database.
+                            If user exists, login proceeds as usual. If user does not exist, then it is auto-created but only if 'OAUTH2AutoCreateUser'
+                            is set as true, else login fails with an error message advising the same.
+                             */
+                            .successHandler(
+                                new CustomOAuth2AuthenticationSuccessHandler(
+                                    loginAttemptService,
+                                    applicationProperties,
+                                    userService))
+                            .failureHandler(
+                                new CustomOAuth2AuthenticationFailureHandler())
+                            . // Add existing Authorities from the database
+                            userInfoEndpoint(
+                            userInfoEndpoint ->
+                                userInfoEndpoint
+                                    .oidcUserService(
+                                        new CustomOAuth2UserService(
+                                            applicationProperties,
+                                            userService,
+                                            loginAttemptService))
+                                    .userAuthoritiesMapper(
+                                        oAuth2userAuthoritiesMapper))
+                            .permitAll());
+            }
+            // Handle SAML
+            if (applicationProperties.getSecurity().isSaml2Active() && runningProOrHigher) {
+                // Configure the authentication provider
+                OpenSaml4AuthenticationProvider authenticationProvider =
+                    new OpenSaml4AuthenticationProvider();
+                authenticationProvider.setResponseAuthenticationConverter(
+                    new CustomSaml2ResponseAuthenticationConverter(userService));
+                http.authenticationProvider(authenticationProvider)
+                    .saml2Login(
+                        saml2 -> {
+                            try {
+                                saml2.loginPage("/saml2")
+                                    .relyingPartyRegistrationRepository(
+                                        saml2RelyingPartyRegistrations)
+                                    .authenticationManager(
+                                        new ProviderManager(authenticationProvider))
+                                    .successHandler(
+                                        new CustomSaml2AuthenticationSuccessHandler(
+                                            loginAttemptService,
+                                            applicationProperties,
+                                            userService))
+                                    .failureHandler(
+                                        new CustomSaml2AuthenticationFailureHandler())
+                                    .authenticationRequestResolver(
+                                        saml2AuthenticationRequestResolver);
+                            } catch (Exception e) {
+                                log.error("Error configuring SAML 2 login", e);
+                                throw new RuntimeException(e);
+                            }
+                        });
+            }
+        } else {
+            log.debug("Login is not enabled.");
+            http.authorizeHttpRequests(authz -> authz.anyRequest().permitAll());
+        }
+        return http.build();
+    }
+
+    public DaoAuthenticationProvider daoAuthenticationProvider() {
+        DaoAuthenticationProvider provider = new DaoAuthenticationProvider(userDetailsService);
+        provider.setPasswordEncoder(passwordEncoder());
+        return provider;
+    }
+
+    @Bean
+    public IPRateLimitingFilter rateLimitingFilter() {
+        // Example limit TODO add config level
+        int maxRequestsPerIp = 1000000;
+        return new IPRateLimitingFilter(maxRequestsPerIp, maxRequestsPerIp);
+    }
+
+    @Bean
+    public PersistentTokenRepository persistentTokenRepository() {
+        return new JPATokenRepositoryImpl(persistentLoginRepository);
+    }
+}

proprietary/src/main/java/stirling/software/proprietary/security/controller/api/DatabaseController.java

@@ -0,0 +1,165 @@
+package stirling.software.proprietary.security.controller.api;
+
+import java.io.IOException;
+import java.io.InputStream;
+import java.net.URI;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.nio.file.StandardCopyOption;
+
+import org.eclipse.jetty.http.HttpStatus;
+import org.springframework.context.annotation.Conditional;
+import org.springframework.core.io.InputStreamResource;
+import org.springframework.http.HttpHeaders;
+import org.springframework.http.MediaType;
+import org.springframework.http.ResponseEntity;
+import org.springframework.security.access.prepost.PreAuthorize;
+import org.springframework.stereotype.Controller;
+import org.springframework.web.bind.annotation.*;
+import org.springframework.web.multipart.MultipartFile;
+import org.springframework.web.servlet.mvc.support.RedirectAttributes;
+
+import io.swagger.v3.oas.annotations.Hidden;
+import io.swagger.v3.oas.annotations.Operation;
+import io.swagger.v3.oas.annotations.Parameter;
+import io.swagger.v3.oas.annotations.tags.Tag;
+
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+import stirling.software.proprietary.security.database.H2SQLCondition;
+import stirling.software.proprietary.security.service.DatabaseService;
+
+@Slf4j
+@Controller
+@RequestMapping("/api/v1/database")
+@PreAuthorize("hasRole('ROLE_ADMIN')")
+@Conditional(H2SQLCondition.class)
+@Tag(name = "Database", description = "Database APIs for backup, import, and management")
+@RequiredArgsConstructor
+public class DatabaseController {
+
+    private final DatabaseService databaseService;
+
+    @Operation(
+            summary = "Import a database backup file",
+            description = "Uploads and imports a database backup SQL file.")
+    @PostMapping(consumes = "multipart/form-data", value = "import-database")
+    public String importDatabase(
+            @Parameter(description = "SQL file to import", required = true)
+                    @RequestParam("fileInput")
+                    MultipartFile file,
+            RedirectAttributes redirectAttributes)
+            throws IOException {
+        if (file == null || file.isEmpty()) {
+            redirectAttributes.addAttribute("error", "fileNullOrEmpty");
+            return "redirect:/database";
+        }
+        log.info("Received file: {}", file.getOriginalFilename());
+        Path tempTemplatePath = Files.createTempFile("backup_", ".sql");
+        try (InputStream in = file.getInputStream()) {
+            Files.copy(in, tempTemplatePath, StandardCopyOption.REPLACE_EXISTING);
+            boolean importSuccess = databaseService.importDatabaseFromUI(tempTemplatePath);
+            if (importSuccess) {
+                redirectAttributes.addAttribute("infoMessage", "importIntoDatabaseSuccessed");
+            } else {
+                redirectAttributes.addAttribute("error", "failedImportFile");
+            }
+        } catch (Exception e) {
+            log.error("Error importing database: {}", e.getMessage());
+            redirectAttributes.addAttribute("error", "failedImportFile");
+        }
+        return "redirect:/database";
+    }
+
+    @Hidden
+    @Operation(
+            summary = "Import database backup by filename",
+            description = "Imports a database backup file from the server using its file name.")
+    @GetMapping("/import-database-file/{fileName}")
+    public String importDatabaseFromBackupUI(
+            @Parameter(description = "Name of the file to import", required = true) @PathVariable
+                    String fileName) {
+        if (fileName == null || fileName.isEmpty()) {
+            return "redirect:/database?error=fileNullOrEmpty";
+        }
+        // Check if the file exists in the backup list
+        boolean fileExists =
+                databaseService.getBackupList().stream()
+                        .anyMatch(backup -> backup.getFileName().equals(fileName));
+        if (!fileExists) {
+            log.error("File {} not found in backup list", fileName);
+            return "redirect:/database?error=fileNotFound";
+        }
+        log.info("Received file: {}", fileName);
+        if (databaseService.importDatabaseFromUI(fileName)) {
+            log.info("File {} imported to database", fileName);
+            return "redirect:/database?infoMessage=importIntoDatabaseSuccessed";
+        }
+        return "redirect:/database?error=failedImportFile";
+    }
+
+    @Hidden
+    @Operation(
+            summary = "Delete a database backup file",
+            description = "Deletes a specified database backup file from the server.")
+    @GetMapping("/delete/{fileName}")
+    public String deleteFile(
+            @Parameter(description = "Name of the file to delete", required = true) @PathVariable
+                    String fileName) {
+        if (fileName == null || fileName.isEmpty()) {
+            throw new IllegalArgumentException("File must not be null or empty");
+        }
+        try {
+            if (databaseService.deleteBackupFile(fileName)) {
+                log.info("Deleted file: {}", fileName);
+            } else {
+                log.error("Failed to delete file: {}", fileName);
+                return "redirect:/database?error=failedToDeleteFile";
+            }
+        } catch (IOException e) {
+            log.error("Error deleting file: {}", e.getMessage());
+            return "redirect:/database?error=" + e.getMessage();
+        }
+        return "redirect:/database";
+    }
+
+    @Hidden
+    @Operation(
+            summary = "Download a database backup file",
+            description = "Downloads the specified database backup file from the server.")
+    @GetMapping("/download/{fileName}")
+    public ResponseEntity<?> downloadFile(
+            @Parameter(description = "Name of the file to download", required = true) @PathVariable
+                    String fileName) {
+        if (fileName == null || fileName.isEmpty()) {
+            throw new IllegalArgumentException("File must not be null or empty");
+        }
+        try {
+            Path filePath = databaseService.getBackupFilePath(fileName);
+            InputStreamResource resource = new InputStreamResource(Files.newInputStream(filePath));
+            return ResponseEntity.ok()
+                    .header(HttpHeaders.CONTENT_DISPOSITION, "attachment;filename=" + fileName)
+                    .contentType(MediaType.APPLICATION_OCTET_STREAM)
+                    .contentLength(Files.size(filePath))
+                    .body(resource);
+        } catch (IOException e) {
+            log.error("Error downloading file: {}", e.getMessage());
+            return ResponseEntity.status(HttpStatus.SEE_OTHER_303)
+                    .location(URI.create("/database?error=downloadFailed"))
+                    .build();
+        }
+    }
+
+    @Operation(
+            summary = "Create a database backup",
+            description =
+                    "This endpoint triggers the creation of a database backup and redirects to the"
+                            + " database management page.")
+    @GetMapping("/createDatabaseBackup")
+    public String createDatabaseBackup() {
+        log.info("Starting database backup creation...");
+        databaseService.exportDatabase();
+        log.info("Database backup successfully created.");
+        return "redirect:/database?infoMessage=backupCreated";
+    }
+}

proprietary/src/main/java/stirling/software/proprietary/security/controller/api/EmailController.java

@@ -0,0 +1,70 @@
+package stirling.software.proprietary.security.controller.api;
+
+import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
+import org.springframework.http.HttpStatus;
+import org.springframework.http.ResponseEntity;
+import org.springframework.mail.MailSendException;
+import org.springframework.web.bind.annotation.ModelAttribute;
+import org.springframework.web.bind.annotation.PostMapping;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
+import io.swagger.v3.oas.annotations.Operation;
+import io.swagger.v3.oas.annotations.tags.Tag;
+
+import jakarta.mail.MessagingException;
+import jakarta.validation.Valid;
+
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+
+import stirling.software.proprietary.security.model.api.Email;
+import stirling.software.proprietary.security.service.EmailService;
+
+/**
+ * Controller for handling email-related API requests. This controller exposes an endpoint for
+ * sending emails with attachments.
+ */
+@RestController
+@RequestMapping("/api/v1/general")
+@RequiredArgsConstructor
+@Slf4j
+@Tag(name = "General", description = "General APIs")
+@ConditionalOnProperty(value = "mail.enabled", havingValue = "true", matchIfMissing = false)
+public class EmailController {
+    private final EmailService emailService;
+
+    /**
+     * Endpoint to send an email with an attachment. This method consumes a multipart/form-data
+     * request containing the email details and attachment.
+     *
+     * @param email The Email object containing recipient address, subject, body, and file
+     *     attachment.
+     * @return ResponseEntity with success or error message.
+     */
+    @PostMapping(consumes = "multipart/form-data", value = "/send-email")
+    @Operation(
+            summary = "Send an email with an attachment",
+            description =
+                    "This endpoint sends an email with an attachment. Input:PDF"
+                            + " Output:Success/Failure Type:MISO")
+    public ResponseEntity<String> sendEmailWithAttachment(@Valid @ModelAttribute Email email) {
+        log.info("Sending email to: {}", email.toString());
+        try {
+            // Calls the service to send the email with attachment
+            emailService.sendEmailWithAttachment(email);
+            return ResponseEntity.ok("Email sent successfully");
+        } catch (MailSendException ex) {
+            // handles your "Invalid Addresses" case
+            String errorMsg = ex.getMessage();
+            log.error("MailSendException: {}", errorMsg, ex);
+            return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR).body(errorMsg);
+        } catch (MessagingException e) {
+            // Catches any messaging exception (e.g., invalid email address, SMTP server issues)
+            String errorMsg = "Failed to send email: " + e.getMessage();
+            log.error(errorMsg, e); // Logging the detailed error
+            // Returns an error response with status 500 (Internal Server Error)
+            return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR).body(errorMsg);
+        }
+    }
+}

proprietary/src/main/java/stirling/software/proprietary/security/controller/api/UserController.java

@@ -0,0 +1,389 @@
+package stirling.software.proprietary.security.controller.api;
+
+import java.io.IOException;
+import java.security.Principal;
+import java.sql.SQLException;
+import java.util.List;
+import java.util.Map;
+import java.util.Optional;
+
+import org.springframework.http.HttpStatus;
+import org.springframework.http.ResponseEntity;
+import org.springframework.security.access.prepost.PreAuthorize;
+import org.springframework.security.core.Authentication;
+import org.springframework.security.core.session.SessionInformation;
+import org.springframework.security.core.userdetails.UserDetails;
+import org.springframework.security.oauth2.core.user.OAuth2User;
+import org.springframework.security.web.authentication.logout.SecurityContextLogoutHandler;
+import org.springframework.stereotype.Controller;
+import org.springframework.ui.Model;
+import org.springframework.web.bind.annotation.*;
+import org.springframework.web.servlet.mvc.support.RedirectAttributes;
+import org.springframework.web.servlet.view.RedirectView;
+
+import io.swagger.v3.oas.annotations.tags.Tag;
+
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+
+import stirling.software.proprietary.security.model.AuthenticationType;
+import stirling.software.common.model.enumeration.Role;
+import stirling.software.proprietary.security.model.User;
+import stirling.software.common.model.ApplicationProperties;
+import stirling.software.common.model.exception.UnsupportedProviderException;
+import stirling.software.proprietary.security.model.api.user.UsernameAndPass;
+import stirling.software.proprietary.security.saml2.CustomSaml2AuthenticatedPrincipal;
+import stirling.software.proprietary.security.service.UserService;
+import stirling.software.proprietary.security.session.SessionPersistentRegistry;
+
+@Controller
+@Tag(name = "User", description = "User APIs")
+@RequestMapping("/api/v1/user")
+@Slf4j
+@RequiredArgsConstructor
+public class UserController {
+
+    private static final String LOGIN_MESSAGETYPE_CREDSUPDATED = "/login?messageType=credsUpdated";
+    private final UserService userService;
+    private final SessionPersistentRegistry sessionRegistry;
+    private final ApplicationProperties applicationProperties;
+
+    @PreAuthorize("!hasAuthority('ROLE_DEMO_USER')")
+    @PostMapping("/register")
+    public String register(@ModelAttribute UsernameAndPass requestModel, Model model)
+            throws SQLException, UnsupportedProviderException {
+        if (userService.usernameExistsIgnoreCase(requestModel.getUsername())) {
+            model.addAttribute("error", "Username already exists");
+            return "register";
+        }
+        try {
+            userService.saveUser(requestModel.getUsername(), requestModel.getPassword());
+        } catch (IllegalArgumentException e) {
+            return "redirect:/login?messageType=invalidUsername";
+        }
+        return "redirect:/login?registered=true";
+    }
+
+    @PreAuthorize("!hasAuthority('ROLE_DEMO_USER')")
+    @PostMapping("/change-username")
+    public RedirectView changeUsername(
+            Principal principal,
+            @RequestParam(name = "currentPasswordChangeUsername") String currentPassword,
+            @RequestParam(name = "newUsername") String newUsername,
+            HttpServletRequest request,
+            HttpServletResponse response,
+            RedirectAttributes redirectAttributes)
+            throws IOException, SQLException, UnsupportedProviderException {
+        if (!userService.isUsernameValid(newUsername)) {
+            return new RedirectView("/account?messageType=invalidUsername", true);
+        }
+        if (principal == null) {
+            return new RedirectView("/account?messageType=notAuthenticated", true);
+        }
+        // The username MUST be unique when renaming
+        Optional<User> userOpt = userService.findByUsername(principal.getName());
+        if (userOpt == null || userOpt.isEmpty()) {
+            return new RedirectView("/account?messageType=userNotFound", true);
+        }
+        User user = userOpt.get();
+        if (user.getUsername().equals(newUsername)) {
+            return new RedirectView("/account?messageType=usernameExists", true);
+        }
+        if (!userService.isPasswordCorrect(user, currentPassword)) {
+            return new RedirectView("/account?messageType=incorrectPassword", true);
+        }
+        if (!user.getUsername().equals(newUsername) && userService.usernameExists(newUsername)) {
+            return new RedirectView("/account?messageType=usernameExists", true);
+        }
+        if (newUsername != null && newUsername.length() > 0) {
+            try {
+                userService.changeUsername(user, newUsername);
+            } catch (IllegalArgumentException e) {
+                return new RedirectView("/account?messageType=invalidUsername", true);
+            }
+        }
+        // Logout using Spring's utility
+        new SecurityContextLogoutHandler().logout(request, response, null);
+        return new RedirectView(LOGIN_MESSAGETYPE_CREDSUPDATED, true);
+    }
+
+    @PreAuthorize("!hasAuthority('ROLE_DEMO_USER')")
+    @PostMapping("/change-password-on-login")
+    public RedirectView changePasswordOnLogin(
+            Principal principal,
+            @RequestParam(name = "currentPassword") String currentPassword,
+            @RequestParam(name = "newPassword") String newPassword,
+            HttpServletRequest request,
+            HttpServletResponse response,
+            RedirectAttributes redirectAttributes)
+            throws SQLException, UnsupportedProviderException {
+        if (principal == null) {
+            return new RedirectView("/change-creds?messageType=notAuthenticated", true);
+        }
+        Optional<User> userOpt = userService.findByUsernameIgnoreCase(principal.getName());
+        if (userOpt.isEmpty()) {
+            return new RedirectView("/change-creds?messageType=userNotFound", true);
+        }
+        User user = userOpt.get();
+        if (!userService.isPasswordCorrect(user, currentPassword)) {
+            return new RedirectView("/change-creds?messageType=incorrectPassword", true);
+        }
+        userService.changePassword(user, newPassword);
+        userService.changeFirstUse(user, false);
+        // Logout using Spring's utility
+        new SecurityContextLogoutHandler().logout(request, response, null);
+        return new RedirectView(LOGIN_MESSAGETYPE_CREDSUPDATED, true);
+    }
+
+    @PreAuthorize("!hasAuthority('ROLE_DEMO_USER')")
+    @PostMapping("/change-password")
+    public RedirectView changePassword(
+            Principal principal,
+            @RequestParam(name = "currentPassword") String currentPassword,
+            @RequestParam(name = "newPassword") String newPassword,
+            HttpServletRequest request,
+            HttpServletResponse response,
+            RedirectAttributes redirectAttributes)
+            throws SQLException, UnsupportedProviderException {
+        if (principal == null) {
+            return new RedirectView("/account?messageType=notAuthenticated", true);
+        }
+        Optional<User> userOpt = userService.findByUsernameIgnoreCase(principal.getName());
+        if (userOpt.isEmpty()) {
+            return new RedirectView("/account?messageType=userNotFound", true);
+        }
+        User user = userOpt.get();
+        if (!userService.isPasswordCorrect(user, currentPassword)) {
+            return new RedirectView("/account?messageType=incorrectPassword", true);
+        }
+        userService.changePassword(user, newPassword);
+        // Logout using Spring's utility
+        new SecurityContextLogoutHandler().logout(request, response, null);
+        return new RedirectView(LOGIN_MESSAGETYPE_CREDSUPDATED, true);
+    }
+
+    @PreAuthorize("!hasAuthority('ROLE_DEMO_USER')")
+    @PostMapping("/updateUserSettings")
+    /**
+     * Updates the user settings based on the provided JSON payload.
+     *
+     * @param updates A map containing the settings to update. The expected structure is:
+     *     <ul>
+     *       <li><b>emailNotifications</b> (optional): "true" or "false" - Enable or disable email
+     *           notifications.
+     *       <li><b>theme</b> (optional): "light" or "dark" - Set the user's preferred theme.
+     *       <li><b>language</b> (optional): A string representing the preferred language (e.g.,
+     *           "en", "fr").
+     *     </ul>
+     *     Keys not listed above will be ignored.
+     * @param principal The currently authenticated user.
+     * @return A redirect string to the account page after updating the settings.
+     * @throws SQLException If a database error occurs.
+     * @throws UnsupportedProviderException If the operation is not supported for the user's
+     *     provider.
+     */
+    public String updateUserSettings(@RequestBody Map<String, String> updates, Principal principal)
+            throws SQLException, UnsupportedProviderException {
+        log.debug("Processed updates: {}", updates);
+        // Assuming you have a method in userService to update the settings for a user
+        userService.updateUserSettings(principal.getName(), updates);
+        // Redirect to a page of your choice after updating
+        return "redirect:/account";
+    }
+
+    @PreAuthorize("hasRole('ROLE_ADMIN')")
+    @PostMapping("/admin/saveUser")
+    public RedirectView saveUser(
+            @RequestParam(name = "username", required = true) String username,
+            @RequestParam(name = "password", required = false) String password,
+            @RequestParam(name = "role") String role,
+            @RequestParam(name = "authType") String authType,
+            @RequestParam(name = "forceChange", required = false, defaultValue = "false")
+                    boolean forceChange)
+            throws IllegalArgumentException, SQLException, UnsupportedProviderException {
+        if (!userService.isUsernameValid(username)) {
+            return new RedirectView("/adminSettings?messageType=invalidUsername", true);
+        }
+        if (applicationProperties.getPremium().isEnabled()
+                && applicationProperties.getPremium().getMaxUsers()
+                        <= userService.getTotalUsersCount()) {
+            return new RedirectView("/adminSettings?messageType=maxUsersReached", true);
+        }
+        Optional<User> userOpt = userService.findByUsernameIgnoreCase(username);
+        if (userOpt.isPresent()) {
+            User user = userOpt.get();
+            if (user.getUsername().equalsIgnoreCase(username)) {
+                return new RedirectView("/adminSettings?messageType=usernameExists", true);
+            }
+        }
+        if (userService.usernameExistsIgnoreCase(username)) {
+            return new RedirectView("/adminSettings?messageType=usernameExists", true);
+        }
+        try {
+            // Validate the role
+            Role roleEnum = Role.fromString(role);
+            if (roleEnum == Role.INTERNAL_API_USER) {
+                // If the role is INTERNAL_API_USER, reject the request
+                return new RedirectView("/adminSettings?messageType=invalidRole", true);
+            }
+        } catch (IllegalArgumentException e) {
+            // If the role ID is not valid, redirect with an error message
+            return new RedirectView("/adminSettings?messageType=invalidRole", true);
+        }
+        if (authType.equalsIgnoreCase(AuthenticationType.SSO.toString())) {
+            userService.saveUser(username, AuthenticationType.SSO, role);
+        } else {
+            if (password.isBlank()) {
+                return new RedirectView("/adminSettings?messageType=invalidPassword", true);
+            }
+            userService.saveUser(username, password, role, forceChange);
+        }
+        return new RedirectView(
+                "/adminSettings", // Redirect to account page after adding the user
+                true);
+    }
+
+    @PreAuthorize("hasRole('ROLE_ADMIN')")
+    @PostMapping("/admin/changeRole")
+    public RedirectView changeRole(
+            @RequestParam(name = "username") String username,
+            @RequestParam(name = "role") String role,
+            Authentication authentication)
+            throws SQLException, UnsupportedProviderException {
+        Optional<User> userOpt = userService.findByUsernameIgnoreCase(username);
+        if (!userOpt.isPresent()) {
+            return new RedirectView("/adminSettings?messageType=userNotFound", true);
+        }
+        if (!userService.usernameExistsIgnoreCase(username)) {
+            return new RedirectView("/adminSettings?messageType=userNotFound", true);
+        }
+        // Get the currently authenticated username
+        String currentUsername = authentication.getName();
+        // Check if the provided username matches the current session's username
+        if (currentUsername.equalsIgnoreCase(username)) {
+            return new RedirectView("/adminSettings?messageType=downgradeCurrentUser", true);
+        }
+        try {
+            // Validate the role
+            Role roleEnum = Role.fromString(role);
+            if (roleEnum == Role.INTERNAL_API_USER) {
+                // If the role is INTERNAL_API_USER, reject the request
+                return new RedirectView("/adminSettings?messageType=invalidRole", true);
+            }
+        } catch (IllegalArgumentException e) {
+            // If the role ID is not valid, redirect with an error message
+            return new RedirectView("/adminSettings?messageType=invalidRole", true);
+        }
+        User user = userOpt.get();
+        userService.changeRole(user, role);
+        return new RedirectView(
+                "/adminSettings", // Redirect to account page after adding the user
+                true);
+    }
+
+    @PreAuthorize("hasRole('ROLE_ADMIN')")
+    @PostMapping("/admin/changeUserEnabled/{username}")
+    public RedirectView changeUserEnabled(
+            @PathVariable("username") String username,
+            @RequestParam("enabled") boolean enabled,
+            Authentication authentication)
+            throws SQLException, UnsupportedProviderException {
+        Optional<User> userOpt = userService.findByUsernameIgnoreCase(username);
+        if (userOpt.isEmpty()) {
+            return new RedirectView("/adminSettings?messageType=userNotFound", true);
+        }
+        if (!userService.usernameExistsIgnoreCase(username)) {
+            return new RedirectView("/adminSettings?messageType=userNotFound", true);
+        }
+        // Get the currently authenticated username
+        String currentUsername = authentication.getName();
+        // Check if the provided username matches the current session's username
+        if (currentUsername.equalsIgnoreCase(username)) {
+            return new RedirectView("/adminSettings?messageType=disabledCurrentUser", true);
+        }
+        User user = userOpt.get();
+        userService.changeUserEnabled(user, enabled);
+        if (!enabled) {
+            // Invalidate all sessions if the user is being disabled
+            List<Object> principals = sessionRegistry.getAllPrincipals();
+            String userNameP = "";
+            for (Object principal : principals) {
+                List<SessionInformation> sessionsInformation =
+                        sessionRegistry.getAllSessions(principal, false);
+                if (principal instanceof UserDetails detailsUser) {
+                    userNameP = detailsUser.getUsername();
+                } else if (principal instanceof OAuth2User oAuth2User) {
+                    userNameP = oAuth2User.getName();
+                } else if (principal instanceof CustomSaml2AuthenticatedPrincipal saml2User) {
+                    userNameP = saml2User.name();
+                } else if (principal instanceof String stringUser) {
+                    userNameP = stringUser;
+                }
+                if (userNameP.equalsIgnoreCase(username)) {
+                    for (SessionInformation sessionInfo : sessionsInformation) {
+                        sessionRegistry.expireSession(sessionInfo.getSessionId());
+                    }
+                }
+            }
+        }
+        return new RedirectView(
+                "/adminSettings", // Redirect to account page after adding the user
+                true);
+    }
+
+    @PreAuthorize("hasRole('ROLE_ADMIN')")
+    @PostMapping("/admin/deleteUser/{username}")
+    public RedirectView deleteUser(
+            @PathVariable("username") String username, Authentication authentication) {
+        if (!userService.usernameExistsIgnoreCase(username)) {
+            return new RedirectView("/adminSettings?messageType=deleteUsernameExists", true);
+        }
+        // Get the currently authenticated username
+        String currentUsername = authentication.getName();
+        // Check if the provided username matches the current session's username
+        if (currentUsername.equalsIgnoreCase(username)) {
+            return new RedirectView("/adminSettings?messageType=deleteCurrentUser", true);
+        }
+        // Invalidate all sessions before deleting the user
+        List<SessionInformation> sessionsInformations =
+                sessionRegistry.getAllSessions(username, false);
+        for (SessionInformation sessionsInformation : sessionsInformations) {
+            sessionRegistry.expireSession(sessionsInformation.getSessionId());
+            sessionRegistry.removeSessionInformation(sessionsInformation.getSessionId());
+        }
+        userService.deleteUser(username);
+        return new RedirectView("/adminSettings", true);
+    }
+
+    @PreAuthorize("!hasAuthority('ROLE_DEMO_USER')")
+    @PostMapping("/get-api-key")
+    public ResponseEntity<String> getApiKey(Principal principal) {
+        if (principal == null) {
+            return ResponseEntity.status(HttpStatus.FORBIDDEN).body("User not authenticated.");
+        }
+        String username = principal.getName();
+        String apiKey = userService.getApiKeyForUser(username);
+        if (apiKey == null) {
+            return ResponseEntity.status(HttpStatus.NOT_FOUND).body("API key not found for user.");
+        }
+        return ResponseEntity.ok(apiKey);
+    }
+
+    @PreAuthorize("!hasAuthority('ROLE_DEMO_USER')")
+    @PostMapping("/update-api-key")
+    public ResponseEntity<String> updateApiKey(Principal principal) {
+        if (principal == null) {
+            return ResponseEntity.status(HttpStatus.FORBIDDEN).body("User not authenticated.");
+        }
+        String username = principal.getName();
+        User user = userService.refreshApiKeyForUser(username);
+        String apiKey = user.getApiKey();
+        if (apiKey == null) {
+            return ResponseEntity.status(HttpStatus.NOT_FOUND).body("API key not found for user.");
+        }
+        return ResponseEntity.ok(apiKey);
+    }
+}

