1

In my spring boot application we've currently 2 types of accesses, permitAll for a handful of URIs stored in String[] ALLOWED_WITHOUT_AUTHENTICATION.

For rest (/**), we've applied oauth2Login. Then we added a securityContext.

http.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS)
  
  .and().authorizeRequests().antMatchers(ALLOWED_WITHOUT_AUTHENTICATION).permitAll()

  .and().authorizeRequests()
  .antMatchers("/**").authenticated()
  .and().oauth2Login().userInfoEndpoint().oidcUserService(myOidcUserService).customUserType(MyOidcUser.class, "customUser")
  .and().defaultSuccessUrl(authSuccessURL, true).failureUrl(userNotAuthenticatedURL)
  .and().securityContext().securityContextRepository(new CookieSecurityContextRepository(myAuthCookieHelper))
  .and().exceptionHandling().authenticationEntryPoint(getAuthenticationEntryPoint());

Now I want to added basic authentication for few URIs stored in String[] AUTHENTICATED_WITH_BASIC_AUTH.

So I've written below code :

http.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS)
  
  .and().authorizeRequests().antMatchers(ALLOWED_WITHOUT_AUTHENTICATION).permitAll()

  .and().authorizeRequests()
  .antMatchers(Constants.AUTHENTICATED_WITH_BASIC_AUTH).authenticated()
  .and().httpBasic().authenticationEntryPoint(myBasicAuthenticationEntryPoint())
  .and().exceptionHandling().accessDeniedPage("/403")

  .and().authorizeRequests()
  .antMatchers("/**").authenticated()
  .and().oauth2Login().userInfoEndpoint().oidcUserService(myOidcUserService).customUserType(MyOidcUser.class, "customUser")
  .and().defaultSuccessUrl(authSuccessURL, true).failureUrl(userNotAuthenticatedURL)
  .and().securityContext().securityContextRepository(new CookieSecurityContextRepository(myAuthCookieHelper))
  .and().exceptionHandling().authenticationEntryPoint(getAuthenticationEntryPoint());

But I do not want to apply securityContext to URIs which are authenticated with basic auth.

How can I segregate these two?

reiley
  • 3,601
  • 10
  • 53
  • 110

0 Answers0