Spring Security's authentication filter not getting called when accessing secured URLs

Question

User is able to access secured URLs without being prompted for loging in. Below is the example of such a URL for which user should be prompted to log in but it is accessed without authentication.

http://localhost:9090/HospitalProject/web/patient/home

Security configuration:

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired
    Environment env;

    @Autowired
    public void configureAuthentication(AuthenticationManagerBuilder auth) throws Exception {
        auth
            .inMemoryAuthentication()
                .withUser("root")
                .password("root")
                .roles("ADMIN");
        auth
            .inMemoryAuthentication()
                .withUser("notroot")
                .password("notroot")
                .roles("SUPER_ADMIN");
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
      http
          .csrf().disable()
          .authorizeRequests()
              .antMatchers("/web/login").permitAll()
              .antMatchers("/web/**").access("hasRole('ADMIN') or hasRole('SUPER_ADMIN')")
              .and()
          .formLogin()
              .loginPage("/web/login")
              .loginProcessingUrl("/web/login")
              .usernameParameter("username")
              .passwordParameter("password")
              .and()
          .logout().logoutSuccessUrl("/login?logout");
    }
}

Security initializer:

public class SecurityWebApplicationIntializer extends AbstractSecurityWebApplicationInitializer {

    public SecurityWebApplicationIntializer() {
        super(SecurityConfig.class);
    }
}

Controller:

@Controller
public class MasterController {

    @GetMapping(value={"/", "/web/login"})
    public ModelAndView loginForm(){
        ModelAndView mv = new ModelAndView("login");
        mv.addObject("loginForm", new LoginForm());
        return mv;
    }
}

Any clue what's missing?

are you using spring-mvc?

kuhajeyan
– kuhajeyan

2016-11-04 10:14:39 +00:00
Commented Nov 4, 2016 at 10:14 — kuhajeyan
– kuhajeyan, Commented Nov 4, 2016 at 10:14

kuhajeyan · Accepted Answer · 2016-11-04 10:26:41Z

Separate role permission on admin to different url

try,

authorizeRequests()    
    .antMatchers("/web/admin/**").access("hasRole('ADMIN') or hasRole('SUPER_ADMIN')")
    .anyRequest().authenticated()    
    .and()
    .formLogin().loginPage("/web/login").permitAll(); 
    .loginProcessingUrl("/web/login")
    .usernameParameter("username").passwordParameter("password")
    .and()
    .logout().logoutSuccessUrl("/login?logout")
    .and()
    .csrf().disable();

and if you using spring mvc you need to add the SecurityConfig to xxxServletInitializer instead of AbstractSecurityWebApplicationInitializer

public class SpringMvcInitializer
       extends AbstractAnnotationConfigDispatcherServletInitializer {

    @Override
    protected Class<?>[] getRootConfigClasses() {
        return new Class[] { SecurityConfig.class };
    }

    @Override
    protected Class<?>[] getServletConfigClasses() {
        return null;
    }

    @Override
    protected String[] getServletMappings() {
        return new String[] { "/" };
    }

}

Collectives™ on Stack Overflow

Spring Security's authentication filter not getting called when accessing secured URLs

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related