proprietary/src/main/java/stirling/software/proprietary/security/controller/web/AccountWebController.java

@@ -0,0 +1,448 @@
+package stirling.software.proprietary.security.controller.web;
+
+import static stirling.software.common.util.ProviderUtils.validateProvider;
+
+import java.time.Instant;
+import java.time.temporal.ChronoUnit;
+import java.util.Date;
+import java.util.HashMap;
+import java.util.Iterator;
+import java.util.List;
+import java.util.Map;
+import java.util.Optional;
+
+import org.springframework.beans.factory.annotation.Qualifier;
+import org.springframework.security.access.prepost.PreAuthorize;
+import org.springframework.security.core.Authentication;
+import org.springframework.security.core.userdetails.UserDetails;
+import org.springframework.security.oauth2.core.user.OAuth2User;
+import org.springframework.stereotype.Controller;
+import org.springframework.ui.Model;
+import org.springframework.web.bind.annotation.GetMapping;
+
+import com.fasterxml.jackson.core.JsonProcessingException;
+import com.fasterxml.jackson.databind.ObjectMapper;
+
+import io.swagger.v3.oas.annotations.tags.Tag;
+
+import jakarta.servlet.http.HttpServletRequest;
+
+import lombok.extern.slf4j.Slf4j;
+
+import stirling.software.common.model.enumeration.Role;
+import stirling.software.common.model.ApplicationProperties;
+import stirling.software.common.model.ApplicationProperties.Security;
+import stirling.software.common.model.ApplicationProperties.Security.OAUTH2;
+import stirling.software.common.model.ApplicationProperties.Security.OAUTH2.Client;
+import stirling.software.common.model.ApplicationProperties.Security.SAML2;
+import stirling.software.common.model.oauth2.GitHubProvider;
+import stirling.software.common.model.oauth2.GoogleProvider;
+import stirling.software.common.model.oauth2.KeycloakProvider;
+import stirling.software.proprietary.security.database.repository.UserRepository;
+import stirling.software.proprietary.security.model.Authority;
+import stirling.software.proprietary.security.model.SessionEntity;
+import stirling.software.proprietary.security.model.User;
+import stirling.software.proprietary.security.saml2.CustomSaml2AuthenticatedPrincipal;
+import stirling.software.proprietary.security.session.SessionPersistentRegistry;
+
+@Controller
+@Slf4j
+@Tag(name = "Account Security", description = "Account Security APIs")
+public class AccountWebController {
+
+    public static final String OAUTH_2_AUTHORIZATION = "/oauth2/authorization/";
+
+    private final ApplicationProperties applicationProperties;
+    private final SessionPersistentRegistry sessionPersistentRegistry;
+    // Assuming you have a repository for user operations
+    private final UserRepository userRepository;
+    private final boolean runningEE;
+
+    public AccountWebController(
+            ApplicationProperties applicationProperties,
+            SessionPersistentRegistry sessionPersistentRegistry,
+            UserRepository userRepository,
+            @Qualifier("runningEE") boolean runningEE) {
+        this.applicationProperties = applicationProperties;
+        this.sessionPersistentRegistry = sessionPersistentRegistry;
+        this.userRepository = userRepository;
+        this.runningEE = runningEE;
+    }
+
+    @GetMapping("/login")
+    public String login(HttpServletRequest request, Model model, Authentication authentication) {
+        // If the user is already authenticated, redirect them to the home page.
+        if (authentication != null && authentication.isAuthenticated()) {
+            return "redirect:/";
+        }
+
+        Map<String, String> providerList = new HashMap<>();
+        Security securityProps = applicationProperties.getSecurity();
+        OAUTH2 oauth = securityProps.getOauth2();
+
+        if (oauth != null) {
+            if (oauth.getEnabled()) {
+                if (oauth.isSettingsValid()) {
+                    String firstChar = String.valueOf(oauth.getProvider().charAt(0));
+                    String clientName =
+                            oauth.getProvider().replaceFirst(firstChar, firstChar.toUpperCase());
+                    providerList.put(OAUTH_2_AUTHORIZATION + oauth.getProvider(), clientName);
+                }
+
+                Client client = oauth.getClient();
+
+                if (client != null) {
+                    GoogleProvider google = client.getGoogle();
+
+                    if (validateProvider(google)) {
+                        providerList.put(
+                                OAUTH_2_AUTHORIZATION + google.getName(), google.getClientName());
+                    }
+
+                    GitHubProvider github = client.getGithub();
+
+                    if (validateProvider(github)) {
+                        providerList.put(
+                                OAUTH_2_AUTHORIZATION + github.getName(), github.getClientName());
+                    }
+
+                    KeycloakProvider keycloak = client.getKeycloak();
+
+                    if (validateProvider(keycloak)) {
+                        providerList.put(
+                                OAUTH_2_AUTHORIZATION + keycloak.getName(),
+                                keycloak.getClientName());
+                    }
+                }
+            }
+        }
+
+        SAML2 saml2 = securityProps.getSaml2();
+
+        if (securityProps.isSaml2Active()
+                && applicationProperties.getSystem().getEnableAlphaFunctionality()
+                && applicationProperties.getPremium().isEnabled()) {
+            String samlIdp = saml2.getProvider();
+            String saml2AuthenticationPath = "/saml2/authenticate/" + saml2.getRegistrationId();
+
+            if (applicationProperties.getPremium().getProFeatures().isSsoAutoLogin()) {
+                return "redirect:" + request.getRequestURL() + saml2AuthenticationPath;
+            } else {
+                providerList.put(saml2AuthenticationPath, samlIdp + " (SAML 2)");
+            }
+        }
+
+        // Remove any null keys/values from the providerList
+        providerList
+                .entrySet()
+                .removeIf(entry -> entry.getKey() == null || entry.getValue() == null);
+        model.addAttribute("providerList", providerList);
+        model.addAttribute("loginMethod", securityProps.getLoginMethod());
+
+        boolean altLogin = !providerList.isEmpty() ? securityProps.isAltLogin() : false;
+
+        model.addAttribute("altLogin", altLogin);
+        model.addAttribute("currentPage", "login");
+        String error = request.getParameter("error");
+
+        if (error != null) {
+            switch (error) {
+                case "badCredentials" -> error = "login.invalid";
+                case "locked" -> error = "login.locked";
+                case "oauth2AuthenticationError" -> error = "userAlreadyExistsOAuthMessage";
+            }
+
+            model.addAttribute("error", error);
+        }
+
+        String errorOAuth = request.getParameter("errorOAuth");
+
+        if (errorOAuth != null) {
+            switch (errorOAuth) {
+                case "oAuth2AutoCreateDisabled" -> errorOAuth = "login.oAuth2AutoCreateDisabled";
+                case "invalidUsername" -> errorOAuth = "login.invalid";
+                case "userAlreadyExistsWeb" -> errorOAuth = "userAlreadyExistsWebMessage";
+                case "oAuth2AuthenticationErrorWeb" -> errorOAuth = "login.oauth2InvalidUserType";
+                case "invalid_token_response" -> errorOAuth = "login.oauth2InvalidTokenResponse";
+                case "authorization_request_not_found" ->
+                        errorOAuth = "login.oauth2RequestNotFound";
+                case "access_denied" -> errorOAuth = "login.oauth2AccessDenied";
+                case "invalid_user_info_response" ->
+                        errorOAuth = "login.oauth2InvalidUserInfoResponse";
+                case "invalid_request" -> errorOAuth = "login.oauth2invalidRequest";
+                case "invalid_id_token" -> errorOAuth = "login.oauth2InvalidIdToken";
+                case "oAuth2AdminBlockedUser" -> errorOAuth = "login.oAuth2AdminBlockedUser";
+                case "userIsDisabled" -> errorOAuth = "login.userIsDisabled";
+                case "invalid_destination" -> errorOAuth = "login.invalid_destination";
+                case "relying_party_registration_not_found" ->
+                        errorOAuth = "login.relyingPartyRegistrationNotFound";
+                // Valid InResponseTo was not available from the validation context, unable to
+                // evaluate
+                case "invalid_in_response_to" -> errorOAuth = "login.invalid_in_response_to";
+                case "not_authentication_provider_found" ->
+                        errorOAuth = "login.not_authentication_provider_found";
+            }
+
+            model.addAttribute("errorOAuth", errorOAuth);
+        }
+
+        if (request.getParameter("messageType") != null) {
+            model.addAttribute("messageType", "changedCredsMessage");
+        }
+
+        if (request.getParameter("logout") != null) {
+            model.addAttribute("logoutMessage", "login.logoutMessage");
+        }
+
+        return "login";
+    }
+
+    @PreAuthorize("hasRole('ROLE_ADMIN')")
+    @GetMapping("/usage")
+    public String showUsage() {
+        if (!runningEE) {
+            return "error";
+        }
+        return "usage";
+    }
+
+    @PreAuthorize("hasRole('ROLE_ADMIN')")
+    @GetMapping("/adminSettings")
+    public String showAddUserForm(
+            HttpServletRequest request, Model model, Authentication authentication) {
+        List<User> allUsers = userRepository.findAll();
+        Iterator<User> iterator = allUsers.iterator();
+        Map<String, String> roleDetails = Role.getAllRoleDetails();
+        // Map to store session information and user activity status
+        Map<String, Boolean> userSessions = new HashMap<>();
+        Map<String, Date> userLastRequest = new HashMap<>();
+        int activeUsers = 0;
+        int disabledUsers = 0;
+        while (iterator.hasNext()) {
+            User user = iterator.next();
+            if (user != null) {
+                for (Authority authority : user.getAuthorities()) {
+                    if (authority.getAuthority().equals(Role.INTERNAL_API_USER.getRoleId())) {
+                        iterator.remove();
+                        roleDetails.remove(Role.INTERNAL_API_USER.getRoleId());
+                        // Break out of the inner loop once the user is removed
+                        break;
+                    }
+                }
+                // Determine the user's session status and last request time
+                int maxInactiveInterval = sessionPersistentRegistry.getMaxInactiveInterval();
+                boolean hasActiveSession = false;
+                Date lastRequest = null;
+                Optional<SessionEntity> latestSession =
+                        sessionPersistentRegistry.findLatestSession(user.getUsername());
+                if (latestSession.isPresent()) {
+                    SessionEntity sessionEntity = latestSession.get();
+                    Date lastAccessedTime = sessionEntity.getLastRequest();
+                    Instant now = Instant.now();
+                    // Calculate session expiration and update session status accordingly
+                    Instant expirationTime =
+                            lastAccessedTime
+                                    .toInstant()
+                                    .plus(maxInactiveInterval, ChronoUnit.SECONDS);
+                    if (now.isAfter(expirationTime)) {
+                        sessionPersistentRegistry.expireSession(sessionEntity.getSessionId());
+                    } else {
+                        hasActiveSession = !sessionEntity.isExpired();
+                    }
+                    lastRequest = sessionEntity.getLastRequest();
+                } else {
+                    // No session, set default last request time
+                    lastRequest = new Date(0);
+                }
+                userSessions.put(user.getUsername(), hasActiveSession);
+                userLastRequest.put(user.getUsername(), lastRequest);
+                if (hasActiveSession) {
+                    activeUsers++;
+                }
+                if (!user.isEnabled()) {
+                    disabledUsers++;
+                }
+            }
+        }
+        // Sort users by active status and last request date
+        List<User> sortedUsers =
+                allUsers.stream()
+                        .sorted(
+                                (u1, u2) -> {
+                                    boolean u1Active = userSessions.get(u1.getUsername());
+                                    boolean u2Active = userSessions.get(u2.getUsername());
+                                    if (u1Active && !u2Active) {
+                                        return -1;
+                                    } else if (!u1Active && u2Active) {
+                                        return 1;
+                                    } else {
+                                        Date u1LastRequest =
+                                                userLastRequest.getOrDefault(
+                                                        u1.getUsername(), new Date(0));
+                                        Date u2LastRequest =
+                                                userLastRequest.getOrDefault(
+                                                        u2.getUsername(), new Date(0));
+                                        return u2LastRequest.compareTo(u1LastRequest);
+                                    }
+                                })
+                        .toList();
+        String messageType = request.getParameter("messageType");
+
+        String deleteMessage;
+        if (messageType != null) {
+            deleteMessage =
+                    switch (messageType) {
+                        case "deleteCurrentUser" -> "deleteCurrentUserMessage";
+                        case "deleteUsernameExists" -> "deleteUsernameExistsMessage";
+                        default -> null;
+                    };
+
+            model.addAttribute("deleteMessage", deleteMessage);
+
+            String addMessage;
+            addMessage =
+                    switch (messageType) {
+                        case "usernameExists" -> "usernameExistsMessage";
+                        case "invalidUsername" -> "invalidUsernameMessage";
+                        case "invalidPassword" -> "invalidPasswordMessage";
+                        default -> null;
+                    };
+            model.addAttribute("addMessage", addMessage);
+        }
+
+        String changeMessage;
+        if (messageType != null) {
+            changeMessage =
+                    switch (messageType) {
+                        case "userNotFound" -> "userNotFoundMessage";
+                        case "downgradeCurrentUser" -> "downgradeCurrentUserMessage";
+                        case "disabledCurrentUser" -> "disabledCurrentUserMessage";
+                        default -> messageType;
+                    };
+            model.addAttribute("changeMessage", changeMessage);
+        }
+
+        model.addAttribute("users", sortedUsers);
+        model.addAttribute("currentUsername", authentication.getName());
+        model.addAttribute("roleDetails", roleDetails);
+        model.addAttribute("userSessions", userSessions);
+        model.addAttribute("userLastRequest", userLastRequest);
+        model.addAttribute("totalUsers", allUsers.size());
+        model.addAttribute("activeUsers", activeUsers);
+        model.addAttribute("disabledUsers", disabledUsers);
+
+        model.addAttribute("maxPaidUsers", applicationProperties.getPremium().getMaxUsers());
+        return "adminSettings";
+    }
+
+    @PreAuthorize("!hasAuthority('ROLE_DEMO_USER')")
+    @GetMapping("/account")
+    public String account(HttpServletRequest request, Model model, Authentication authentication) {
+        if (authentication == null || !authentication.isAuthenticated()) {
+            return "redirect:/";
+        }
+        if (authentication.isAuthenticated()) {
+            Object principal = authentication.getPrincipal();
+            String username = null;
+
+            // Retrieve username and other attributes and add login attributes to the model
+            if (principal instanceof UserDetails detailsUser) {
+                username = detailsUser.getUsername();
+                model.addAttribute("oAuth2Login", false);
+            }
+            if (principal instanceof OAuth2User oAuth2User) {
+                username = oAuth2User.getName();
+                model.addAttribute("oAuth2Login", true);
+            }
+            if (principal instanceof CustomSaml2AuthenticatedPrincipal saml2User) {
+                username = saml2User.name();
+                model.addAttribute("saml2Login", true);
+            }
+            if (username != null) {
+                // Fetch user details from the database
+                Optional<User> user = userRepository.findByUsernameIgnoreCaseWithSettings(username);
+
+                if (user.isEmpty()) {
+                    return "redirect:/error";
+                }
+
+                // Convert settings map to JSON string
+                ObjectMapper objectMapper = new ObjectMapper();
+                String settingsJson;
+                try {
+                    settingsJson = objectMapper.writeValueAsString(user.get().getSettings());
+                } catch (JsonProcessingException e) {
+                    log.error("Error converting settings map", e);
+                    return "redirect:/error";
+                }
+
+                String messageType = request.getParameter("messageType");
+                if (messageType != null) {
+                    switch (messageType) {
+                        case "notAuthenticated" -> messageType = "notAuthenticatedMessage";
+                        case "userNotFound" -> messageType = "userNotFoundMessage";
+                        case "incorrectPassword" -> messageType = "incorrectPasswordMessage";
+                        case "usernameExists" -> messageType = "usernameExistsMessage";
+                        case "invalidUsername" -> messageType = "invalidUsernameMessage";
+                    }
+                }
+
+                model.addAttribute("username", username);
+                model.addAttribute("messageType", messageType);
+                model.addAttribute("role", user.get().getRolesAsString());
+                model.addAttribute("settings", settingsJson);
+                model.addAttribute("changeCredsFlag", user.get().isFirstLogin());
+                model.addAttribute("currentPage", "account");
+            }
+        } else {
+            return "redirect:/";
+        }
+        return "account";
+    }
+
+    @PreAuthorize("!hasAuthority('ROLE_DEMO_USER')")
+    @GetMapping("/change-creds")
+    public String changeCreds(
+            HttpServletRequest request, Model model, Authentication authentication) {
+        if (authentication == null || !authentication.isAuthenticated()) {
+            return "redirect:/";
+        }
+        if (authentication.isAuthenticated()) {
+            Object principal = authentication.getPrincipal();
+            if (principal instanceof UserDetails detailsUser) {
+                String username = detailsUser.getUsername();
+                // Fetch user details from the database
+                Optional<User> user = userRepository.findByUsernameIgnoreCase(username);
+                if (user.isEmpty()) {
+                    // Handle error appropriately, example redirection in case of error
+                    return "redirect:/error";
+                }
+                String messageType = request.getParameter("messageType");
+                if (messageType != null) {
+                    switch (messageType) {
+                        case "notAuthenticated":
+                            messageType = "notAuthenticatedMessage";
+                            break;
+                        case "userNotFound":
+                            messageType = "userNotFoundMessage";
+                            break;
+                        case "incorrectPassword":
+                            messageType = "incorrectPasswordMessage";
+                            break;
+                        case "usernameExists":
+                            messageType = "usernameExistsMessage";
+                            break;
+                        default:
+                            break;
+                    }
+                    model.addAttribute("messageType", messageType);
+                }
+
+                model.addAttribute("username", username);
+            }
+        } else {
+            return "redirect:/";
+        }
+        return "change-creds";
+    }
+}

proprietary/src/main/java/stirling/software/proprietary/security/controller/web/DatabaseWebController.java

@@ -0,0 +1,46 @@
+package stirling.software.proprietary.security.controller.web;
+
+import java.util.List;
+
+import org.springframework.security.access.prepost.PreAuthorize;
+import org.springframework.security.core.Authentication;
+import org.springframework.stereotype.Controller;
+import org.springframework.ui.Model;
+import org.springframework.web.bind.annotation.GetMapping;
+
+import io.swagger.v3.oas.annotations.tags.Tag;
+
+import jakarta.servlet.http.HttpServletRequest;
+
+import lombok.RequiredArgsConstructor;
+
+import stirling.software.common.model.FileInfo;
+import stirling.software.proprietary.security.service.DatabaseService;
+
+@Controller
+@Tag(name = "Database Management", description = "Database management and security APIs")
+@RequiredArgsConstructor
+public class DatabaseWebController {
+
+    private final DatabaseService databaseService;
+
+    @PreAuthorize("hasRole('ROLE_ADMIN')")
+    @GetMapping("/database")
+    public String database(HttpServletRequest request, Model model, Authentication authentication) {
+        String error = request.getParameter("error");
+        String confirmed = request.getParameter("infoMessage");
+        if (error != null) {
+            model.addAttribute("error", error);
+        } else if (confirmed != null) {
+            model.addAttribute("infoMessage", confirmed);
+        }
+        List<FileInfo> backupList = databaseService.getBackupList();
+        model.addAttribute("backupFiles", backupList);
+        String dbVersion = databaseService.getH2Version();
+        model.addAttribute("databaseVersion", dbVersion);
+        if ("Unknown".equalsIgnoreCase(dbVersion)) {
+            model.addAttribute("infoMessage", "notSupported");
+        }
+        return "database";
+    }
+}

proprietary/src/main/java/stirling/software/proprietary/security/database/H2SQLCondition.java

@@ -0,0 +1,23 @@
+package stirling.software.proprietary.security.database;
+
+import org.springframework.context.annotation.Condition;
+import org.springframework.context.annotation.ConditionContext;
+import org.springframework.core.type.AnnotatedTypeMetadata;
+
+public class H2SQLCondition implements Condition {
+
+    @Override
+    public boolean matches(ConditionContext context, AnnotatedTypeMetadata metadata) {
+        boolean enableCustomDatabase =
+                Boolean.parseBoolean(
+                        context.getEnvironment()
+                                .getProperty("system.datasource.enableCustomDatabase"));
+
+        if (!enableCustomDatabase) {
+            return false;
+        }
+
+        String dataSourceType = context.getEnvironment().getProperty("system.datasource.type");
+        return "h2".equalsIgnoreCase(dataSourceType);
+    }
+}

proprietary/src/main/java/stirling/software/proprietary/security/database/ScheduledTasks.java

@@ -0,0 +1,22 @@
+package stirling.software.proprietary.security.database;
+
+import java.sql.SQLException;
+import lombok.RequiredArgsConstructor;
+import org.springframework.context.annotation.Conditional;
+import org.springframework.scheduling.annotation.Scheduled;
+import org.springframework.stereotype.Component;
+import stirling.software.common.model.exception.UnsupportedProviderException;
+import stirling.software.proprietary.security.service.DatabaseServiceInterface;
+
+@Component
+@Conditional(H2SQLCondition.class)
+@RequiredArgsConstructor
+public class ScheduledTasks {
+
+    private final DatabaseServiceInterface databaseService;
+
+    @Scheduled(cron = "0 0 0 * * ?")
+    public void performBackup() throws SQLException, UnsupportedProviderException {
+        databaseService.exportDatabase();
+    }
+}

proprietary/src/main/java/stirling/software/proprietary/security/database/repository/AuthorityRepository.java

@@ -0,0 +1,15 @@
+package stirling.software.proprietary.security.database.repository;
+
+import java.util.Set;
+
+import org.springframework.data.jpa.repository.JpaRepository;
+import org.springframework.stereotype.Repository;
+import stirling.software.proprietary.security.model.Authority;
+
+@Repository
+public interface AuthorityRepository extends JpaRepository<Authority, Long> {
+    // Set<Authority> findByUsername(String username);
+    Set<Authority> findByUser_Username(String username);
+
+    Authority findByUserId(long user_id);
+}

proprietary/src/main/java/stirling/software/proprietary/security/database/repository/JPATokenRepositoryImpl.java

@@ -0,0 +1,58 @@
+package stirling.software.proprietary.security.database.repository;
+
+import java.util.Date;
+
+import org.springframework.security.web.authentication.rememberme.PersistentRememberMeToken;
+import org.springframework.security.web.authentication.rememberme.PersistentTokenRepository;
+import org.springframework.transaction.annotation.Transactional;
+import stirling.software.proprietary.security.model.PersistentLogin;
+
+public class JPATokenRepositoryImpl implements PersistentTokenRepository {
+
+    private final PersistentLoginRepository persistentLoginRepository;
+
+    public JPATokenRepositoryImpl(PersistentLoginRepository persistentLoginRepository) {
+        this.persistentLoginRepository = persistentLoginRepository;
+    }
+
+    @Override
+    @Transactional
+    public void createNewToken(PersistentRememberMeToken token) {
+        PersistentLogin newToken = new PersistentLogin();
+        newToken.setSeries(token.getSeries());
+        newToken.setUsername(token.getUsername());
+        newToken.setToken(token.getTokenValue());
+        newToken.setLastUsed(token.getDate());
+        persistentLoginRepository.save(newToken);
+    }
+
+    @Override
+    @Transactional
+    public void updateToken(String series, String tokenValue, Date lastUsed) {
+        PersistentLogin existingToken = persistentLoginRepository.findById(series).orElse(null);
+        if (existingToken != null) {
+            existingToken.setToken(tokenValue);
+            existingToken.setLastUsed(lastUsed);
+            persistentLoginRepository.save(existingToken);
+        }
+    }
+
+    @Override
+    public PersistentRememberMeToken getTokenForSeries(String seriesId) {
+        PersistentLogin token = persistentLoginRepository.findById(seriesId).orElse(null);
+        if (token != null) {
+            return new PersistentRememberMeToken(
+                    token.getUsername(), token.getSeries(), token.getToken(), token.getLastUsed());
+        }
+        return null;
+    }
+
+    @Override
+    @Transactional
+    public void removeUserTokens(String username) {
+        try {
+            persistentLoginRepository.deleteByUsername(username);
+        } catch (Exception e) {
+        }
+    }
+}

proprietary/src/main/java/stirling/software/proprietary/security/database/repository/PersistentLoginRepository.java

@@ -0,0 +1,10 @@
+package stirling.software.proprietary.security.database.repository;
+
+import org.springframework.data.jpa.repository.JpaRepository;
+import org.springframework.stereotype.Repository;
+import stirling.software.proprietary.security.model.PersistentLogin;
+
+@Repository
+public interface PersistentLoginRepository extends JpaRepository<PersistentLogin, String> {
+    void deleteByUsername(String username);
+}

proprietary/src/main/java/stirling/software/proprietary/security/database/repository/SessionRepository.java

@@ -0,0 +1,29 @@
+package stirling.software.proprietary.security.database.repository;
+
+import jakarta.transaction.Transactional;
+import java.util.Date;
+import java.util.List;
+import org.springframework.data.jpa.repository.JpaRepository;
+import org.springframework.data.jpa.repository.Modifying;
+import org.springframework.data.jpa.repository.Query;
+import org.springframework.data.repository.query.Param;
+import org.springframework.stereotype.Repository;
+import stirling.software.proprietary.security.model.SessionEntity;
+
+@Repository
+public interface SessionRepository extends JpaRepository<SessionEntity, String> {
+    List<SessionEntity> findByPrincipalName(String principalName);
+
+    List<SessionEntity> findByExpired(boolean expired);
+
+    SessionEntity findBySessionId(String sessionId);
+
+    @Modifying
+    @Transactional
+    @Query(
+            "UPDATE SessionEntity s SET s.expired = :expired, s.lastRequest = :lastRequest WHERE s.principalName = :principalName")
+    void saveByPrincipalName(
+            @Param("expired") boolean expired,
+            @Param("lastRequest") Date lastRequest,
+            @Param("principalName") String principalName);
+}

proprietary/src/main/java/stirling/software/proprietary/security/database/repository/UserRepository.java

@@ -0,0 +1,24 @@
+package stirling.software.proprietary.security.database.repository;
+
+import java.util.List;
+import java.util.Optional;
+
+import org.springframework.data.jpa.repository.JpaRepository;
+import org.springframework.data.jpa.repository.Query;
+import org.springframework.data.repository.query.Param;
+import org.springframework.stereotype.Repository;
+import stirling.software.proprietary.security.model.User;
+
+@Repository
+public interface UserRepository extends JpaRepository<User, Long> {
+    Optional<User> findByUsernameIgnoreCase(String username);
+
+    @Query("FROM User u LEFT JOIN FETCH u.settings where upper(u.username) = upper(:username)")
+    Optional<User> findByUsernameIgnoreCaseWithSettings(@Param("username") String username);
+
+    Optional<User> findByUsername(String username);
+
+    Optional<User> findByApiKey(String apiKey);
+
+    List<User> findByAuthenticationTypeIgnoreCase(String authenticationType);
+}

proprietary/src/main/java/stirling/software/proprietary/security/filter/EnterpriseEndpointFilter.java

@@ -0,0 +1,38 @@
+package stirling.software.proprietary.security.filter;
+
+import java.io.IOException;
+
+import org.springframework.beans.factory.annotation.Qualifier;
+import org.springframework.http.HttpStatus;
+import org.springframework.stereotype.Component;
+import org.springframework.web.filter.OncePerRequestFilter;
+
+import jakarta.servlet.FilterChain;
+import jakarta.servlet.ServletException;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+
+@Component
+public class EnterpriseEndpointFilter extends OncePerRequestFilter {
+    private final boolean runningProOrHigher;
+
+    public EnterpriseEndpointFilter(@Qualifier("runningProOrHigher") boolean runningProOrHigher) {
+        this.runningProOrHigher = runningProOrHigher;
+    }
+
+    @Override
+    protected void doFilterInternal(
+            HttpServletRequest request, HttpServletResponse response, FilterChain filterChain)
+            throws ServletException, IOException {
+
+        if (!runningProOrHigher && isPrometheusEndpointRequest(request)) {
+            response.setStatus(HttpStatus.NOT_FOUND.value());
+            return;
+        }
+        filterChain.doFilter(request, response);
+    }
+
+    private boolean isPrometheusEndpointRequest(HttpServletRequest request) {
+        return request.getRequestURI().contains("/actuator/");
+    }
+}

proprietary/src/main/java/stirling/software/proprietary/security/filter/FirstLoginFilter.java

@@ -0,0 +1,73 @@
+package stirling.software.proprietary.security.filter;
+
+import jakarta.servlet.FilterChain;
+import jakarta.servlet.ServletException;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+import jakarta.servlet.http.HttpSession;
+import java.io.IOException;
+import java.text.SimpleDateFormat;
+import java.util.Date;
+import java.util.Optional;
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.context.annotation.Lazy;
+import org.springframework.security.core.Authentication;
+import org.springframework.security.core.context.SecurityContextHolder;
+import org.springframework.stereotype.Component;
+import org.springframework.web.filter.OncePerRequestFilter;
+import stirling.software.common.util.RequestUriUtils;
+import stirling.software.proprietary.security.model.User;
+import stirling.software.proprietary.security.service.UserService;
+
+@Slf4j
+@Component
+public class FirstLoginFilter extends OncePerRequestFilter {
+
+    @Lazy private final UserService userService;
+
+    public FirstLoginFilter(@Lazy UserService userService) {
+        this.userService = userService;
+    }
+
+    @Override
+    protected void doFilterInternal(
+            HttpServletRequest request, HttpServletResponse response, FilterChain filterChain)
+            throws ServletException, IOException {
+        String method = request.getMethod();
+        String requestURI = request.getRequestURI();
+        String contextPath = request.getContextPath();
+        // Check if the request is for static resources
+        boolean isStaticResource = RequestUriUtils.isStaticResource(contextPath, requestURI);
+        // If it's a static resource, just continue the filter chain and skip the logic below
+        if (isStaticResource) {
+            filterChain.doFilter(request, response);
+            return;
+        }
+        Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
+        if (authentication != null && authentication.isAuthenticated()) {
+            Optional<User> user = userService.findByUsernameIgnoreCase(authentication.getName());
+            if ("GET".equalsIgnoreCase(method)
+                    && user.isPresent()
+                    && user.get().isFirstLogin()
+                    && !(contextPath + "/change-creds").equals(requestURI)) {
+                response.sendRedirect(contextPath + "/change-creds");
+                return;
+            }
+        }
+        if (log.isDebugEnabled()) {
+            HttpSession session = request.getSession(true);
+            SimpleDateFormat timeFormat = new SimpleDateFormat("HH:mm:ss");
+            String creationTime = timeFormat.format(new Date(session.getCreationTime()));
+            log.debug(
+                    "Request Info - New: {}, creationTimeSession {}, ID:  {}, IP: {}, User-Agent: {}, Referer: {}, Request URL: {}",
+                    session.isNew(),
+                    creationTime,
+                    session.getId(),
+                    request.getRemoteAddr(),
+                    request.getHeader("User-Agent"),
+                    request.getHeader("Referer"),
+                    request.getRequestURL().toString());
+        }
+        filterChain.doFilter(request, response);
+    }
+}

proprietary/src/main/java/stirling/software/proprietary/security/filter/IPRateLimitingFilter.java

@@ -0,0 +1,65 @@
+package stirling.software.proprietary.security.filter;
+
+import jakarta.servlet.Filter;
+import jakarta.servlet.FilterChain;
+import jakarta.servlet.ServletException;
+import jakarta.servlet.ServletRequest;
+import jakarta.servlet.ServletResponse;
+import jakarta.servlet.http.HttpServletRequest;
+import java.io.IOException;
+import java.util.concurrent.ConcurrentHashMap;
+import java.util.concurrent.atomic.AtomicInteger;
+import lombok.RequiredArgsConstructor;
+import stirling.software.common.util.RequestUriUtils;
+
+@RequiredArgsConstructor
+public class IPRateLimitingFilter implements Filter {
+
+    private final ConcurrentHashMap<String, AtomicInteger> requestCounts =
+            new ConcurrentHashMap<>();
+    private final ConcurrentHashMap<String, AtomicInteger> getCounts = new ConcurrentHashMap<>();
+    private final int maxRequests;
+    private final int maxGetRequests;
+
+    @Override
+    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
+            throws IOException, ServletException {
+        if (request instanceof HttpServletRequest httpServletRequest) {
+            HttpServletRequest httpRequest = httpServletRequest;
+            String method = httpRequest.getMethod();
+            String requestURI = httpRequest.getRequestURI();
+            // Check if the request is for static resources
+            boolean isStaticResource =
+                    RequestUriUtils.isStaticResource(httpRequest.getContextPath(), requestURI);
+
+            // If it's a static resource, just continue the filter chain and skip the logic below
+            if (isStaticResource) {
+                chain.doFilter(request, response);
+                return;
+            }
+
+            String clientIp = request.getRemoteAddr();
+            requestCounts.computeIfAbsent(clientIp, k -> new AtomicInteger(0));
+            if (!"GET".equalsIgnoreCase(method)) {
+
+                if (requestCounts.get(clientIp).incrementAndGet() > maxRequests) {
+                    // Handle limit exceeded (e.g., send error response)
+                    response.getWriter().write("Rate limit exceeded");
+                    return;
+                }
+            } else {
+                if (requestCounts.get(clientIp).incrementAndGet() > maxGetRequests) {
+                    // Handle limit exceeded (e.g., send error response)
+                    response.getWriter().write("GET Rate limit exceeded");
+                    return;
+                }
+            }
+        }
+        chain.doFilter(request, response);
+    }
+
+    public void resetRequestCounts() {
+        requestCounts.clear();
+        getCounts.clear();
+    }
+}

proprietary/src/main/java/stirling/software/proprietary/security/filter/UserAuthenticationFilter.java

@@ -0,0 +1,254 @@
+package stirling.software.proprietary.security.filter;
+
+import jakarta.servlet.FilterChain;
+import jakarta.servlet.ServletException;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+import java.io.IOException;
+import java.util.List;
+import java.util.Optional;
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.beans.factory.annotation.Qualifier;
+import org.springframework.context.annotation.Lazy;
+import org.springframework.http.HttpStatus;
+import org.springframework.security.core.Authentication;
+import org.springframework.security.core.AuthenticationException;
+import org.springframework.security.core.authority.SimpleGrantedAuthority;
+import org.springframework.security.core.context.SecurityContextHolder;
+import org.springframework.security.core.session.SessionInformation;
+import org.springframework.security.core.userdetails.UserDetails;
+import org.springframework.security.oauth2.core.user.OAuth2User;
+import org.springframework.stereotype.Component;
+import org.springframework.web.filter.OncePerRequestFilter;
+import stirling.software.common.model.ApplicationProperties;
+import stirling.software.common.model.ApplicationProperties.Security.OAUTH2;
+import stirling.software.common.model.ApplicationProperties.Security.SAML2;
+import stirling.software.proprietary.security.model.ApiKeyAuthenticationToken;
+import stirling.software.proprietary.security.model.User;
+import stirling.software.proprietary.security.saml2.CustomSaml2AuthenticatedPrincipal;
+import stirling.software.proprietary.security.service.UserService;
+import stirling.software.proprietary.security.session.SessionPersistentRegistry;
+
+@Slf4j
+@Component
+public class UserAuthenticationFilter extends OncePerRequestFilter {
+
+    private final ApplicationProperties.Security securityProp;
+    private final UserService userService;
+    private final SessionPersistentRegistry sessionPersistentRegistry;
+    private final boolean loginEnabledValue;
+
+    public UserAuthenticationFilter(
+            @Lazy ApplicationProperties.Security securityProp,
+            @Lazy UserService userService,
+            SessionPersistentRegistry sessionPersistentRegistry,
+            @Qualifier("loginEnabled") boolean loginEnabledValue) {
+        this.securityProp = securityProp;
+        this.userService = userService;
+        this.sessionPersistentRegistry = sessionPersistentRegistry;
+        this.loginEnabledValue = loginEnabledValue;
+    }
+
+    @Override
+    protected void doFilterInternal(
+            HttpServletRequest request, HttpServletResponse response, FilterChain filterChain)
+            throws ServletException, IOException {
+
+        if (!loginEnabledValue) {
+            // If login is not enabled, just pass all requests without authentication
+            filterChain.doFilter(request, response);
+            return;
+        }
+        String requestURI = request.getRequestURI();
+        Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
+
+        // Check for session expiration (unsure if needed)
+        //        if (authentication != null && authentication.isAuthenticated()) {
+        //            String sessionId = request.getSession().getId();
+        //            SessionInformation sessionInfo =
+        //                    sessionPersistentRegistry.getSessionInformation(sessionId);
+        //
+        //            if (sessionInfo != null && sessionInfo.isExpired()) {
+        //                SecurityContextHolder.clearContext();
+        //                response.sendRedirect(request.getContextPath() + "/login?expired=true");
+        //                return;
+        //            }
+        //        }
+
+        // Check for API key in the request headers if no authentication exists
+        if (authentication == null || !authentication.isAuthenticated()) {
+            String apiKey = request.getHeader("X-API-KEY");
+            if (apiKey != null && !apiKey.trim().isEmpty()) {
+                try {
+                    // Use API key to authenticate. This requires you to have an authentication
+                    // provider for API keys.
+                    Optional<User> user = userService.getUserByApiKey(apiKey);
+                    if (user.isEmpty()) {
+                        response.setStatus(HttpStatus.UNAUTHORIZED.value());
+                        response.getWriter().write("Invalid API Key.");
+                        return;
+                    }
+                    List<SimpleGrantedAuthority> authorities =
+                            user.get().getAuthorities().stream()
+                                    .map(
+                                            authority ->
+                                                    new SimpleGrantedAuthority(
+                                                            authority.getAuthority()))
+                                    .toList();
+                    authentication = new ApiKeyAuthenticationToken(user.get(), apiKey, authorities);
+                    SecurityContextHolder.getContext().setAuthentication(authentication);
+                } catch (AuthenticationException e) {
+                    // If API key authentication fails, deny the request
+                    response.setStatus(HttpStatus.UNAUTHORIZED.value());
+                    response.getWriter().write("Invalid API Key.");
+                    return;
+                }
+            }
+        }
+
+        // If we still don't have any authentication, deny the request
+        if (authentication == null || !authentication.isAuthenticated()) {
+            String method = request.getMethod();
+            String contextPath = request.getContextPath();
+
+            if ("GET".equalsIgnoreCase(method) && !(contextPath + "/login").equals(requestURI)) {
+                response.sendRedirect(contextPath + "/login"); // redirect to the login page
+                return;
+            } else {
+                response.setStatus(HttpStatus.UNAUTHORIZED.value());
+                response.getWriter()
+                        .write(
+                                "Authentication required. Please provide a X-API-KEY in request"
+                                        + " header.\n"
+                                        + "This is found in Settings -> Account Settings -> API Key\n"
+                                        + "Alternatively you can disable authentication if this is"
+                                        + " unexpected");
+                return;
+            }
+        }
+
+        // Check if the authenticated user is disabled and invalidate their session if so
+        if (authentication != null && authentication.isAuthenticated()) {
+
+            LoginMethod loginMethod = LoginMethod.UNKNOWN;
+
+            boolean blockRegistration = false;
+
+            // Extract username and determine the login method
+            Object principal = authentication.getPrincipal();
+            String username = null;
+            if (principal instanceof UserDetails detailsUser) {
+                username = detailsUser.getUsername();
+                loginMethod = LoginMethod.USERDETAILS;
+            } else if (principal instanceof OAuth2User oAuth2User) {
+                username = oAuth2User.getName();
+                loginMethod = LoginMethod.OAUTH2USER;
+                OAUTH2 oAuth = securityProp.getOauth2();
+                blockRegistration = oAuth != null && oAuth.getBlockRegistration();
+            } else if (principal instanceof CustomSaml2AuthenticatedPrincipal saml2User) {
+                username = saml2User.name();
+                loginMethod = LoginMethod.SAML2USER;
+                SAML2 saml2 = securityProp.getSaml2();
+                blockRegistration = saml2 != null && saml2.getBlockRegistration();
+            } else if (principal instanceof String stringUser) {
+                username = stringUser;
+                loginMethod = LoginMethod.STRINGUSER;
+            }
+
+            // Retrieve all active sessions for the user
+            List<SessionInformation> sessionsInformations =
+                    sessionPersistentRegistry.getAllSessions(principal, false);
+
+            // Check if the user exists, is disabled, or needs session invalidation
+            if (username != null) {
+                log.debug("Validating user: {}", username);
+                boolean isUserExists = userService.usernameExistsIgnoreCase(username);
+                boolean isUserDisabled = userService.isUserDisabled(username);
+
+                boolean notSsoLogin =
+                        !LoginMethod.OAUTH2USER.equals(loginMethod)
+                                && !LoginMethod.SAML2USER.equals(loginMethod);
+
+                // Block user registration if not allowed by configuration
+                if (blockRegistration && !isUserExists) {
+                    log.warn("Blocked registration for OAuth2/SAML user: {}", username);
+                    response.sendRedirect(
+                            request.getContextPath() + "/logout?oAuth2AdminBlockedUser=true");
+                    return;
+                }
+
+                // Expire sessions and logout if the user does not exist or is disabled
+                if (!isUserExists || isUserDisabled) {
+                    log.info(
+                            "Invalidating session for disabled or non-existent user: {}", username);
+                    for (SessionInformation sessionsInformation : sessionsInformations) {
+                        sessionsInformation.expireNow();
+                        sessionPersistentRegistry.expireSession(sessionsInformation.getSessionId());
+                    }
+                }
+
+                // Redirect to logout if credentials are invalid
+                if (!isUserExists && notSsoLogin) {
+                    response.sendRedirect(request.getContextPath() + "/logout?badCredentials=true");
+                    return;
+                }
+                if (isUserDisabled) {
+                    response.sendRedirect(request.getContextPath() + "/logout?userIsDisabled=true");
+                    return;
+                }
+            }
+        }
+
+        filterChain.doFilter(request, response);
+    }
+
+    private enum LoginMethod {
+        USERDETAILS("UserDetails"),
+        OAUTH2USER("OAuth2User"),
+        STRINGUSER("StringUser"),
+        UNKNOWN("Unknown"),
+        SAML2USER("Saml2User");
+
+        private String method;
+
+        LoginMethod(String method) {
+            this.method = method;
+        }
+
+        @Override
+        public String toString() {
+            return method;
+        }
+    }
+
+    @Override
+    protected boolean shouldNotFilter(HttpServletRequest request) throws ServletException {
+        String uri = request.getRequestURI();
+        String contextPath = request.getContextPath();
+        String[] permitAllPatterns = {
+            contextPath + "/login",
+            contextPath + "/register",
+            contextPath + "/error",
+            contextPath + "/images/",
+            contextPath + "/public/",
+            contextPath + "/css/",
+            contextPath + "/fonts/",
+            contextPath + "/js/",
+            contextPath + "/pdfjs/",
+            contextPath + "/pdfjs-legacy/",
+            contextPath + "/api/v1/info/status",
+            contextPath + "/site.webmanifest"
+        };
+
+        for (String pattern : permitAllPatterns) {
+            if (uri.startsWith(pattern)
+                    || uri.endsWith(".svg")
+                    || uri.endsWith(".png")
+                    || uri.endsWith(".ico")) {
+                return true;
+            }
+        }
+
+        return false;
+    }
+}

proprietary/src/main/java/stirling/software/proprietary/security/filter/UserBasedRateLimitingFilter.java

@@ -0,0 +1,144 @@
+package stirling.software.proprietary.security.filter;
+
+import io.github.bucket4j.Bandwidth;
+import io.github.bucket4j.Bucket;
+import io.github.bucket4j.ConsumptionProbe;
+import io.github.pixee.security.Newlines;
+import jakarta.servlet.FilterChain;
+import jakarta.servlet.ServletException;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+import java.io.IOException;
+import java.time.Duration;
+import java.util.Map;
+import java.util.concurrent.ConcurrentHashMap;
+import org.springframework.beans.factory.annotation.Qualifier;
+import org.springframework.http.HttpStatus;
+import org.springframework.security.core.Authentication;
+import org.springframework.security.core.GrantedAuthority;
+import org.springframework.security.core.context.SecurityContextHolder;
+import org.springframework.security.core.userdetails.UserDetails;
+import org.springframework.stereotype.Component;
+import org.springframework.web.filter.OncePerRequestFilter;
+import stirling.software.common.model.enumeration.Role;
+
+@Component
+public class UserBasedRateLimitingFilter extends OncePerRequestFilter {
+
+    private final Map<String, Bucket> apiBuckets = new ConcurrentHashMap<>();
+
+    private final Map<String, Bucket> webBuckets = new ConcurrentHashMap<>();
+
+    @Qualifier("rateLimit")
+    private final boolean rateLimit;
+
+    public UserBasedRateLimitingFilter(@Qualifier("rateLimit") boolean rateLimit) {
+        this.rateLimit = rateLimit;
+    }
+
+    @Override
+    protected void doFilterInternal(
+            HttpServletRequest request, HttpServletResponse response, FilterChain filterChain)
+            throws ServletException, IOException {
+        if (!rateLimit) {
+            // If rateLimit is not enabled, just pass all requests without rate limiting
+            filterChain.doFilter(request, response);
+            return;
+        }
+        String method = request.getMethod();
+        if (!"POST".equalsIgnoreCase(method)) {
+            // If the request is not a POST, just pass it through without rate limiting
+            filterChain.doFilter(request, response);
+            return;
+        }
+        String identifier = null;
+        // Check for API key in the request headers
+        String apiKey = request.getHeader("X-API-KEY");
+        if (apiKey != null && !apiKey.trim().isEmpty()) {
+            identifier = // Prefix to distinguish between API keys and usernames
+                    "API_KEY_" + apiKey;
+        } else {
+            Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
+            if (authentication != null && authentication.isAuthenticated()) {
+                UserDetails userDetails = (UserDetails) authentication.getPrincipal();
+                identifier = userDetails.getUsername();
+            }
+        }
+        // If neither API key nor an authenticated user is present, use IP address
+        if (identifier == null) {
+            identifier = request.getRemoteAddr();
+        }
+        Role userRole =
+                getRoleFromAuthentication(SecurityContextHolder.getContext().getAuthentication());
+        if (request.getHeader("X-API-KEY") != null) {
+            // It's an API call
+            processRequest(
+                    userRole.getApiCallsPerDay(),
+                    identifier,
+                    apiBuckets,
+                    request,
+                    response,
+                    filterChain);
+        } else {
+            // It's a Web UI call
+            processRequest(
+                    userRole.getWebCallsPerDay(),
+                    identifier,
+                    webBuckets,
+                    request,
+                    response,
+                    filterChain);
+        }
+    }
+
+    private Role getRoleFromAuthentication(Authentication authentication) {
+        if (authentication != null && authentication.isAuthenticated()) {
+            for (GrantedAuthority authority : authentication.getAuthorities()) {
+                try {
+                    return Role.fromString(authority.getAuthority());
+                } catch (IllegalArgumentException ex) {
+                    // Ignore and continue to next authority.
+                }
+            }
+        }
+        throw new IllegalStateException("User does not have a valid role.");
+    }
+
+    private void processRequest(
+            int limitPerDay,
+            String identifier,
+            Map<String, Bucket> buckets,
+            HttpServletRequest request,
+            HttpServletResponse response,
+            FilterChain filterChain)
+            throws IOException, ServletException {
+        Bucket userBucket = buckets.computeIfAbsent(identifier, k -> createUserBucket(limitPerDay));
+        ConsumptionProbe probe = userBucket.tryConsumeAndReturnRemaining(1);
+        if (probe.isConsumed()) {
+            response.setHeader(
+                    "X-Rate-Limit-Remaining",
+                    stripNewlines(Newlines.stripAll(Long.toString(probe.getRemainingTokens()))));
+            filterChain.doFilter(request, response);
+        } else {
+            long waitForRefill = probe.getNanosToWaitForRefill() / 1_000_000_000;
+            response.setStatus(HttpStatus.TOO_MANY_REQUESTS.value());
+            response.setHeader(
+                    "X-Rate-Limit-Retry-After-Seconds",
+                    Newlines.stripAll(String.valueOf(waitForRefill)));
+            response.getWriter().write("Rate limit exceeded for POST requests.");
+        }
+    }
+
+    private Bucket createUserBucket(int limitPerDay) {
+        Bandwidth limit =
+                Bandwidth.builder()
+                        .capacity(limitPerDay)
+                        .refillIntervally(limitPerDay, Duration.ofDays(1))
+                        .build();
+        return Bucket.builder().addLimit(limit).build();
+    }
+
+    private static String stripNewlines(final String s) {
+        return s.replaceAll("[\n\r]", "");
+    }
+}

proprietary/src/main/java/stirling/software/proprietary/security/model/ApiKeyAuthenticationToken.java

@@ -0,0 +1,52 @@
+package stirling.software.proprietary.security.model;
+
+import java.util.Collection;
+
+import org.springframework.security.authentication.AbstractAuthenticationToken;
+import org.springframework.security.core.GrantedAuthority;
+
+public class ApiKeyAuthenticationToken extends AbstractAuthenticationToken {
+
+    private final Object principal;
+    private Object credentials;
+
+    public ApiKeyAuthenticationToken(String apiKey) {
+        super(null);
+        this.principal = null;
+        this.credentials = apiKey;
+        setAuthenticated(false);
+    }
+
+    public ApiKeyAuthenticationToken(
+            Object principal, String apiKey, Collection<? extends GrantedAuthority> authorities) {
+        super(authorities);
+        this.principal = principal; // principal can be a UserDetails object
+        this.credentials = apiKey;
+        super.setAuthenticated(true); // this authentication is trusted
+    }
+
+    @Override
+    public Object getCredentials() {
+        return credentials;
+    }
+
+    @Override
+    public Object getPrincipal() {
+        return principal;
+    }
+
+    @Override
+    public void setAuthenticated(boolean isAuthenticated) throws IllegalArgumentException {
+        if (isAuthenticated) {
+            throw new IllegalArgumentException(
+                    "Cannot set this token to trusted. Use constructor which takes a GrantedAuthority list instead.");
+        }
+        super.setAuthenticated(false);
+    }
+
+    @Override
+    public void eraseCredentials() {
+        super.eraseCredentials();
+        credentials = null;
+    }
+}

proprietary/src/main/java/stirling/software/proprietary/security/model/AttemptCounter.java

@@ -0,0 +1,33 @@
+package stirling.software.proprietary.security.model;
+
+public class AttemptCounter {
+    private int attemptCount;
+    private long lastAttemptTime;
+
+    public AttemptCounter() {
+        this.attemptCount = 0;
+        this.lastAttemptTime = System.currentTimeMillis();
+    }
+
+    public void increment() {
+        this.attemptCount++;
+        this.lastAttemptTime = System.currentTimeMillis();
+    }
+
+    public int getAttemptCount() {
+        return attemptCount;
+    }
+
+    public long getLastAttemptTime() {
+        return lastAttemptTime;
+    }
+
+    public boolean shouldReset(long attemptIncrementTime) {
+        return System.currentTimeMillis() - lastAttemptTime > attemptIncrementTime;
+    }
+
+    public void reset() {
+        this.attemptCount = 0;
+        this.lastAttemptTime = System.currentTimeMillis();
+    }
+}

proprietary/src/main/java/stirling/software/proprietary/security/model/AuthenticationType.java

@@ -0,0 +1,6 @@
+package stirling.software.proprietary.security.model;
+
+public enum AuthenticationType {
+    WEB,
+    SSO
+}

proprietary/src/main/java/stirling/software/proprietary/security/model/Authority.java

@@ -0,0 +1,43 @@
+package stirling.software.proprietary.security.model;
+
+import java.io.Serializable;
+
+import jakarta.persistence.Column;
+import jakarta.persistence.Entity;
+import jakarta.persistence.GeneratedValue;
+import jakarta.persistence.GenerationType;
+import jakarta.persistence.Id;
+import jakarta.persistence.JoinColumn;
+import jakarta.persistence.ManyToOne;
+import jakarta.persistence.Table;
+
+import lombok.Getter;
+import lombok.Setter;
+
+@Entity
+@Table(name = "authorities")
+@Getter
+@Setter
+public class Authority implements Serializable {
+
+    private static final long serialVersionUID = 1L;
+
+    @Id
+    @GeneratedValue(strategy = GenerationType.IDENTITY)
+    private Long id;
+
+    @Column(name = "authority")
+    private String authority;
+
+    @ManyToOne
+    @JoinColumn(name = "user_id")
+    private User user;
+
+    public Authority() {}
+
+    public Authority(String authority, User user) {
+        this.authority = authority;
+        this.user = user;
+        user.getAuthorities().add(this);
+    }
+}

proprietary/src/main/java/stirling/software/proprietary/security/model/PersistentLogin.java

@@ -0,0 +1,29 @@
+package stirling.software.proprietary.security.model;
+
+import java.util.Date;
+
+import jakarta.persistence.Column;
+import jakarta.persistence.Entity;
+import jakarta.persistence.Id;
+import jakarta.persistence.Table;
+
+import lombok.Data;
+
+@Entity
+@Table(name = "persistent_logins")
+@Data
+public class PersistentLogin {
+
+    @Id
+    @Column(name = "series")
+    private String series;
+
+    @Column(name = "username", length = 64, nullable = false)
+    private String username;
+
+    @Column(name = "token", length = 64, nullable = false)
+    private String token;
+
+    @Column(name = "last_used", nullable = false)
+    private Date lastUsed;
+}

proprietary/src/main/java/stirling/software/proprietary/security/model/SessionEntity.java

@@ -0,0 +1,23 @@
+package stirling.software.proprietary.security.model;
+
+import java.io.Serializable;
+import java.util.Date;
+
+import jakarta.persistence.Entity;
+import jakarta.persistence.Id;
+import jakarta.persistence.Table;
+
+import lombok.Data;
+
+@Entity
+@Data
+@Table(name = "sessions")
+public class SessionEntity implements Serializable {
+    @Id private String sessionId;
+
+    private String principalName;
+
+    private Date lastRequest;
+
+    private boolean expired;
+}

proprietary/src/main/java/stirling/software/proprietary/security/model/User.java

@@ -0,0 +1,99 @@
+package stirling.software.proprietary.security.model;
+
+import java.io.Serializable;
+import java.util.HashMap;
+import java.util.HashSet;
+import java.util.Map;
+import java.util.Set;
+import java.util.stream.Collectors;
+
+import jakarta.persistence.*;
+
+import lombok.EqualsAndHashCode;
+import lombok.Getter;
+import lombok.NoArgsConstructor;
+import lombok.Setter;
+import lombok.ToString;
+import stirling.software.common.model.enumeration.Role;
+
+@Entity
+@Table(name = "users")
+@NoArgsConstructor
+@Getter
+@Setter
+@EqualsAndHashCode(onlyExplicitlyIncluded = true)
+@ToString(onlyExplicitlyIncluded = true)
+public class User implements Serializable {
+
+    private static final long serialVersionUID = 1L;
+
+    @Id
+    @GeneratedValue(strategy = GenerationType.IDENTITY)
+    @Column(name = "user_id")
+    private Long id;
+
+    @Column(name = "username", unique = true)
+    private String username;
+
+    @Column(name = "password")
+    private String password;
+
+    @Column(name = "apiKey")
+    private String apiKey;
+
+    @Column(name = "enabled")
+    private boolean enabled;
+
+    @Column(name = "isFirstLogin")
+    private Boolean isFirstLogin = false;
+
+    @Column(name = "roleName")
+    private String roleName;
+
+    @Column(name = "authenticationtype")
+    private String authenticationType;
+
+    @OneToMany(fetch = FetchType.EAGER, cascade = CascadeType.ALL, mappedBy = "user")
+    private Set<Authority> authorities = new HashSet<>();
+
+    @ElementCollection
+    @MapKeyColumn(name = "setting_key")
+    @Lob
+    @Column(name = "setting_value", columnDefinition = "text")
+    @CollectionTable(name = "user_settings", joinColumns = @JoinColumn(name = "user_id"))
+    private Map<String, String> settings = new HashMap<>(); // Key-value pairs of settings.
+
+    public String getRoleName() {
+        return Role.getRoleNameByRoleId(getRolesAsString());
+    }
+
+    public boolean isFirstLogin() {
+        return isFirstLogin != null && isFirstLogin;
+    }
+
+    public void setFirstLogin(boolean isFirstLogin) {
+        this.isFirstLogin = isFirstLogin;
+    }
+
+    public void setAuthenticationType(AuthenticationType authenticationType) {
+        this.authenticationType = authenticationType.toString().toLowerCase();
+    }
+
+    public void addAuthorities(Set<Authority> authorities) {
+        this.authorities.addAll(authorities);
+    }
+
+    public void addAuthority(Authority authority) {
+        this.authorities.add(authority);
+    }
+
+    public String getRolesAsString() {
+        return this.authorities.stream()
+                .map(Authority::getAuthority)
+                .collect(Collectors.joining(", "));
+    }
+
+    public boolean hasPassword() {
+        return this.password != null && !this.password.isEmpty();
+    }
+}

proprietary/src/main/java/stirling/software/proprietary/security/model/api/Email.java

@@ -0,0 +1,39 @@
+package stirling.software.proprietary.security.model.api;
+
+import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
+
+import io.swagger.v3.oas.annotations.media.Schema;
+
+import lombok.Data;
+import lombok.EqualsAndHashCode;
+import lombok.NoArgsConstructor;
+import stirling.software.common.model.api.GeneralFile;
+
+@Data
+@NoArgsConstructor
+@EqualsAndHashCode(callSuper = true)
+@ConditionalOnProperty(value = "mail.enabled", havingValue = "true", matchIfMissing = false)
+public class Email extends GeneralFile {
+
+    @Schema(
+            description = "The recipient's email address",
+            requiredMode = Schema.RequiredMode.REQUIRED,
+            format = "email")
+    private String to;
+
+    @Schema(
+            description = "The subject of the email",
+            defaultValue = "Stirling Software PDF Notification",
+            requiredMode = Schema.RequiredMode.NOT_REQUIRED)
+    private String subject;
+
+    @Schema(
+            description = "The body of the email",
+            requiredMode = Schema.RequiredMode.NOT_REQUIRED,
+            defaultValue =
+                    "This message was automatically generated by Stirling-PDF, an innovative"
+                            + " solution from Stirling Software. For more information, visit our <a"
+                            + " href=\"https://stirling-software.com\">website</a>.<br><br>Please do"
+                            + " not reply directly to this email.")
+    private String body;
+}

proprietary/src/main/java/stirling/software/proprietary/security/model/api/user/UpdateUserDetails.java

@@ -0,0 +1,17 @@
+package stirling.software.proprietary.security.model.api.user;
+
+import io.swagger.v3.oas.annotations.media.Schema;
+
+import lombok.Data;
+import lombok.EqualsAndHashCode;
+
+@Data
+@EqualsAndHashCode(callSuper = true)
+public class UpdateUserDetails extends UpdateUserUsername {
+
+    @Schema(
+            description = "new password for user",
+            format = "password",
+            requiredMode = Schema.RequiredMode.REQUIRED)
+    private String newPassword;
+}

proprietary/src/main/java/stirling/software/proprietary/security/model/api/user/UpdateUserUsername.java

@@ -0,0 +1,14 @@
+package stirling.software.proprietary.security.model.api.user;
+
+import io.swagger.v3.oas.annotations.media.Schema;
+
+import lombok.Data;
+import lombok.EqualsAndHashCode;
+
+@Data
+@EqualsAndHashCode(callSuper = true)
+public class UpdateUserUsername extends UsernameAndPass {
+
+    @Schema(description = "new username for user")
+    private String newUsername;
+}

proprietary/src/main/java/stirling/software/proprietary/security/model/api/user/Username.java

@@ -0,0 +1,14 @@
+package stirling.software.proprietary.security.model.api.user;
+
+import io.swagger.v3.oas.annotations.media.Schema;
+
+import lombok.Data;
+import lombok.EqualsAndHashCode;
+
+@Data
+@EqualsAndHashCode
+public class Username {
+
+    @Schema(description = "username of user", requiredMode = Schema.RequiredMode.REQUIRED)
+    private String username;
+}

proprietary/src/main/java/stirling/software/proprietary/security/model/api/user/UsernameAndPass.java

@@ -0,0 +1,14 @@
+package stirling.software.proprietary.security.model.api.user;
+
+import io.swagger.v3.oas.annotations.media.Schema;
+
+import lombok.Data;
+import lombok.EqualsAndHashCode;
+
+@Data
+@EqualsAndHashCode(callSuper = true)
+public class UsernameAndPass extends Username {
+
+    @Schema(description = "password of user", format = "password")
+    private String password;
+}

proprietary/src/main/java/stirling/software/proprietary/security/model/exception/BackupNotFoundException.java

@@ -0,0 +1,7 @@
+package stirling.software.proprietary.security.model.exception;
+
+public class BackupNotFoundException extends RuntimeException {
+    public BackupNotFoundException(String message) {
+        super(message);
+    }
+}

proprietary/src/main/java/stirling/software/proprietary/security/model/exception/NoProviderFoundException.java

@@ -0,0 +1,11 @@
+package stirling.software.proprietary.security.model.exception;
+
+public class NoProviderFoundException extends Exception {
+    public NoProviderFoundException(String message) {
+        super(message);
+    }
+
+    public NoProviderFoundException(String message, Throwable cause) {
+        super(message, cause);
+    }
+}

proprietary/src/main/java/stirling/software/proprietary/security/oauth2/CustomOAuth2AuthenticationFailureHandler.java

@@ -0,0 +1,60 @@
+package stirling.software.proprietary.security.oauth2;
+
+import jakarta.servlet.ServletException;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+import java.io.IOException;
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.security.authentication.BadCredentialsException;
+import org.springframework.security.authentication.DisabledException;
+import org.springframework.security.authentication.LockedException;
+import org.springframework.security.core.AuthenticationException;
+import org.springframework.security.oauth2.core.OAuth2AuthenticationException;
+import org.springframework.security.oauth2.core.OAuth2Error;
+import org.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler;
+
+@Slf4j
+public class CustomOAuth2AuthenticationFailureHandler
+        extends SimpleUrlAuthenticationFailureHandler {
+
+    @Override
+    public void onAuthenticationFailure(
+            HttpServletRequest request,
+            HttpServletResponse response,
+            AuthenticationException exception)
+            throws IOException, ServletException {
+
+        if (exception instanceof BadCredentialsException) {
+            log.error("BadCredentialsException", exception);
+            getRedirectStrategy().sendRedirect(request, response, "/login?error=badCredentials");
+            return;
+        }
+        if (exception instanceof DisabledException) {
+            log.error("User is deactivated: ", exception);
+            getRedirectStrategy().sendRedirect(request, response, "/logout?userIsDisabled=true");
+            return;
+        }
+        if (exception instanceof LockedException) {
+            log.error("Account locked: ", exception);
+            getRedirectStrategy().sendRedirect(request, response, "/logout?error=locked");
+            return;
+        }
+        if (exception instanceof OAuth2AuthenticationException oAuth2Exception) {
+            OAuth2Error error = oAuth2Exception.getError();
+
+            String errorCode = error.getErrorCode();
+
+            if ("Password must not be null".equals(error.getErrorCode())) {
+                errorCode = "userAlreadyExistsWeb";
+            }
+
+            log.error(
+                    "OAuth2 Authentication error: {}",
+                    errorCode != null ? errorCode : exception.getMessage(),
+                    exception);
+            getRedirectStrategy().sendRedirect(request, response, "/login?errorOAuth=" + errorCode);
+        }
+        log.error("Unhandled authentication exception", exception);
+        super.onAuthenticationFailure(request, response, exception);
+    }
+}

proprietary/src/main/java/stirling/software/proprietary/security/oauth2/CustomOAuth2AuthenticationSuccessHandler.java

@@ -0,0 +1,97 @@
+package stirling.software.proprietary.security.oauth2;
+
+import jakarta.servlet.ServletException;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+import jakarta.servlet.http.HttpSession;
+import java.io.IOException;
+import java.sql.SQLException;
+import lombok.RequiredArgsConstructor;
+import org.springframework.security.authentication.LockedException;
+import org.springframework.security.core.Authentication;
+import org.springframework.security.core.userdetails.UserDetails;
+import org.springframework.security.oauth2.core.user.OAuth2User;
+import org.springframework.security.web.authentication.SavedRequestAwareAuthenticationSuccessHandler;
+import org.springframework.security.web.savedrequest.SavedRequest;
+import stirling.software.common.model.ApplicationProperties;
+import stirling.software.common.model.ApplicationProperties.Security.OAUTH2;
+import stirling.software.common.model.exception.UnsupportedProviderException;
+import stirling.software.common.util.RequestUriUtils;
+import stirling.software.proprietary.security.model.AuthenticationType;
+import stirling.software.proprietary.security.service.LoginAttemptService;
+import stirling.software.proprietary.security.service.UserService;
+
+@RequiredArgsConstructor
+public class CustomOAuth2AuthenticationSuccessHandler
+        extends SavedRequestAwareAuthenticationSuccessHandler {
+
+    private final LoginAttemptService loginAttemptService;
+    private final ApplicationProperties applicationProperties;
+    private final UserService userService;
+
+    @Override
+    public void onAuthenticationSuccess(
+            HttpServletRequest request, HttpServletResponse response, Authentication authentication)
+            throws ServletException, IOException {
+
+        Object principal = authentication.getPrincipal();
+        String username = "";
+
+        if (principal instanceof OAuth2User oAuth2User) {
+            username = oAuth2User.getName();
+        } else if (principal instanceof UserDetails detailsUser) {
+            username = detailsUser.getUsername();
+        }
+
+        // Get the saved request
+        HttpSession session = request.getSession(false);
+        String contextPath = request.getContextPath();
+        SavedRequest savedRequest =
+                (session != null)
+                        ? (SavedRequest) session.getAttribute("SPRING_SECURITY_SAVED_REQUEST")
+                        : null;
+
+        if (savedRequest != null
+                && !RequestUriUtils.isStaticResource(contextPath, savedRequest.getRedirectUrl())) {
+            // Redirect to the original destination
+            super.onAuthenticationSuccess(request, response, authentication);
+        } else {
+            OAUTH2 oAuth = applicationProperties.getSecurity().getOauth2();
+
+            if (loginAttemptService.isBlocked(username)) {
+                if (session != null) {
+                    session.removeAttribute("SPRING_SECURITY_SAVED_REQUEST");
+                }
+                throw new LockedException(
+                        "Your account has been locked due to too many failed login attempts.");
+            }
+
+            if (userService.isUserDisabled(username)) {
+                getRedirectStrategy()
+                        .sendRedirect(request, response, "/logout?userIsDisabled=true");
+                return;
+            }
+            if (userService.usernameExistsIgnoreCase(username)
+                    && userService.hasPassword(username)
+                    && !userService.isAuthenticationTypeByUsername(username, AuthenticationType.SSO)
+                    && oAuth.getAutoCreateUser()) {
+                response.sendRedirect(contextPath + "/logout?oAuth2AuthenticationErrorWeb=true");
+                return;
+            }
+
+            try {
+                if (oAuth.getBlockRegistration()
+                        && !userService.usernameExistsIgnoreCase(username)) {
+                    response.sendRedirect(contextPath + "/logout?oAuth2AdminBlockedUser=true");
+                    return;
+                }
+                if (principal instanceof OAuth2User) {
+                    userService.processSSOPostLogin(username, oAuth.getAutoCreateUser());
+                }
+                response.sendRedirect(contextPath + "/");
+            } catch (IllegalArgumentException | SQLException | UnsupportedProviderException e) {
+                response.sendRedirect(contextPath + "/logout?invalidUsername=true");
+            }
+        }
+    }
+}

proprietary/src/main/java/stirling/software/proprietary/security/oauth2/OAuth2Configuration.java

@@ -0,0 +1,251 @@
+package stirling.software.proprietary.security.oauth2;
+
+import java.util.ArrayList;
+import java.util.HashSet;
+import java.util.List;
+import java.util.Optional;
+import java.util.Set;
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.boot.autoconfigure.condition.ConditionalOnExpression;
+import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.context.annotation.Lazy;
+import org.springframework.security.core.GrantedAuthority;
+import org.springframework.security.core.authority.SimpleGrantedAuthority;
+import org.springframework.security.core.authority.mapping.GrantedAuthoritiesMapper;
+import org.springframework.security.oauth2.client.registration.ClientRegistration;
+import org.springframework.security.oauth2.client.registration.ClientRegistrationRepository;
+import org.springframework.security.oauth2.client.registration.ClientRegistrations;
+import org.springframework.security.oauth2.client.registration.InMemoryClientRegistrationRepository;
+import org.springframework.security.oauth2.core.user.OAuth2UserAuthority;
+import stirling.software.common.model.ApplicationProperties;
+import stirling.software.common.model.ApplicationProperties.Security.OAUTH2;
+import stirling.software.common.model.ApplicationProperties.Security.OAUTH2.Client;
+import stirling.software.common.model.enumeration.UsernameAttribute;
+import stirling.software.proprietary.security.model.exception.NoProviderFoundException;
+import stirling.software.common.model.oauth2.GitHubProvider;
+import stirling.software.common.model.oauth2.GoogleProvider;
+import stirling.software.common.model.oauth2.KeycloakProvider;
+import stirling.software.common.model.oauth2.Provider;
+import stirling.software.proprietary.security.model.User;
+import stirling.software.proprietary.security.service.UserService;
+import static org.springframework.security.oauth2.core.AuthorizationGrantType.AUTHORIZATION_CODE;
+import static stirling.software.common.util.ProviderUtils.validateProvider;
+import static stirling.software.common.util.ValidationUtils.isStringEmpty;
+
+@Slf4j
+@Configuration
+@ConditionalOnProperty(value = "security.oauth2.enabled", havingValue = "true")
+@ConditionalOnExpression("${docker.enable.security:true}") // todo: change this
+public class OAuth2Configuration {
+
+    public static final String REDIRECT_URI_PATH = "{baseUrl}/login/oauth2/code/";
+
+    private final ApplicationProperties applicationProperties;
+    @Lazy private final UserService userService;
+
+    public OAuth2Configuration(
+            ApplicationProperties applicationProperties, @Lazy UserService userService) {
+        this.userService = userService;
+        this.applicationProperties = applicationProperties;
+    }
+
+    @Bean
+    @ConditionalOnProperty(value = "security.oauth2.enabled", havingValue = "true")
+    public ClientRegistrationRepository clientRegistrationRepository()
+            throws NoProviderFoundException {
+        List<ClientRegistration> registrations = new ArrayList<>();
+        githubClientRegistration().ifPresent(registrations::add);
+        oidcClientRegistration().ifPresent(registrations::add);
+        googleClientRegistration().ifPresent(registrations::add);
+        keycloakClientRegistration().ifPresent(registrations::add);
+
+        if (registrations.isEmpty()) {
+            log.error("No OAuth2 provider registered");
+            throw new NoProviderFoundException("At least one OAuth2 provider must be configured.");
+        }
+
+        return new InMemoryClientRegistrationRepository(registrations);
+    }
+
+    private Optional<ClientRegistration> keycloakClientRegistration() {
+        OAUTH2 oauth2 = applicationProperties.getSecurity().getOauth2();
+
+        if (isOAuth2Enabled(oauth2) || isClientInitialised(oauth2)) {
+            return Optional.empty();
+        }
+
+        Client client = oauth2.getClient();
+        KeycloakProvider keycloakClient = client.getKeycloak();
+        Provider keycloak =
+                new KeycloakProvider(
+                        keycloakClient.getIssuer(),
+                        keycloakClient.getClientId(),
+                        keycloakClient.getClientSecret(),
+                        keycloakClient.getScopes(),
+                        keycloakClient.getUseAsUsername());
+
+        return validateProvider(keycloak)
+                ? Optional.of(
+                        ClientRegistrations.fromIssuerLocation(keycloak.getIssuer())
+                                .registrationId(keycloak.getName())
+                                .clientId(keycloak.getClientId())
+                                .clientSecret(keycloak.getClientSecret())
+                                .scope(keycloak.getScopes())
+                                .userNameAttributeName(keycloak.getUseAsUsername().getName())
+                                .clientName(keycloak.getClientName())
+                                .build())
+                : Optional.empty();
+    }
+
+    private Optional<ClientRegistration> googleClientRegistration() {
+        OAUTH2 oAuth2 = applicationProperties.getSecurity().getOauth2();
+
+        if (isOAuth2Enabled(oAuth2) || isClientInitialised(oAuth2)) {
+            return Optional.empty();
+        }
+
+        Client client = oAuth2.getClient();
+        GoogleProvider googleClient = client.getGoogle();
+        Provider google =
+                new GoogleProvider(
+                        googleClient.getClientId(),
+                        googleClient.getClientSecret(),
+                        googleClient.getScopes(),
+                        googleClient.getUseAsUsername());
+
+        return validateProvider(google)
+                ? Optional.of(
+                        ClientRegistration.withRegistrationId(google.getName())
+                                .clientId(google.getClientId())
+                                .clientSecret(google.getClientSecret())
+                                .scope(google.getScopes())
+                                .authorizationUri(google.getAuthorizationUri())
+                                .tokenUri(google.getTokenUri())
+                                .userInfoUri(google.getUserInfoUri())
+                                .userNameAttributeName(google.getUseAsUsername().getName())
+                                .clientName(google.getClientName())
+                                .redirectUri(REDIRECT_URI_PATH + google.getName())
+                                .authorizationGrantType(AUTHORIZATION_CODE)
+                                .build())
+                : Optional.empty();
+    }
+
+    private Optional<ClientRegistration> githubClientRegistration() {
+        OAUTH2 oAuth2 = applicationProperties.getSecurity().getOauth2();
+
+        if (isOAuth2Enabled(oAuth2)) {
+            return Optional.empty();
+        }
+
+        Client client = oAuth2.getClient();
+        GitHubProvider githubClient = client.getGithub();
+        Provider github =
+                new GitHubProvider(
+                        githubClient.getClientId(),
+                        githubClient.getClientSecret(),
+                        githubClient.getScopes(),
+                        githubClient.getUseAsUsername());
+
+        return validateProvider(github)
+                ? Optional.of(
+                        ClientRegistration.withRegistrationId(github.getName())
+                                .clientId(github.getClientId())
+                                .clientSecret(github.getClientSecret())
+                                .scope(github.getScopes())
+                                .authorizationUri(github.getAuthorizationUri())
+                                .tokenUri(github.getTokenUri())
+                                .userInfoUri(github.getUserInfoUri())
+                                .userNameAttributeName(github.getUseAsUsername().getName())
+                                .clientName(github.getClientName())
+                                .redirectUri(REDIRECT_URI_PATH + github.getName())
+                                .authorizationGrantType(AUTHORIZATION_CODE)
+                                .build())
+                : Optional.empty();
+    }
+
+    private Optional<ClientRegistration> oidcClientRegistration() {
+        OAUTH2 oauth = applicationProperties.getSecurity().getOauth2();
+
+        if (isOAuth2Enabled(oauth) || isClientInitialised(oauth)) {
+            return Optional.empty();
+        }
+
+        String name = oauth.getProvider();
+        String firstChar = String.valueOf(name.charAt(0));
+        String clientName = name.replaceFirst(firstChar, firstChar.toUpperCase());
+
+        Provider oidcProvider =
+                new Provider(
+                        oauth.getIssuer(),
+                        name,
+                        clientName,
+                        oauth.getClientId(),
+                        oauth.getClientSecret(),
+                        oauth.getScopes(),
+                        UsernameAttribute.valueOf(oauth.getUseAsUsername().toUpperCase()),
+                        null,
+                        null,
+                        null);
+
+        return !isStringEmpty(oidcProvider.getIssuer()) || validateProvider(oidcProvider)
+                ? Optional.of(
+                        ClientRegistrations.fromIssuerLocation(oauth.getIssuer())
+                                .registrationId(name)
+                                .clientId(oidcProvider.getClientId())
+                                .clientSecret(oidcProvider.getClientSecret())
+                                .scope(oidcProvider.getScopes())
+                                .userNameAttributeName(oidcProvider.getUseAsUsername().getName())
+                                .clientName(clientName)
+                                .redirectUri(REDIRECT_URI_PATH + "oidc")
+                                .authorizationGrantType(AUTHORIZATION_CODE)
+                                .build())
+                : Optional.empty();
+    }
+
+    private boolean isOAuth2Enabled(OAUTH2 oAuth2) {
+        return oAuth2 == null || !oAuth2.getEnabled();
+    }
+
+    private boolean isClientInitialised(OAUTH2 oauth2) {
+        Client client = oauth2.getClient();
+        return client == null;
+    }
+
+    /*
+    This following function is to grant Authorities to the OAUTH2 user from the values stored in the database.
+    This is required for the internal; 'hasRole()' function to give out the correct role.
+     */
+
+    @Bean
+    @ConditionalOnProperty(value = "security.oauth2.enabled", havingValue = "true")
+    GrantedAuthoritiesMapper userAuthoritiesMapper() {
+        return (authorities) -> {
+            Set<GrantedAuthority> mappedAuthorities = new HashSet<>();
+            authorities.forEach(
+                    authority -> {
+                        // Add existing OAUTH2 Authorities
+                        mappedAuthorities.add(new SimpleGrantedAuthority(authority.getAuthority()));
+                        // Add Authorities from database for existing user, if user is present.
+                        if (authority instanceof OAuth2UserAuthority oAuth2Auth) {
+                            String useAsUsername =
+                                    applicationProperties
+                                            .getSecurity()
+                                            .getOauth2()
+                                            .getUseAsUsername();
+                            Optional<User> userOpt =
+                                    userService.findByUsernameIgnoreCase(
+                                            (String) oAuth2Auth.getAttributes().get(useAsUsername));
+                            if (userOpt.isPresent()) {
+                                User user = userOpt.get();
+                                mappedAuthorities.add(
+                                        new SimpleGrantedAuthority(
+                                                userService.findRole(user).getAuthority()));
+                            }
+                        }
+                    });
+            return mappedAuthorities;
+        };
+    }
+}

proprietary/src/main/java/stirling/software/proprietary/security/saml2/CertificateUtils.java

@@ -0,0 +1,55 @@
+package stirling.software.proprietary.security.saml2;
+
+import java.io.ByteArrayInputStream;
+import java.io.InputStreamReader;
+import java.nio.charset.StandardCharsets;
+import java.security.cert.CertificateFactory;
+import java.security.cert.X509Certificate;
+import java.security.interfaces.RSAPrivateKey;
+import org.bouncycastle.asn1.pkcs.PrivateKeyInfo;
+import org.bouncycastle.openssl.PEMKeyPair;
+import org.bouncycastle.openssl.PEMParser;
+import org.bouncycastle.openssl.jcajce.JcaPEMKeyConverter;
+import org.bouncycastle.util.io.pem.PemObject;
+import org.bouncycastle.util.io.pem.PemReader;
+import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
+import org.springframework.core.io.Resource;
+
+@ConditionalOnProperty(name = "security.saml2.enabled", havingValue = "true")
+public class CertificateUtils {
+
+    public static X509Certificate readCertificate(Resource certificateResource) throws Exception {
+        try (PemReader pemReader =
+                new PemReader(
+                        new InputStreamReader(
+                                certificateResource.getInputStream(), StandardCharsets.UTF_8))) {
+            PemObject pemObject = pemReader.readPemObject();
+            byte[] decodedCert = pemObject.getContent();
+            CertificateFactory cf = CertificateFactory.getInstance("X.509");
+            return (X509Certificate) cf.generateCertificate(new ByteArrayInputStream(decodedCert));
+        }
+    }
+
+    public static RSAPrivateKey readPrivateKey(Resource privateKeyResource) throws Exception {
+        try (PEMParser pemParser =
+                new PEMParser(
+                        new InputStreamReader(
+                                privateKeyResource.getInputStream(), StandardCharsets.UTF_8))) {
+
+            Object object = pemParser.readObject();
+            JcaPEMKeyConverter converter = new JcaPEMKeyConverter();
+
+            if (object instanceof PEMKeyPair keypair) {
+                // Handle traditional RSA private key format
+                return (RSAPrivateKey) converter.getPrivateKey(keypair.getPrivateKeyInfo());
+            } else if (object instanceof PrivateKeyInfo keyInfo) {
+                // Handle PKCS#8 format
+                return (RSAPrivateKey) converter.getPrivateKey(keyInfo);
+            } else {
+                throw new IllegalArgumentException(
+                        "Unsupported key format: "
+                                + (object != null ? object.getClass().getName() : "null"));
+            }
+        }
+    }
+}

proprietary/src/main/java/stirling/software/proprietary/security/saml2/CustomSaml2AuthenticatedPrincipal.java

@@ -0,0 +1,26 @@
+package stirling.software.proprietary.security.saml2;
+
+import java.io.Serializable;
+import java.util.List;
+import java.util.Map;
+import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
+import org.springframework.security.saml2.provider.service.authentication.Saml2AuthenticatedPrincipal;
+
+@ConditionalOnProperty(name = "security.saml2.enabled", havingValue = "true")
+public record CustomSaml2AuthenticatedPrincipal(
+        String name,
+        Map<String, List<Object>> attributes,
+        String nameId,
+        List<String> sessionIndexes)
+        implements Saml2AuthenticatedPrincipal, Serializable {
+
+    @Override
+    public String getName() {
+        return this.name;
+    }
+
+    @Override
+    public Map<String, List<Object>> getAttributes() {
+        return this.attributes;
+    }
+}

proprietary/src/main/java/stirling/software/proprietary/security/saml2/CustomSaml2AuthenticationFailureHandler.java

@@ -0,0 +1,38 @@
+package stirling.software.proprietary.security.saml2;
+
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+import java.io.IOException;
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
+import org.springframework.security.authentication.ProviderNotFoundException;
+import org.springframework.security.core.AuthenticationException;
+import org.springframework.security.saml2.core.Saml2Error;
+import org.springframework.security.saml2.provider.service.authentication.Saml2AuthenticationException;
+import org.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler;
+
+@Slf4j
+@ConditionalOnProperty(name = "security.saml2.enabled", havingValue = "true")
+public class CustomSaml2AuthenticationFailureHandler extends SimpleUrlAuthenticationFailureHandler {
+
+    @Override
+    public void onAuthenticationFailure(
+            HttpServletRequest request,
+            HttpServletResponse response,
+            AuthenticationException exception)
+            throws IOException {
+        log.error("Authentication error", exception);
+
+        if (exception instanceof Saml2AuthenticationException) {
+            Saml2Error error = ((Saml2AuthenticationException) exception).getSaml2Error();
+            getRedirectStrategy()
+                    .sendRedirect(request, response, "/login?errorOAuth=" + error.getErrorCode());
+        } else if (exception instanceof ProviderNotFoundException) {
+            getRedirectStrategy()
+                    .sendRedirect(
+                            request,
+                            response,
+                            "/login?errorOAuth=not_authentication_provider_found");
+        }
+    }
+}

proprietary/src/main/java/stirling/software/proprietary/security/saml2/CustomSaml2AuthenticationSuccessHandler.java

@@ -0,0 +1,123 @@
+package stirling.software.proprietary.security.saml2;
+
+import jakarta.servlet.ServletException;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+import jakarta.servlet.http.HttpSession;
+import java.io.IOException;
+import java.sql.SQLException;
+import lombok.AllArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.security.authentication.LockedException;
+import org.springframework.security.core.Authentication;
+import org.springframework.security.web.authentication.SavedRequestAwareAuthenticationSuccessHandler;
+import org.springframework.security.web.savedrequest.SavedRequest;
+import stirling.software.common.model.ApplicationProperties;
+import stirling.software.common.model.ApplicationProperties.Security.SAML2;
+import stirling.software.common.model.exception.UnsupportedProviderException;
+import stirling.software.common.util.RequestUriUtils;
+import stirling.software.proprietary.security.model.AuthenticationType;
+import stirling.software.proprietary.security.service.LoginAttemptService;
+import stirling.software.proprietary.security.service.UserService;
+
+@AllArgsConstructor
+@Slf4j
+public class CustomSaml2AuthenticationSuccessHandler
+        extends SavedRequestAwareAuthenticationSuccessHandler {
+
+    private LoginAttemptService loginAttemptService;
+    private ApplicationProperties applicationProperties;
+    private UserService userService;
+
+    @Override
+    public void onAuthenticationSuccess(
+            HttpServletRequest request, HttpServletResponse response, Authentication authentication)
+            throws ServletException, IOException {
+
+        Object principal = authentication.getPrincipal();
+        log.debug("Starting SAML2 authentication success handling");
+
+        if (principal instanceof CustomSaml2AuthenticatedPrincipal saml2Principal) {
+            String username = saml2Principal.name();
+            log.debug("Authenticated principal found for user: {}", username);
+
+            HttpSession session = request.getSession(false);
+            String contextPath = request.getContextPath();
+            SavedRequest savedRequest =
+                    (session != null)
+                            ? (SavedRequest) session.getAttribute("SPRING_SECURITY_SAVED_REQUEST")
+                            : null;
+
+            log.debug(
+                    "Session exists: {}, Saved request exists: {}",
+                    session != null,
+                    savedRequest != null);
+
+            if (savedRequest != null
+                    && !RequestUriUtils.isStaticResource(
+                            contextPath, savedRequest.getRedirectUrl())) {
+                log.debug(
+                        "Valid saved request found, redirecting to original destination: {}",
+                        savedRequest.getRedirectUrl());
+                super.onAuthenticationSuccess(request, response, authentication);
+            } else {
+                SAML2 saml2 = applicationProperties.getSecurity().getSaml2();
+                log.debug(
+                        "Processing SAML2 authentication with autoCreateUser: {}",
+                        saml2.getAutoCreateUser());
+
+                if (loginAttemptService.isBlocked(username)) {
+                    log.debug("User {} is blocked due to too many login attempts", username);
+                    if (session != null) {
+                        session.removeAttribute("SPRING_SECURITY_SAVED_REQUEST");
+                    }
+                    throw new LockedException(
+                            "Your account has been locked due to too many failed login attempts.");
+                }
+
+                boolean userExists = userService.usernameExistsIgnoreCase(username);
+                boolean hasPassword = userExists && userService.hasPassword(username);
+                boolean isSSOUser =
+                        userExists
+                                && userService.isAuthenticationTypeByUsername(
+                                        username, AuthenticationType.SSO);
+
+                log.debug(
+                        "User status - Exists: {}, Has password: {}, Is SSO user: {}",
+                        userExists,
+                        hasPassword,
+                        isSSOUser);
+
+                if (userExists && hasPassword && !isSSOUser && saml2.getAutoCreateUser()) {
+                    log.debug(
+                            "User {} exists with password but is not SSO user, redirecting to logout",
+                            username);
+                    response.sendRedirect(
+                            contextPath + "/logout?oAuth2AuthenticationErrorWeb=true");
+                    return;
+                }
+
+                try {
+                    if (saml2.getBlockRegistration() && !userExists) {
+                        log.debug("Registration blocked for new user: {}", username);
+                        response.sendRedirect(
+                                contextPath + "/login?errorOAuth=oAuth2AdminBlockedUser");
+                        return;
+                    }
+                    log.debug("Processing SSO post-login for user: {}", username);
+                    userService.processSSOPostLogin(username, saml2.getAutoCreateUser());
+                    log.debug("Successfully processed authentication for user: {}", username);
+                    response.sendRedirect(contextPath + "/");
+                } catch (IllegalArgumentException | SQLException | UnsupportedProviderException e) {
+                    log.debug(
+                            "Invalid username detected for user: {}, redirecting to logout",
+                            username);
+                    response.sendRedirect(contextPath + "/logout?invalidUsername=true");
+                }
+            }
+        } else {
+            log.debug("Non-SAML2 principal detected, delegating to parent handler");
+            super.onAuthenticationSuccess(request, response, authentication);
+        }
+    }
+}

proprietary/src/main/java/stirling/software/proprietary/security/saml2/CustomSaml2ResponseAuthenticationConverter.java

@@ -0,0 +1,115 @@
+package stirling.software.proprietary.security.saml2;
+
+import java.util.ArrayList;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.Optional;
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+import org.opensaml.core.xml.XMLObject;
+import org.opensaml.saml.saml2.core.Assertion;
+import org.opensaml.saml.saml2.core.Attribute;
+import org.opensaml.saml.saml2.core.AttributeStatement;
+import org.opensaml.saml.saml2.core.AuthnStatement;
+import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
+import org.springframework.core.convert.converter.Converter;
+import org.springframework.security.core.authority.SimpleGrantedAuthority;
+import org.springframework.security.saml2.provider.service.authentication.OpenSaml4AuthenticationProvider.ResponseToken;
+import org.springframework.security.saml2.provider.service.authentication.Saml2Authentication;
+import stirling.software.proprietary.security.model.User;
+import stirling.software.proprietary.security.service.UserService;
+
+@Slf4j
+@ConditionalOnProperty(name = "security.saml2.enabled", havingValue = "true")
+@RequiredArgsConstructor
+public class CustomSaml2ResponseAuthenticationConverter
+        implements Converter<ResponseToken, Saml2Authentication> {
+
+    private final UserService userService;
+
+    private Map<String, List<Object>> extractAttributes(Assertion assertion) {
+        Map<String, List<Object>> attributes = new HashMap<>();
+
+        for (AttributeStatement attributeStatement : assertion.getAttributeStatements()) {
+            for (Attribute attribute : attributeStatement.getAttributes()) {
+                String attributeName = attribute.getName();
+                List<Object> values = new ArrayList<>();
+
+                for (XMLObject xmlObject : attribute.getAttributeValues()) {
+                    // Get the text content directly
+                    String value = xmlObject.getDOM().getTextContent();
+                    if (value != null && !value.trim().isEmpty()) {
+                        values.add(value);
+                    }
+                }
+
+                if (!values.isEmpty()) {
+                    // Store with both full URI and last part of the URI
+                    attributes.put(attributeName, values);
+                    String shortName = attributeName.substring(attributeName.lastIndexOf('/') + 1);
+                    attributes.put(shortName, values);
+                }
+            }
+        }
+
+        return attributes;
+    }
+
+    @Override
+    public Saml2Authentication convert(ResponseToken responseToken) {
+        Assertion assertion = responseToken.getResponse().getAssertions().get(0);
+        Map<String, List<Object>> attributes = extractAttributes(assertion);
+
+        // Debug log with actual values
+        log.debug("Extracted SAML Attributes: {}", attributes);
+
+        // Try to get username/identifier in order of preference
+        String userIdentifier;
+        if (hasAttribute(attributes, "username")) {
+            userIdentifier = getFirstAttributeValue(attributes, "username");
+        } else if (hasAttribute(attributes, "emailaddress")) {
+            userIdentifier = getFirstAttributeValue(attributes, "emailaddress");
+        } else if (hasAttribute(attributes, "name")) {
+            userIdentifier = getFirstAttributeValue(attributes, "name");
+        } else if (hasAttribute(attributes, "upn")) {
+            userIdentifier = getFirstAttributeValue(attributes, "upn");
+        } else if (hasAttribute(attributes, "uid")) {
+            userIdentifier = getFirstAttributeValue(attributes, "uid");
+        } else {
+            userIdentifier = assertion.getSubject().getNameID().getValue();
+        }
+
+        // Rest of your existing code...
+        Optional<User> userOpt = userService.findByUsernameIgnoreCase(userIdentifier);
+        SimpleGrantedAuthority simpleGrantedAuthority = new SimpleGrantedAuthority("ROLE_USER");
+        if (userOpt.isPresent()) {
+            User user = userOpt.get();
+            simpleGrantedAuthority =
+                    new SimpleGrantedAuthority(userService.findRole(user).getAuthority());
+        }
+
+        List<String> sessionIndexes = new ArrayList<>();
+        for (AuthnStatement authnStatement : assertion.getAuthnStatements()) {
+            sessionIndexes.add(authnStatement.getSessionIndex());
+        }
+
+        CustomSaml2AuthenticatedPrincipal principal =
+                new CustomSaml2AuthenticatedPrincipal(
+                        userIdentifier, attributes, userIdentifier, sessionIndexes);
+
+        return new Saml2Authentication(
+                principal,
+                responseToken.getToken().getSaml2Response(),
+                List.of(simpleGrantedAuthority));
+    }
+
+    private boolean hasAttribute(Map<String, List<Object>> attributes, String name) {
+        return attributes.containsKey(name) && !attributes.get(name).isEmpty();
+    }
+
+    private String getFirstAttributeValue(Map<String, List<Object>> attributes, String name) {
+        List<Object> values = attributes.get(name);
+        return values != null && !values.isEmpty() ? values.get(0).toString() : null;
+    }
+}

proprietary/src/main/java/stirling/software/proprietary/security/saml2/SAML2Configuration.java

@@ -0,0 +1,170 @@
+package stirling.software.proprietary.security.saml2;
+
+import jakarta.servlet.http.HttpServletRequest;
+import java.security.cert.X509Certificate;
+import java.util.Collections;
+import java.util.UUID;
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+import org.opensaml.saml.saml2.core.AuthnRequest;
+import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.core.io.Resource;
+import org.springframework.security.saml2.core.Saml2X509Credential;
+import org.springframework.security.saml2.core.Saml2X509Credential.Saml2X509CredentialType;
+import org.springframework.security.saml2.provider.service.authentication.AbstractSaml2AuthenticationRequest;
+import org.springframework.security.saml2.provider.service.registration.InMemoryRelyingPartyRegistrationRepository;
+import org.springframework.security.saml2.provider.service.registration.RelyingPartyRegistration;
+import org.springframework.security.saml2.provider.service.registration.RelyingPartyRegistrationRepository;
+import org.springframework.security.saml2.provider.service.registration.Saml2MessageBinding;
+import org.springframework.security.saml2.provider.service.web.HttpSessionSaml2AuthenticationRequestRepository;
+import org.springframework.security.saml2.provider.service.web.authentication.OpenSaml4AuthenticationRequestResolver;
+import stirling.software.common.model.ApplicationProperties;
+import stirling.software.common.model.ApplicationProperties.Security.SAML2;
+
+@Configuration
+@Slf4j
+@ConditionalOnProperty(value = "security.saml2.enabled", havingValue = "true")
+@RequiredArgsConstructor
+public class SAML2Configuration {
+
+    private final ApplicationProperties applicationProperties;
+
+    @Bean
+    @ConditionalOnProperty(name = "security.saml2.enabled", havingValue = "true")
+    public RelyingPartyRegistrationRepository relyingPartyRegistrations() throws Exception {
+        SAML2 samlConf = applicationProperties.getSecurity().getSaml2();
+        X509Certificate idpCert = CertificateUtils.readCertificate(samlConf.getIdpCert());
+        Saml2X509Credential verificationCredential = Saml2X509Credential.verification(idpCert);
+        Resource privateKeyResource = samlConf.getPrivateKey();
+        Resource certificateResource = samlConf.getSpCert();
+        Saml2X509Credential signingCredential =
+                new Saml2X509Credential(
+                        CertificateUtils.readPrivateKey(privateKeyResource),
+                        CertificateUtils.readCertificate(certificateResource),
+                        Saml2X509CredentialType.SIGNING);
+        RelyingPartyRegistration rp =
+                RelyingPartyRegistration.withRegistrationId(samlConf.getRegistrationId())
+                        .signingX509Credentials(c -> c.add(signingCredential))
+                        .entityId(samlConf.getIdpIssuer())
+                        .singleLogoutServiceBinding(Saml2MessageBinding.POST)
+                        .singleLogoutServiceLocation(samlConf.getIdpSingleLogoutUrl())
+                        .singleLogoutServiceResponseLocation("http://localhost:8080/login")
+                        .assertionConsumerServiceBinding(Saml2MessageBinding.POST)
+                        .assertionConsumerServiceLocation(
+                                "{baseUrl}/login/saml2/sso/{registrationId}")
+                        .assertingPartyMetadata(
+                                metadata ->
+                                        metadata.entityId(samlConf.getIdpIssuer())
+                                                .verificationX509Credentials(
+                                                        c -> c.add(verificationCredential))
+                                                .singleSignOnServiceBinding(
+                                                        Saml2MessageBinding.POST)
+                                                .singleSignOnServiceLocation(
+                                                        samlConf.getIdpSingleLoginUrl())
+                                                .singleLogoutServiceBinding(
+                                                        Saml2MessageBinding.POST)
+                                                .singleLogoutServiceLocation(
+                                                        samlConf.getIdpSingleLogoutUrl())
+                                                .wantAuthnRequestsSigned(true))
+                        .build();
+        return new InMemoryRelyingPartyRegistrationRepository(rp);
+    }
+
+    @Bean
+    @ConditionalOnProperty(name = "security.saml2.enabled", havingValue = "true")
+    public OpenSaml4AuthenticationRequestResolver authenticationRequestResolver(
+            RelyingPartyRegistrationRepository relyingPartyRegistrationRepository) {
+        OpenSaml4AuthenticationRequestResolver resolver =
+                new OpenSaml4AuthenticationRequestResolver(relyingPartyRegistrationRepository);
+
+        resolver.setAuthnRequestCustomizer(
+                customizer -> {
+                    HttpServletRequest request = customizer.getRequest();
+                    AuthnRequest authnRequest = customizer.getAuthnRequest();
+                    HttpSessionSaml2AuthenticationRequestRepository requestRepository =
+                            new HttpSessionSaml2AuthenticationRequestRepository();
+                    AbstractSaml2AuthenticationRequest saml2AuthenticationRequest =
+                            requestRepository.loadAuthenticationRequest(request);
+
+                    if (saml2AuthenticationRequest != null) {
+                        String sessionId = request.getSession(false).getId();
+
+                        log.debug(
+                                "Retrieving SAML 2 authentication request ID from the current HTTP session {}",
+                                sessionId);
+
+                        String authenticationRequestId = saml2AuthenticationRequest.getId();
+
+                        if (!authenticationRequestId.isBlank()) {
+                            authnRequest.setID(authenticationRequestId);
+                        } else {
+                            log.warn(
+                                    "No authentication request found for HTTP session {}. Generating new ID",
+                                    sessionId);
+                            authnRequest.setID("ARQ" + UUID.randomUUID().toString().substring(1));
+                        }
+                    } else {
+                        log.debug("Generating new authentication request ID");
+                        authnRequest.setID("ARQ" + UUID.randomUUID().toString().substring(1));
+                    }
+
+                    logAuthnRequestDetails(authnRequest);
+                    logHttpRequestDetails(request);
+                });
+        return resolver;
+    }
+
+    private static void logAuthnRequestDetails(AuthnRequest authnRequest) {
+        String message =
+                """
+                        AuthnRequest:
+
+                        ID: {}
+                        Issuer: {}
+                        IssueInstant: {}
+                        AssertionConsumerService (ACS) URL: {}
+                        """;
+        log.debug(
+                message,
+                authnRequest.getID(),
+                authnRequest.getIssuer() != null ? authnRequest.getIssuer().getValue() : null,
+                authnRequest.getIssueInstant(),
+                authnRequest.getAssertionConsumerServiceURL());
+
+        if (authnRequest.getNameIDPolicy() != null) {
+            log.debug("NameIDPolicy Format: {}", authnRequest.getNameIDPolicy().getFormat());
+        }
+    }
+
+    private static void logHttpRequestDetails(HttpServletRequest request) {
+        log.debug("HTTP Headers: ");
+        Collections.list(request.getHeaderNames())
+                .forEach(
+                        headerName ->
+                                log.debug("{}: {}", headerName, request.getHeader(headerName)));
+        String message =
+                """
+                        HTTP Request Method: {}
+                        Session ID: {}
+                        Request Path: {}
+                        Query String: {}
+                        Remote Address: {}
+
+                        SAML Request Parameters:
+
+                        SAMLRequest: {}
+                        RelayState: {}
+                        """;
+        log.debug(
+                message,
+                request.getMethod(),
+                request.getSession().getId(),
+                request.getRequestURI(),
+                request.getQueryString(),
+                request.getRemoteAddr(),
+                request.getParameter("SAMLRequest"),
+                request.getParameter("RelayState"));
+    }
+}

proprietary/src/main/java/stirling/software/proprietary/security/service/AppUpdateAuthService.java

@@ -0,0 +1,41 @@
+package stirling.software.proprietary.security.service;
+
+import java.util.Optional;
+import lombok.RequiredArgsConstructor;
+import org.springframework.security.core.Authentication;
+import org.springframework.security.core.context.SecurityContextHolder;
+import org.springframework.stereotype.Service;
+import stirling.software.common.configuration.interfaces.ShowAdminInterface;
+import stirling.software.common.model.ApplicationProperties;
+import stirling.software.proprietary.security.database.repository.UserRepository;
+import stirling.software.proprietary.security.model.User;
+
+@Service
+@RequiredArgsConstructor
+class AppUpdateAuthService implements ShowAdminInterface {
+
+    private final UserRepository userRepository;
+
+    private final ApplicationProperties applicationProperties;
+
+    @Override
+    public boolean getShowUpdateOnlyAdmins() {
+        boolean showUpdate = applicationProperties.getSystem().isShowUpdate();
+        if (!showUpdate) {
+            return showUpdate;
+        }
+        boolean showUpdateOnlyAdmin = applicationProperties.getSystem().getShowUpdateOnlyAdmin();
+        Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
+        if (authentication == null || !authentication.isAuthenticated()) {
+            return !showUpdateOnlyAdmin;
+        }
+        if ("anonymousUser".equalsIgnoreCase(authentication.getName())) {
+            return !showUpdateOnlyAdmin;
+        }
+        Optional<User> user = userRepository.findByUsername(authentication.getName());
+        if (user.isPresent() && showUpdateOnlyAdmin) {
+            return "ROLE_ADMIN".equals(user.get().getRolesAsString());
+        }
+        return showUpdate;
+    }
+}

proprietary/src/main/java/stirling/software/proprietary/security/service/CustomOAuth2UserService.java

@@ -0,0 +1,78 @@
+package stirling.software.proprietary.security.service;
+
+import java.util.Optional;
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.security.authentication.LockedException;
+import org.springframework.security.oauth2.client.oidc.userinfo.OidcUserRequest;
+import org.springframework.security.oauth2.client.oidc.userinfo.OidcUserService;
+import org.springframework.security.oauth2.client.userinfo.OAuth2UserService;
+import org.springframework.security.oauth2.core.OAuth2AuthenticationException;
+import org.springframework.security.oauth2.core.OAuth2Error;
+import org.springframework.security.oauth2.core.oidc.user.DefaultOidcUser;
+import org.springframework.security.oauth2.core.oidc.user.OidcUser;
+import stirling.software.common.model.ApplicationProperties;
+import stirling.software.common.model.ApplicationProperties.Security.OAUTH2;
+import stirling.software.common.model.enumeration.UsernameAttribute;
+import stirling.software.proprietary.security.model.User;
+
+@Slf4j
+public class CustomOAuth2UserService implements OAuth2UserService<OidcUserRequest, OidcUser> {
+
+    private final OidcUserService delegate = new OidcUserService();
+
+    private final UserService userService;
+
+    private final LoginAttemptService loginAttemptService;
+
+    private final ApplicationProperties applicationProperties;
+
+    public CustomOAuth2UserService(
+            ApplicationProperties applicationProperties,
+            UserService userService,
+            LoginAttemptService loginAttemptService) {
+        this.applicationProperties = applicationProperties;
+        this.userService = userService;
+        this.loginAttemptService = loginAttemptService;
+    }
+
+    @Override
+    public OidcUser loadUser(OidcUserRequest userRequest) throws OAuth2AuthenticationException {
+        try {
+            OidcUser user = delegate.loadUser(userRequest);
+            OAUTH2 oauth2 = applicationProperties.getSecurity().getOauth2();
+            UsernameAttribute usernameAttribute =
+                    UsernameAttribute.valueOf(oauth2.getUseAsUsername().toUpperCase());
+            String usernameAttributeKey = usernameAttribute.getName();
+
+            // todo: save user by OIDC ID instead of username
+            Optional<User> internalUser =
+                    userService.findByUsernameIgnoreCase(user.getAttribute(usernameAttributeKey));
+
+            if (internalUser.isPresent()) {
+                String internalUsername = internalUser.get().getUsername();
+                if (loginAttemptService.isBlocked(internalUsername)) {
+                    throw new LockedException(
+                            "The account "
+                                    + internalUsername
+                                    + " has been locked due to too many failed login attempts.");
+                }
+                if (userService.hasPassword(usernameAttributeKey)) {
+                    throw new IllegalArgumentException("Password must not be null");
+                }
+            }
+
+            // Return a new OidcUser with adjusted attributes
+            return new DefaultOidcUser(
+                    user.getAuthorities(),
+                    userRequest.getIdToken(),
+                    user.getUserInfo(),
+                    usernameAttributeKey);
+        } catch (IllegalArgumentException e) {
+            log.error("Error loading OIDC user: {}", e.getMessage());
+            throw new OAuth2AuthenticationException(new OAuth2Error(e.getMessage()), e);
+        } catch (Exception e) {
+            log.error("Unexpected error loading OIDC user", e);
+            throw new OAuth2AuthenticationException("Unexpected error during authentication");
+        }
+    }
+}

proprietary/src/main/java/stirling/software/proprietary/security/service/CustomUserDetailsService.java

@@ -0,0 +1,56 @@
+package stirling.software.proprietary.security.service;
+
+import java.util.Collection;
+import java.util.Set;
+import lombok.RequiredArgsConstructor;
+import org.springframework.security.authentication.LockedException;
+import org.springframework.security.core.GrantedAuthority;
+import org.springframework.security.core.authority.SimpleGrantedAuthority;
+import org.springframework.security.core.userdetails.UserDetails;
+import org.springframework.security.core.userdetails.UserDetailsService;
+import org.springframework.security.core.userdetails.UsernameNotFoundException;
+import org.springframework.stereotype.Service;
+import stirling.software.proprietary.security.database.repository.UserRepository;
+import stirling.software.proprietary.security.model.Authority;
+import stirling.software.proprietary.security.model.User;
+
+@Service
+@RequiredArgsConstructor
+public class CustomUserDetailsService implements UserDetailsService {
+
+    private final UserRepository userRepository;
+
+    private final LoginAttemptService loginAttemptService;
+
+    @Override
+    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
+        User user =
+                userRepository
+                        .findByUsername(username)
+                        .orElseThrow(
+                                () ->
+                                        new UsernameNotFoundException(
+                                                "No user found with username: " + username));
+        if (loginAttemptService.isBlocked(username)) {
+            throw new LockedException(
+                    "Your account has been locked due to too many failed login attempts.");
+        }
+        if (!user.hasPassword()) {
+            throw new IllegalArgumentException("Password must not be null");
+        }
+        return new org.springframework.security.core.userdetails.User(
+                user.getUsername(),
+                user.getPassword(),
+                user.isEnabled(),
+                true,
+                true,
+                true,
+                getAuthorities(user.getAuthorities()));
+    }
+
+    private Collection<? extends GrantedAuthority> getAuthorities(Set<Authority> authorities) {
+        return authorities.stream()
+                .map(authority -> new SimpleGrantedAuthority(authority.getAuthority()))
+                .toList();
+    }
+}

proprietary/src/main/java/stirling/software/proprietary/security/service/DatabaseService.java

@@ -0,0 +1,336 @@
+package stirling.software.proprietary.security.service;
+
+import java.io.IOException;
+import java.nio.file.DirectoryStream;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.nio.file.Paths;
+import java.nio.file.attribute.BasicFileAttributes;
+import java.sql.Connection;
+import java.sql.PreparedStatement;
+import java.sql.ResultSet;
+import java.sql.SQLException;
+import java.sql.Statement;
+import java.time.LocalDateTime;
+import java.time.ZoneId;
+import java.time.format.DateTimeFormatter;
+import java.util.ArrayList;
+import java.util.Comparator;
+import java.util.List;
+import java.util.stream.Collectors;
+import javax.sql.DataSource;
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.jdbc.datasource.init.CannotReadScriptException;
+import org.springframework.jdbc.datasource.init.ScriptException;
+import org.springframework.stereotype.Service;
+import stirling.software.common.configuration.InstallationPathConfig;
+import stirling.software.common.model.ApplicationProperties;
+import stirling.software.common.model.FileInfo;
+import stirling.software.proprietary.security.model.exception.BackupNotFoundException;
+
+@Slf4j
+@Service
+public class DatabaseService implements DatabaseServiceInterface {
+
+    public static final String BACKUP_PREFIX = "backup_";
+    public static final String SQL_SUFFIX = ".sql";
+    private final Path BACKUP_DIR;
+
+    private final ApplicationProperties.Datasource datasourceProps;
+    private final DataSource dataSource;
+
+    public DatabaseService(
+            ApplicationProperties.Datasource datasourceProps, DataSource dataSource) {
+        this.BACKUP_DIR =
+                Paths.get(InstallationPathConfig.getConfigPath(), "db", "backup").normalize();
+        this.datasourceProps = datasourceProps;
+        this.dataSource = dataSource;
+    }
+
+    /**
+     * Checks if there is at least one backup. First checks if the directory exists, then checks if
+     * there are backup scripts within the directory
+     *
+     * @return true if there are backup scripts, false if there are not
+     */
+    @Override
+    public boolean hasBackup() {
+        createBackupDirectory();
+
+        if (Files.exists(BACKUP_DIR)) {
+            return !getBackupList().isEmpty();
+        }
+
+        return false;
+    }
+
+    /**
+     * Read the backup directory and filter for files with the prefix "backup_" and suffix ".sql"
+     *
+     * @return a <code>List</code> of backup files
+     */
+    @Override
+    public List<FileInfo> getBackupList() {
+        List<FileInfo> backupFiles = new ArrayList<>();
+
+        if (isH2Database()) {
+            createBackupDirectory();
+
+            try (DirectoryStream<Path> stream =
+                    Files.newDirectoryStream(
+                            BACKUP_DIR,
+                            path ->
+                                    path.getFileName().toString().startsWith(BACKUP_PREFIX)
+                                            && path.getFileName()
+                                                    .toString()
+                                                    .endsWith(SQL_SUFFIX))) {
+                for (Path entry : stream) {
+                    BasicFileAttributes attrs =
+                            Files.readAttributes(entry, BasicFileAttributes.class);
+                    LocalDateTime modificationDate =
+                            LocalDateTime.ofInstant(
+                                    attrs.lastModifiedTime().toInstant(), ZoneId.systemDefault());
+                    LocalDateTime creationDate =
+                            LocalDateTime.ofInstant(
+                                    attrs.creationTime().toInstant(), ZoneId.systemDefault());
+                    long fileSize = attrs.size();
+                    backupFiles.add(
+                            new FileInfo(
+                                    entry.getFileName().toString(),
+                                    entry.toString(),
+                                    modificationDate,
+                                    fileSize,
+                                    creationDate));
+                }
+            } catch (IOException e) {
+                log.error("Error reading backup directory: {}", e.getMessage(), e);
+            }
+        }
+
+        return backupFiles;
+    }
+
+    private void createBackupDirectory() {
+        if (!Files.exists(BACKUP_DIR)) {
+            try {
+                Files.createDirectories(BACKUP_DIR);
+                log.debug("create backup directory: {}", BACKUP_DIR);
+            } catch (IOException e) {
+                log.error("Error create backup directory: {}", e.getMessage(), e);
+            }
+        }
+    }
+
+    @Override
+    public void importDatabase() {
+        if (!hasBackup()) throw new BackupNotFoundException("No backup scripts were found.");
+
+        List<FileInfo> backupList = this.getBackupList();
+        backupList.sort(Comparator.comparing(FileInfo::getModificationDate).reversed());
+
+        Path latestExport = Paths.get(backupList.get(0).getFilePath());
+
+        executeDatabaseScript(latestExport);
+    }
+
+    /** Imports a database backup from the specified file. */
+    public boolean importDatabaseFromUI(String fileName) {
+        try {
+            importDatabaseFromUI(getBackupFilePath(fileName));
+            return true;
+        } catch (IOException e) {
+            log.error(
+                    "Error importing database from file: {}, message: {}",
+                    fileName,
+                    e.getMessage(),
+                    e.getCause());
+            return false;
+        }
+    }
+
+    /** Imports a database backup from the specified path. */
+    public boolean importDatabaseFromUI(Path tempTemplatePath) throws IOException {
+        executeDatabaseScript(tempTemplatePath);
+        LocalDateTime dateNow = LocalDateTime.now();
+        DateTimeFormatter myFormatObj = DateTimeFormatter.ofPattern("yyyyMMddHHmm");
+        Path insertOutputFilePath =
+                this.getBackupFilePath(
+                        BACKUP_PREFIX + "user_" + dateNow.format(myFormatObj) + SQL_SUFFIX);
+        Files.copy(tempTemplatePath, insertOutputFilePath);
+        Files.deleteIfExists(tempTemplatePath);
+        return true;
+    }
+
+    @Override
+    public void exportDatabase() {
+        List<FileInfo> filteredBackupList =
+                this.getBackupList().stream()
+                        .filter(backup -> !backup.getFileName().startsWith(BACKUP_PREFIX + "user_"))
+                        .collect(Collectors.toList());
+
+        if (filteredBackupList.size() > 5) {
+            deleteOldestBackup(filteredBackupList);
+        }
+
+        LocalDateTime dateNow = LocalDateTime.now();
+        DateTimeFormatter myFormatObj = DateTimeFormatter.ofPattern("yyyyMMddHHmm");
+        Path insertOutputFilePath =
+                this.getBackupFilePath(BACKUP_PREFIX + dateNow.format(myFormatObj) + SQL_SUFFIX);
+
+        if (isH2Database()) {
+            String query = "SCRIPT SIMPLE COLUMNS DROP to ?;";
+
+            try (Connection conn = dataSource.getConnection();
+                    PreparedStatement stmt = conn.prepareStatement(query)) {
+                stmt.setString(1, insertOutputFilePath.toString());
+                stmt.execute();
+            } catch (SQLException e) {
+                log.error("Error during database export: {}", e.getMessage(), e);
+            } catch (CannotReadScriptException e) {
+                log.error("Error during database export: File {} not found", insertOutputFilePath);
+            }
+
+            log.info("Database export completed: {}", insertOutputFilePath);
+        }
+    }
+
+    private static void deleteOldestBackup(List<FileInfo> filteredBackupList) {
+        try {
+            filteredBackupList.sort(
+                    Comparator.comparing(
+                            p -> p.getFileName().substring(7, p.getFileName().length() - 4)));
+
+            FileInfo oldestFile = filteredBackupList.get(0);
+            Files.deleteIfExists(Paths.get(oldestFile.getFilePath()));
+            log.info("Deleted oldest backup: {}", oldestFile.getFileName());
+        } catch (IOException e) {
+            log.error("Unable to delete oldest backup, message: {}", e.getMessage(), e);
+        }
+    }
+
+    /**
+     * Retrieves the H2 database version.
+     *
+     * @return <code>String</code> of the H2 version
+     */
+    public String getH2Version() {
+        String version = "Unknown";
+
+        if (isH2Database()) {
+            try (Connection conn = dataSource.getConnection()) {
+                try (Statement stmt = conn.createStatement();
+                        ResultSet rs = stmt.executeQuery("SELECT H2VERSION() AS version")) {
+                    if (rs.next()) {
+                        version = rs.getString("version");
+                        log.info("H2 Database Version: {}", version);
+                    }
+                }
+            } catch (SQLException e) {
+                log.error("Error retrieving H2 version: {}", e.getMessage(), e);
+            }
+        }
+
+        return version;
+    }
+
+    private boolean isH2Database() {
+        boolean isTypeH2 =
+            datasourceProps.getType().equalsIgnoreCase(ApplicationProperties.Driver.H2.name());
+        boolean isDBUrlH2 =
+            datasourceProps.getCustomDatabaseUrl().contains("h2")
+                || datasourceProps.getCustomDatabaseUrl().contains("H2");
+        boolean isCustomDatabase = datasourceProps.isEnableCustomDatabase();
+
+        if (isCustomDatabase) {
+            if (isTypeH2 && !isDBUrlH2) {
+                log.warn(
+                    "Datasource type is H2, but the URL does not contain 'h2'. "
+                        + "Please check your configuration.");
+                throw new IllegalStateException(
+                    "Datasource type is H2, but the URL does not contain 'h2'. Please check"
+                        + " your configuration.");
+            } else if (!isTypeH2 && isDBUrlH2) {
+                log.warn(
+                    "Datasource URL contains 'h2', but the type is not H2. "
+                        + "Please check your configuration.");
+                throw new IllegalStateException(
+                    "Datasource URL contains 'h2', but the type is not H2. Please check your"
+                        + " configuration.");
+            }
+        }
+        boolean isH2 = isTypeH2 && isDBUrlH2;
+
+        return !isCustomDatabase || isH2;
+    }
+
+    /**
+     * Deletes a backup file.
+     *
+     * @return true if successful, false if not
+     */
+    public boolean deleteBackupFile(String fileName) throws IOException {
+        if (!isValidFileName(fileName)) {
+            log.error("Invalid file name: {}", fileName);
+            return false;
+        }
+        Path filePath = this.getBackupFilePath(fileName);
+        if (Files.deleteIfExists(filePath)) {
+            log.info("Deleted backup file: {}", fileName);
+            return true;
+        } else {
+            log.error("File not found or could not be deleted: {}", fileName);
+            return false;
+        }
+    }
+
+    /**
+     * Gets the Path for a given backup file name.
+     *
+     * @return the <code>Path</code> object for the given file name
+     */
+    public Path getBackupFilePath(String fileName) {
+        createBackupDirectory();
+        Path filePath = BACKUP_DIR.resolve(fileName).normalize();
+        if (!filePath.startsWith(BACKUP_DIR)) {
+            throw new SecurityException("Path traversal detected");
+        }
+        return filePath;
+    }
+
+    private void executeDatabaseScript(Path scriptPath) {
+        if (isH2Database()) {
+            String query = "RUNSCRIPT from ?;";
+
+            try (Connection conn = dataSource.getConnection();
+                    PreparedStatement stmt = conn.prepareStatement(query)) {
+                stmt.setString(1, scriptPath.toString());
+                stmt.execute();
+            } catch (SQLException e) {
+                log.error("Error during database import: {}", e.getMessage(), e);
+            } catch (ScriptException e) {
+                log.error("Error: File {} not found", scriptPath.toString(), e);
+            }
+        }
+
+        log.info("Database import completed: {}", scriptPath);
+    }
+
+    /**
+     * Checks for invalid characters or sequences
+     *
+     * @return true if it contains no invalid characters, false if it does
+     */
+    private boolean isValidFileName(String fileName) {
+        return fileName != null
+                && !fileName.contains("..")
+                && !fileName.contains("/")
+                && !fileName.contains("\\")
+                && !fileName.contains(":")
+                && !fileName.contains("*")
+                && !fileName.contains("?")
+                && !fileName.contains("\"")
+                && !fileName.contains("<")
+                && !fileName.contains(">")
+                && !fileName.contains("|");
+    }
+}

proprietary/src/main/java/stirling/software/proprietary/security/service/DatabaseServiceInterface.java

@@ -0,0 +1,17 @@
+package stirling.software.proprietary.security.service;
+
+import java.sql.SQLException;
+import java.util.List;
+
+import stirling.software.common.model.FileInfo;
+import stirling.software.common.model.exception.UnsupportedProviderException;
+
+public interface DatabaseServiceInterface {
+    void exportDatabase() throws SQLException, UnsupportedProviderException;
+
+    void importDatabase();
+
+    boolean hasBackup();
+
+    List<FileInfo> getBackupList();
+}

proprietary/src/main/java/stirling/software/proprietary/security/service/EmailService.java

@@ -0,0 +1,76 @@
+package stirling.software.proprietary.security.service;
+
+import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
+import org.springframework.mail.javamail.JavaMailSender;
+import org.springframework.mail.javamail.MimeMessageHelper;
+import org.springframework.scheduling.annotation.Async;
+import org.springframework.stereotype.Service;
+import org.springframework.web.multipart.MultipartFile;
+
+import jakarta.mail.MessagingException;
+import jakarta.mail.internet.MimeMessage;
+
+import lombok.RequiredArgsConstructor;
+
+import stirling.software.common.model.ApplicationProperties;
+import stirling.software.proprietary.security.model.api.Email;
+
+/**
+ * Service class responsible for sending emails, including those with attachments. It uses
+ * JavaMailSender to send the email and is designed to handle both the message content and file
+ * attachments.
+ */
+@Service
+@RequiredArgsConstructor
+@ConditionalOnProperty(value = "mail.enabled", havingValue = "true", matchIfMissing = false)
+public class EmailService {
+
+    private final JavaMailSender mailSender;
+    private final ApplicationProperties applicationProperties;
+
+    /**
+     * Sends an email with an attachment asynchronously. This method is annotated with @Async, which
+     * means it will be executed asynchronously.
+     *
+     * @param email The Email object containing the recipient, subject, body, and file attachment.
+     * @throws MessagingException If there is an issue with creating or sending the email.
+     */
+    @Async
+    public void sendEmailWithAttachment(Email email) throws MessagingException {
+        MultipartFile file = email.getFileInput();
+        // 1) Validate recipient email address
+        if (email.getTo() == null || email.getTo().trim().isEmpty()) {
+            throw new MessagingException("Invalid Addresses");
+        }
+
+        // 2) Validate attachment
+        if (file == null
+                || file.isEmpty()
+                || file.getOriginalFilename() == null
+                || file.getOriginalFilename().isEmpty()) {
+            throw new MessagingException("An attachment is required to send the email.");
+        }
+
+        ApplicationProperties.Mail mailProperties = applicationProperties.getMail();
+
+        // Creates a MimeMessage to represent the email
+        MimeMessage message = mailSender.createMimeMessage();
+
+        // Helper class to set up the message content and attachments
+        MimeMessageHelper helper = new MimeMessageHelper(message, true);
+
+        // Sets the recipient, subject, body, and sender email
+        helper.addTo(email.getTo());
+        helper.setSubject(email.getSubject());
+        helper.setText(
+                email.getBody(),
+                true); // The "true" here indicates that the body contains HTML content.
+        helper.setFrom(mailProperties.getFrom());
+
+        // Adds the attachment to the email
+        helper.addAttachment(file.getOriginalFilename(), file);
+
+        // Sends the email via the configured mail sender
+        mailSender.send(message);
+    }
+}

proprietary/src/main/java/stirling/software/proprietary/security/service/LoginAttemptService.java

@@ -0,0 +1,85 @@
+package stirling.software.proprietary.security.service;
+
+import jakarta.annotation.PostConstruct;
+import java.util.concurrent.ConcurrentHashMap;
+import java.util.concurrent.TimeUnit;
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.stereotype.Service;
+import stirling.software.common.model.ApplicationProperties;
+import stirling.software.proprietary.security.model.AttemptCounter;
+
+@Service
+@Slf4j
+@RequiredArgsConstructor
+public class LoginAttemptService {
+
+    private final ApplicationProperties applicationProperties;
+
+    private int MAX_ATTEMPT;
+
+    private long ATTEMPT_INCREMENT_TIME;
+
+    private ConcurrentHashMap<String, AttemptCounter> attemptsCache;
+
+    private boolean isBlockedEnabled = true;
+
+    @PostConstruct
+    public void init() {
+        MAX_ATTEMPT = applicationProperties.getSecurity().getLoginAttemptCount();
+        if (MAX_ATTEMPT == -1) {
+            isBlockedEnabled = false;
+            log.info("Login attempt tracking is disabled.");
+        }
+        ATTEMPT_INCREMENT_TIME =
+                TimeUnit.MINUTES.toMillis(
+                        applicationProperties.getSecurity().getLoginResetTimeMinutes());
+        attemptsCache = new ConcurrentHashMap<>();
+    }
+
+    public void loginSucceeded(String key) {
+        if (!isBlockedEnabled || key == null || key.trim().isEmpty()) {
+            return;
+        }
+        attemptsCache.remove(key.toLowerCase());
+    }
+
+    public void loginFailed(String key) {
+        if (!isBlockedEnabled || key == null || key.trim().isEmpty()) {
+            return;
+        }
+        AttemptCounter attemptCounter = attemptsCache.get(key.toLowerCase());
+        if (attemptCounter == null) {
+            attemptCounter = new AttemptCounter();
+            attemptsCache.put(key.toLowerCase(), attemptCounter);
+        } else {
+            if (attemptCounter.shouldReset(ATTEMPT_INCREMENT_TIME)) {
+                attemptCounter.reset();
+            }
+            attemptCounter.increment();
+        }
+    }
+
+    public boolean isBlocked(String key) {
+        if (!isBlockedEnabled || key == null || key.trim().isEmpty()) {
+            return false;
+        }
+        AttemptCounter attemptCounter = attemptsCache.get(key.toLowerCase());
+        if (attemptCounter == null) {
+            return false;
+        }
+        return attemptCounter.getAttemptCount() >= MAX_ATTEMPT;
+    }
+
+    public int getRemainingAttempts(String key) {
+        if (!isBlockedEnabled || key == null || key.trim().isEmpty()) {
+            // Arbitrarily high number if tracking is disabled
+            return Integer.MAX_VALUE;
+        }
+        AttemptCounter attemptCounter = attemptsCache.get(key.toLowerCase());
+        if (attemptCounter == null) {
+            return MAX_ATTEMPT;
+        }
+        return MAX_ATTEMPT - attemptCounter.getAttemptCount();
+    }
+}

proprietary/src/main/java/stirling/software/proprietary/security/service/UserService.java

@@ -0,0 +1,477 @@
+package stirling.software.proprietary.security.service;
+
+import java.io.IOException;
+import java.sql.SQLException;
+import java.util.ArrayList;
+import java.util.Collection;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.Optional;
+import java.util.UUID;
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.context.MessageSource;
+import org.springframework.context.i18n.LocaleContextHolder;
+import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
+import org.springframework.security.core.Authentication;
+import org.springframework.security.core.GrantedAuthority;
+import org.springframework.security.core.authority.SimpleGrantedAuthority;
+import org.springframework.security.core.context.SecurityContextHolder;
+import org.springframework.security.core.session.SessionInformation;
+import org.springframework.security.core.userdetails.UserDetails;
+import org.springframework.security.core.userdetails.UsernameNotFoundException;
+import org.springframework.security.crypto.password.PasswordEncoder;
+import org.springframework.security.oauth2.core.user.OAuth2User;
+import org.springframework.stereotype.Service;
+import org.springframework.transaction.annotation.Transactional;
+import stirling.software.common.model.ApplicationProperties;
+import stirling.software.common.model.exception.UnsupportedProviderException;
+import stirling.software.common.service.UserServiceInterface;
+import stirling.software.common.model.enumeration.Role;
+import stirling.software.proprietary.security.database.repository.AuthorityRepository;
+import stirling.software.proprietary.security.database.repository.UserRepository;
+import stirling.software.proprietary.security.model.AuthenticationType;
+import stirling.software.proprietary.security.model.Authority;
+import stirling.software.proprietary.security.model.User;
+import stirling.software.proprietary.security.saml2.CustomSaml2AuthenticatedPrincipal;
+import stirling.software.proprietary.security.session.SessionPersistentRegistry;
+
+@Service
+@Slf4j
+@RequiredArgsConstructor
+public class UserService implements UserServiceInterface {
+
+    private final UserRepository userRepository;
+
+    private final AuthorityRepository authorityRepository;
+
+    private final PasswordEncoder passwordEncoder;
+
+    private final MessageSource messageSource;
+
+    private final SessionPersistentRegistry sessionRegistry;
+
+    private final DatabaseServiceInterface databaseService;
+
+    private final ApplicationProperties.Security.OAUTH2 oAuth2;
+
+    @Transactional
+    public void migrateOauth2ToSSO() {
+        userRepository
+                .findByAuthenticationTypeIgnoreCase("OAUTH2")
+                .forEach(
+                        user -> {
+                            user.setAuthenticationType(AuthenticationType.SSO);
+                            userRepository.save(user);
+                        });
+    }
+
+    // Handle OAUTH2 login and user auto creation.
+    public void processSSOPostLogin(String username, boolean autoCreateUser)
+            throws IllegalArgumentException, SQLException, UnsupportedProviderException {
+        if (!isUsernameValid(username)) {
+            return;
+        }
+        Optional<User> existingUser = findByUsernameIgnoreCase(username);
+        if (existingUser.isPresent()) {
+            return;
+        }
+        if (autoCreateUser) {
+            saveUser(username, AuthenticationType.SSO);
+        }
+    }
+
+    public Authentication getAuthentication(String apiKey) {
+        Optional<User> user = getUserByApiKey(apiKey);
+        if (!user.isPresent()) {
+            throw new UsernameNotFoundException("API key is not valid");
+        }
+        // Convert the user into an Authentication object
+        return new UsernamePasswordAuthenticationToken( // principal (typically the user)
+                user, // credentials (we don't expose the password or API key here)
+                null, // user's authorities (roles/permissions)
+                getAuthorities(user.get()));
+    }
+
+    private Collection<? extends GrantedAuthority> getAuthorities(User user) {
+        // Convert each Authority object into a SimpleGrantedAuthority object.
+        return user.getAuthorities().stream()
+                .map((Authority authority) -> new SimpleGrantedAuthority(authority.getAuthority()))
+                .toList();
+    }
+
+    private String generateApiKey() {
+        String apiKey;
+        do {
+            apiKey = UUID.randomUUID().toString();
+        } while ( // Ensure uniqueness
+        userRepository.findByApiKey(apiKey).isPresent());
+        return apiKey;
+    }
+
+    public User addApiKeyToUser(String username) {
+        Optional<User> userOpt = findByUsernameIgnoreCase(username);
+        User user = saveUser(userOpt, generateApiKey());
+        try {
+            databaseService.exportDatabase();
+        } catch (SQLException | UnsupportedProviderException e) {
+            log.error("Error exporting database after adding API key to user", e);
+        }
+        return user;
+    }
+
+    public User refreshApiKeyForUser(String username) {
+        // reuse the add API key method for refreshing
+        return addApiKeyToUser(username);
+    }
+
+    public String getApiKeyForUser(String username) {
+        User user =
+                findByUsernameIgnoreCase(username)
+                        .orElseThrow(() -> new UsernameNotFoundException("User not found"));
+        if (user.getApiKey() == null || user.getApiKey().length() == 0) {
+            user = addApiKeyToUser(username);
+        }
+        return user.getApiKey();
+    }
+
+    public boolean isValidApiKey(String apiKey) {
+        return userRepository.findByApiKey(apiKey).isPresent();
+    }
+
+    public Optional<User> getUserByApiKey(String apiKey) {
+        return userRepository.findByApiKey(apiKey);
+    }
+
+    public Optional<User> loadUserByApiKey(String apiKey) {
+        Optional<User> user = userRepository.findByApiKey(apiKey);
+        if (user.isPresent()) {
+            return user;
+        }
+        // or throw an exception
+        return null;
+    }
+
+    public boolean validateApiKeyForUser(String username, String apiKey) {
+        Optional<User> userOpt = findByUsernameIgnoreCase(username);
+        return userOpt.isPresent() && apiKey.equals(userOpt.get().getApiKey());
+    }
+
+    public void saveUser(String username, AuthenticationType authenticationType)
+            throws IllegalArgumentException, SQLException, UnsupportedProviderException {
+        saveUser(username, authenticationType, Role.USER.getRoleId());
+    }
+
+    private User saveUser(Optional<User> user, String apiKey) {
+        if (user.isPresent()) {
+            user.get().setApiKey(apiKey);
+            return userRepository.save(user.get());
+        }
+        throw new UsernameNotFoundException("User not found");
+    }
+
+    public void saveUser(String username, AuthenticationType authenticationType, String role)
+            throws IllegalArgumentException, SQLException, UnsupportedProviderException {
+        if (!isUsernameValid(username)) {
+            throw new IllegalArgumentException(getInvalidUsernameMessage());
+        }
+        User user = new User();
+        user.setUsername(username);
+        user.setEnabled(true);
+        user.setFirstLogin(false);
+        user.addAuthority(new Authority(role, user));
+        user.setAuthenticationType(authenticationType);
+        userRepository.save(user);
+        databaseService.exportDatabase();
+    }
+
+    public void saveUser(String username, String password)
+            throws IllegalArgumentException, SQLException, UnsupportedProviderException {
+        if (!isUsernameValid(username)) {
+            throw new IllegalArgumentException(getInvalidUsernameMessage());
+        }
+        User user = new User();
+        user.setUsername(username);
+        user.setPassword(passwordEncoder.encode(password));
+        user.setEnabled(true);
+        user.setAuthenticationType(AuthenticationType.WEB);
+        user.addAuthority(new Authority(Role.USER.getRoleId(), user));
+        userRepository.save(user);
+        databaseService.exportDatabase();
+    }
+
+    public void saveUser(String username, String password, String role, boolean firstLogin)
+            throws IllegalArgumentException, SQLException, UnsupportedProviderException {
+        if (!isUsernameValid(username)) {
+            throw new IllegalArgumentException(getInvalidUsernameMessage());
+        }
+        User user = new User();
+        user.setUsername(username);
+        user.setPassword(passwordEncoder.encode(password));
+        user.addAuthority(new Authority(role, user));
+        user.setEnabled(true);
+        user.setAuthenticationType(AuthenticationType.WEB);
+        user.setFirstLogin(firstLogin);
+        userRepository.save(user);
+        databaseService.exportDatabase();
+    }
+
+    public void saveUser(String username, String password, String role)
+            throws IllegalArgumentException, SQLException, UnsupportedProviderException {
+        saveUser(username, password, role, false);
+    }
+
+    public void saveUser(String username, String password, boolean firstLogin, boolean enabled)
+            throws IllegalArgumentException, SQLException, UnsupportedProviderException {
+        if (!isUsernameValid(username)) {
+            throw new IllegalArgumentException(getInvalidUsernameMessage());
+        }
+        User user = new User();
+        user.setUsername(username);
+        user.setPassword(passwordEncoder.encode(password));
+        user.addAuthority(new Authority(Role.USER.getRoleId(), user));
+        user.setEnabled(enabled);
+        user.setAuthenticationType(AuthenticationType.WEB);
+        user.setFirstLogin(firstLogin);
+        userRepository.save(user);
+        databaseService.exportDatabase();
+    }
+
+    public void deleteUser(String username) {
+        Optional<User> userOpt = findByUsernameIgnoreCase(username);
+        if (userOpt.isPresent()) {
+            for (Authority authority : userOpt.get().getAuthorities()) {
+                if (authority.getAuthority().equals(Role.INTERNAL_API_USER.getRoleId())) {
+                    return;
+                }
+            }
+            userRepository.delete(userOpt.get());
+        }
+        invalidateUserSessions(username);
+    }
+
+    public boolean usernameExists(String username) {
+        return findByUsername(username).isPresent();
+    }
+
+    public boolean usernameExistsIgnoreCase(String username) {
+        return findByUsernameIgnoreCase(username).isPresent();
+    }
+
+    public boolean hasUsers() {
+        long userCount = userRepository.count();
+        if (findByUsernameIgnoreCase(Role.INTERNAL_API_USER.getRoleId()).isPresent()) {
+            userCount -= 1;
+        }
+        return userCount > 0;
+    }
+
+    public void updateUserSettings(String username, Map<String, String> updates)
+            throws SQLException, UnsupportedProviderException {
+        Optional<User> userOpt = findByUsernameIgnoreCaseWithSettings(username);
+        if (userOpt.isPresent()) {
+            User user = userOpt.get();
+            Map<String, String> settingsMap = user.getSettings();
+            if (settingsMap == null) {
+                settingsMap = new HashMap<>();
+            }
+            settingsMap.clear();
+            settingsMap.putAll(updates);
+            user.setSettings(settingsMap);
+            userRepository.save(user);
+            databaseService.exportDatabase();
+        }
+    }
+
+    public Optional<User> findByUsername(String username) {
+        return userRepository.findByUsername(username);
+    }
+
+    public Optional<User> findByUsernameIgnoreCase(String username) {
+        return userRepository.findByUsernameIgnoreCase(username);
+    }
+
+    public Optional<User> findByUsernameIgnoreCaseWithSettings(String username) {
+        return userRepository.findByUsernameIgnoreCaseWithSettings(username);
+    }
+
+    public Authority findRole(User user) {
+        return authorityRepository.findByUserId(user.getId());
+    }
+
+    public void changeUsername(User user, String newUsername)
+            throws IllegalArgumentException,
+                    SQLException,
+                    UnsupportedProviderException {
+        if (!isUsernameValid(newUsername)) {
+            throw new IllegalArgumentException(getInvalidUsernameMessage());
+        }
+        user.setUsername(newUsername);
+        userRepository.save(user);
+        databaseService.exportDatabase();
+    }
+
+    public void changePassword(User user, String newPassword)
+            throws SQLException, UnsupportedProviderException {
+        user.setPassword(passwordEncoder.encode(newPassword));
+        userRepository.save(user);
+        databaseService.exportDatabase();
+    }
+
+    public void changeFirstUse(User user, boolean firstUse)
+            throws SQLException, UnsupportedProviderException {
+        user.setFirstLogin(firstUse);
+        userRepository.save(user);
+        databaseService.exportDatabase();
+    }
+
+    public void changeRole(User user, String newRole)
+            throws SQLException, UnsupportedProviderException {
+        Authority userAuthority = this.findRole(user);
+        userAuthority.setAuthority(newRole);
+        authorityRepository.save(userAuthority);
+        databaseService.exportDatabase();
+    }
+
+    public void changeUserEnabled(User user, Boolean enbeled)
+            throws SQLException, UnsupportedProviderException {
+        user.setEnabled(enbeled);
+        userRepository.save(user);
+        databaseService.exportDatabase();
+    }
+
+    public boolean isPasswordCorrect(User user, String currentPassword) {
+        return passwordEncoder.matches(currentPassword, user.getPassword());
+    }
+
+    public boolean isUsernameValid(String username) {
+        // Checks whether the simple username is formatted correctly
+        // Regular expression for user name: Min. 3 characters, max. 50 characters
+        boolean isValidSimpleUsername =
+                username.matches("^[a-zA-Z0-9](?!.*[-@._+]{2,})[a-zA-Z0-9@._+-]{1,48}[a-zA-Z0-9]$");
+
+        // Checks whether the email address is formatted correctly
+        // Regular expression for email addresses: Max. 320 characters, with RFC-like validation
+        boolean isValidEmail =
+                username.matches(
+                        "^(?=.{1,320}$)(?=.{1,64}@)[A-Za-z0-9](?:[A-Za-z0-9_.+-]*[A-Za-z0-9])?@[^-][A-Za-z0-9-]+(?:\\\\.[A-Za-z0-9-]+)*(?:\\\\.[A-Za-z]{2,})$");
+
+        List<String> notAllowedUserList = new ArrayList<>();
+        notAllowedUserList.add("ALL_USERS".toLowerCase());
+        notAllowedUserList.add("anonymoususer");
+        boolean notAllowedUser = notAllowedUserList.contains(username.toLowerCase());
+        return (isValidSimpleUsername || isValidEmail) && !notAllowedUser;
+    }
+
+    private String getInvalidUsernameMessage() {
+        return messageSource.getMessage(
+                "invalidUsernameMessage", null, LocaleContextHolder.getLocale());
+    }
+
+    public boolean hasPassword(String username) {
+        Optional<User> user = findByUsernameIgnoreCase(username);
+        return user.isPresent() && user.get().hasPassword();
+    }
+
+    public boolean isAuthenticationTypeByUsername(
+            String username, AuthenticationType authenticationType) {
+        Optional<User> user = findByUsernameIgnoreCase(username);
+        return user.isPresent()
+                && authenticationType.name().equalsIgnoreCase(user.get().getAuthenticationType());
+    }
+
+    public boolean isUserDisabled(String username) {
+        Optional<User> userOpt = findByUsernameIgnoreCase(username);
+        return userOpt.map(user -> !user.isEnabled()).orElse(false);
+    }
+
+    public void invalidateUserSessions(String username) {
+        String usernameP = "";
+
+        for (Object principal : sessionRegistry.getAllPrincipals()) {
+            for (SessionInformation sessionsInformation :
+                    sessionRegistry.getAllSessions(principal, false)) {
+                if (principal instanceof UserDetails detailsUser) {
+                    usernameP = detailsUser.getUsername();
+                } else if (principal instanceof OAuth2User oAuth2User) {
+                    usernameP = oAuth2User.getName();
+                } else if (principal instanceof CustomSaml2AuthenticatedPrincipal saml2User) {
+                    usernameP = saml2User.name();
+                } else if (principal instanceof String stringUser) {
+                    usernameP = stringUser;
+                }
+                if (usernameP.equalsIgnoreCase(username)) {
+                    sessionRegistry.expireSession(sessionsInformation.getSessionId());
+                }
+            }
+        }
+    }
+
+    public String getCurrentUsername() {
+        Object principal = SecurityContextHolder.getContext().getAuthentication().getPrincipal();
+
+        if (principal instanceof UserDetails detailsUser) {
+            return detailsUser.getUsername();
+        } else if (principal instanceof User domainUser) {
+            return domainUser.getUsername();
+        } else if (principal instanceof OAuth2User oAuth2User) {
+            return oAuth2User.getAttribute(oAuth2.getUseAsUsername());
+        } else if (principal instanceof CustomSaml2AuthenticatedPrincipal saml2User) {
+            return saml2User.name();
+        } else if (principal instanceof String stringUser) {
+            return stringUser;
+        }
+        return null;
+    }
+
+    @Transactional
+    public void syncCustomApiUser(String customApiKey) {
+        if (customApiKey == null || customApiKey.trim().isBlank()) {
+            return;
+        }
+
+        String username = "CUSTOM_API_USER";
+        Optional<User> existingUser = findByUsernameIgnoreCase(username);
+
+        existingUser.ifPresentOrElse(
+                user -> {
+                    // Update API key if it has changed
+                    User updatedUser = existingUser.get();
+
+                    if (!customApiKey.equals(updatedUser.getApiKey())) {
+                        updatedUser.setApiKey(customApiKey);
+                        userRepository.save(updatedUser);
+                    }
+                },
+                () -> {
+                    // Create new user with API role
+                    User user = new User();
+                    user.setUsername(username);
+                    user.setPassword(UUID.randomUUID().toString());
+                    user.setEnabled(true);
+                    user.setFirstLogin(false);
+                    user.setAuthenticationType(AuthenticationType.WEB);
+                    user.setApiKey(customApiKey);
+                    user.addAuthority(new Authority(Role.INTERNAL_API_USER.getRoleId(), user));
+                    userRepository.save(user);
+                });
+
+        try {
+            databaseService.exportDatabase();
+        } catch (SQLException | UnsupportedProviderException e) {
+            log.error("Error exporting database after synchronising custom API user", e);
+        }
+    }
+
+    @Override
+    public long getTotalUsersCount() {
+        // Count all users in the database
+        long userCount = userRepository.count();
+        // Exclude the internal API user from the count
+        if (findByUsernameIgnoreCase(Role.INTERNAL_API_USER.getRoleId()).isPresent()) {
+            userCount -= 1;
+        }
+        return userCount;
+    }
+}

proprietary/src/main/java/stirling/software/proprietary/security/session/CustomHttpSessionListener.java

@@ -0,0 +1,26 @@
+package stirling.software.proprietary.security.session;
+
+import jakarta.servlet.http.HttpSessionEvent;
+import jakarta.servlet.http.HttpSessionListener;
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.stereotype.Component;
+
+@Component
+@Slf4j
+public class CustomHttpSessionListener implements HttpSessionListener {
+
+    private SessionPersistentRegistry sessionPersistentRegistry;
+
+    public CustomHttpSessionListener(SessionPersistentRegistry sessionPersistentRegistry) {
+        super();
+        this.sessionPersistentRegistry = sessionPersistentRegistry;
+    }
+
+    @Override
+    public void sessionCreated(HttpSessionEvent se) {}
+
+    @Override
+    public void sessionDestroyed(HttpSessionEvent se) {
+        sessionPersistentRegistry.expireSession(se.getSession().getId());
+    }
+}

proprietary/src/main/java/stirling/software/proprietary/security/session/SessionPersistentRegistry.java

@@ -0,0 +1,193 @@
+package stirling.software.proprietary.security.session;
+
+import jakarta.transaction.Transactional;
+import java.time.Duration;
+import java.util.ArrayList;
+import java.util.Collections;
+import java.util.Comparator;
+import java.util.Date;
+import java.util.List;
+import java.util.Optional;
+import lombok.RequiredArgsConstructor;
+import org.springframework.beans.factory.annotation.Value;
+import org.springframework.security.core.session.SessionInformation;
+import org.springframework.security.core.session.SessionRegistry;
+import org.springframework.security.core.userdetails.UserDetails;
+import org.springframework.security.oauth2.core.user.OAuth2User;
+import org.springframework.stereotype.Component;
+import stirling.software.proprietary.security.database.repository.SessionRepository;
+import stirling.software.proprietary.security.model.SessionEntity;
+import stirling.software.proprietary.security.saml2.CustomSaml2AuthenticatedPrincipal;
+
+@Component
+@RequiredArgsConstructor
+public class SessionPersistentRegistry implements SessionRegistry {
+
+    private final SessionRepository sessionRepository;
+
+    @Value("${server.servlet.session.timeout:30m}")
+    private Duration defaultMaxInactiveInterval;
+
+    @Override
+    public List<Object> getAllPrincipals() {
+        List<SessionEntity> sessions = sessionRepository.findAll();
+        List<Object> principals = new ArrayList<>();
+        for (SessionEntity session : sessions) {
+            principals.add(session.getPrincipalName());
+        }
+        return principals;
+    }
+
+    @Override
+    public List<SessionInformation> getAllSessions(
+            Object principal, boolean includeExpiredSessions) {
+        List<SessionInformation> sessionInformations = new ArrayList<>();
+        String principalName = null;
+
+        if (principal instanceof UserDetails detailsUser) {
+            principalName = detailsUser.getUsername();
+        } else if (principal instanceof OAuth2User oAuth2User) {
+            principalName = oAuth2User.getName();
+        } else if (principal instanceof CustomSaml2AuthenticatedPrincipal saml2User) {
+            principalName = saml2User.name();
+        } else if (principal instanceof String stringUser) {
+            principalName = stringUser;
+        }
+
+        if (principalName != null) {
+            List<SessionEntity> sessionEntities =
+                    sessionRepository.findByPrincipalName(principalName);
+            for (SessionEntity sessionEntity : sessionEntities) {
+                if (includeExpiredSessions || !sessionEntity.isExpired()) {
+                    sessionInformations.add(
+                            new SessionInformation(
+                                    sessionEntity.getPrincipalName(),
+                                    sessionEntity.getSessionId(),
+                                    sessionEntity.getLastRequest()));
+                }
+            }
+        }
+        return sessionInformations;
+    }
+
+    @Override
+    @Transactional
+    public void registerNewSession(String sessionId, Object principal) {
+        String principalName = null;
+
+        if (principal instanceof UserDetails detailsUser) {
+            principalName = detailsUser.getUsername();
+        } else if (principal instanceof OAuth2User oAuth2User) {
+            principalName = oAuth2User.getName();
+        } else if (principal instanceof CustomSaml2AuthenticatedPrincipal saml2User) {
+            principalName = saml2User.name();
+        } else if (principal instanceof String stringUser) {
+            principalName = stringUser;
+        }
+
+        if (principalName != null) {
+            // Clear old sessions for the principal (unsure if needed)
+            //            List<SessionEntity> existingSessions =
+            //                    sessionRepository.findByPrincipalName(principalName);
+            //            for (SessionEntity session : existingSessions) {
+            //                session.setExpired(true);
+            //                sessionRepository.save(session);
+            //            }
+
+            SessionEntity sessionEntity = new SessionEntity();
+            sessionEntity.setSessionId(sessionId);
+            sessionEntity.setPrincipalName(principalName);
+            sessionEntity.setLastRequest(new Date()); // Set lastRequest to the current date
+            sessionEntity.setExpired(false);
+            sessionRepository.save(sessionEntity);
+        }
+    }
+
+    @Override
+    @Transactional
+    public void removeSessionInformation(String sessionId) {
+        sessionRepository.deleteById(sessionId);
+    }
+
+    @Override
+    @Transactional
+    public void refreshLastRequest(String sessionId) {
+        Optional<SessionEntity> sessionEntityOpt = sessionRepository.findById(sessionId);
+        if (sessionEntityOpt.isPresent()) {
+            SessionEntity sessionEntity = sessionEntityOpt.get();
+            sessionEntity.setLastRequest(new Date()); // Update lastRequest to the current date
+            sessionRepository.save(sessionEntity);
+        }
+    }
+
+    @Override
+    public SessionInformation getSessionInformation(String sessionId) {
+        Optional<SessionEntity> sessionEntityOpt = sessionRepository.findById(sessionId);
+        if (sessionEntityOpt.isPresent()) {
+            SessionEntity sessionEntity = sessionEntityOpt.get();
+            return new SessionInformation(
+                    sessionEntity.getPrincipalName(),
+                    sessionEntity.getSessionId(),
+                    sessionEntity.getLastRequest());
+        }
+        return null;
+    }
+
+    // Retrieve all non-expired sessions
+    public List<SessionEntity> getAllSessionsNotExpired() {
+        return sessionRepository.findByExpired(false);
+    }
+
+    // Retrieve all sessions
+    public List<SessionEntity> getAllSessions() {
+        return sessionRepository.findAll();
+    }
+
+    // Mark a session as expired
+    public void expireSession(String sessionId) {
+        Optional<SessionEntity> sessionEntityOpt = sessionRepository.findById(sessionId);
+        if (sessionEntityOpt.isPresent()) {
+            SessionEntity sessionEntity = sessionEntityOpt.get();
+            sessionEntity.setExpired(true); // Set expired to true
+            sessionRepository.save(sessionEntity);
+        }
+    }
+
+    // Get the maximum inactive interval for sessions
+    public int getMaxInactiveInterval() {
+        return (int) defaultMaxInactiveInterval.getSeconds();
+    }
+
+    // Retrieve a session entity by session ID
+    public SessionEntity getSessionEntity(String sessionId) {
+        return sessionRepository.findBySessionId(sessionId);
+    }
+
+    // Update session details by principal name
+    public void updateSessionByPrincipalName(
+            String principalName, boolean expired, Date lastRequest) {
+        sessionRepository.saveByPrincipalName(expired, lastRequest, principalName);
+    }
+
+    // Find the latest session for a given principal name
+    public Optional<SessionEntity> findLatestSession(String principalName) {
+        List<SessionEntity> allSessions = sessionRepository.findByPrincipalName(principalName);
+        if (allSessions.isEmpty()) {
+            return Optional.empty();
+        }
+
+        // Sort sessions by lastRequest in descending order
+        Collections.sort(
+                allSessions,
+                new Comparator<SessionEntity>() {
+                    @Override
+                    public int compare(SessionEntity s1, SessionEntity s2) {
+                        // Sort by lastRequest in descending order
+                        return s2.getLastRequest().compareTo(s1.getLastRequest());
+                    }
+                });
+
+        // The first session in the list is the latest session for the given principal name
+        return Optional.of(allSessions.get(0));
+    }
+}

proprietary/src/main/java/stirling/software/proprietary/security/session/SessionRegistryConfig.java

@@ -0,0 +1,20 @@
+package stirling.software.proprietary.security.session;
+
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.security.core.session.SessionRegistryImpl;
+import stirling.software.proprietary.security.database.repository.SessionRepository;
+
+@Configuration
+public class SessionRegistryConfig {
+
+    @Bean
+    public SessionRegistryImpl sessionRegistry() {
+        return new SessionRegistryImpl();
+    }
+
+    @Bean
+    public SessionPersistentRegistry sessionPersistentRegistry(SessionRepository sessionRepository) {
+        return new SessionPersistentRegistry(sessionRepository);
+    }
+}

proprietary/src/main/java/stirling/software/proprietary/security/session/SessionScheduled.java

@@ -0,0 +1,35 @@
+package stirling.software.proprietary.security.session;
+
+import java.time.Instant;
+import java.time.temporal.ChronoUnit;
+import java.util.Date;
+import java.util.List;
+import lombok.RequiredArgsConstructor;
+import org.springframework.scheduling.annotation.Scheduled;
+import org.springframework.security.core.session.SessionInformation;
+import org.springframework.stereotype.Component;
+
+@Component
+@RequiredArgsConstructor
+public class SessionScheduled {
+
+    private final SessionPersistentRegistry sessionPersistentRegistry;
+
+    @Scheduled(cron = "0 0/5 * * * ?")
+    public void expireSessions() {
+        Instant now = Instant.now();
+        for (Object principal : sessionPersistentRegistry.getAllPrincipals()) {
+            List<SessionInformation> sessionInformations =
+                    sessionPersistentRegistry.getAllSessions(principal, false);
+            for (SessionInformation sessionInformation : sessionInformations) {
+                Date lastRequest = sessionInformation.getLastRequest();
+                int maxInactiveInterval = sessionPersistentRegistry.getMaxInactiveInterval();
+                Instant expirationTime =
+                        lastRequest.toInstant().plus(maxInactiveInterval, ChronoUnit.SECONDS);
+                if (now.isAfter(expirationTime)) {
+                    sessionPersistentRegistry.expireSession(sessionInformation.getSessionId());
+                }
+            }
+        }
+    }
+}