Assuming 100% TLS for all communication – both during and at all times after login – authenticating with username/password via basic authentication and receiving a JWT in exchange is a valid use case. This is almost exactly how one of OAuth 2’s flows (‘password grant’) works. The idea is that the end user is authenticated … Read more
SecurityContextHolder.getContext().getAuthentication().getPrincipal(); Returns the current user object. This can be User, UserDetails or your custom user object. You will need to cast the return object to UserDetails or your own user object if it is a custom one. OR you can inject Authentication or Principal directly in to your controllers. Principle is your UserDetails/custom user object. … Read more
Take a look here https://github.com/spring-projects/spring-data-examples/tree/master/rest/security which has http .httpBasic().and() .authorizeRequests() .antMatchers(HttpMethod.POST, “/employees”).hasRole(“ADMIN”) .antMatchers(HttpMethod.PUT, “/employees/**”).hasRole(“ADMIN”) .antMatchers(HttpMethod.PATCH, “/employees/**”).hasRole(“ADMIN”);
There are at least 4 different ways: spring security XML configuration this is the easiest way <security:http auto-config=”true” use-expressions=”true” …> … <security:intercept-url pattern=”/forAll/**” access=”permitAll” /> <security:intercept-url pattern=”/**” access=”isAuthenticated()” /> </security:http> @see Spring Security Reference, Chapter 16.1.1 Common Built-In Expressions @see Spring Security Reference, Chapter 16.2 Web Security Expressions Per @Secured Annotation requires <global-method-security secured-annotations=”enabled” /> … Read more
You can use the standard Java filter. Just place it after authentication filter in web.xml (this means that it will go later in the filter chain and will be called after security filter chain). public class CustomFilter implements Filter{ @Override public void destroy() { // Do nothing } @Override public void doFilter(ServletRequest req, ServletResponse res, … Read more
I managed to get this work based on the hints by Michael Ressler’s answer but with some tweaks. My goal was to allow both Basic Auth and Oauth on the same resource endpoints, e.g., /leafcase/123. I was trapped for quite some time due to the ordering of the filterChains (can be inspected in FilterChainProxy.filterChains); the … Read more
I know this is not a direct answer, but people (as me) usually don’t specify spring’s version when searching for this kinds of questions. So, since spring security a method exists that lets ignore some routes: The following will ensure CSRF protection ignores: Any GET, HEAD, TRACE, OPTIONS (this is the default) We also explicitly … Read more
Try use hasAuthority instead hasRole inside HTML-tag. sec:authorize=”hasAuthority(‘ADMIN’)”
Your spring configuration should be agnostic to the used protocol. If you use something like “requires-channel”, you’ll run into problems sooner or later, especially if you want to deploy the same application to a development environment without https. Instead, consider to configure your tomcat properly. You can do this with RemoteIpValve. Depending on which headers … Read more
You can find examples for writing OAuth clients here: https://github.com/spring-projects/spring-security-oauth In your case you can’t just use default or base classes for everything, you have a multiple classes Implementing OAuth2ProtectedResourceDetails. The configuration depends of how you configured your OAuth service but assuming from your curl connections I would recommend: @EnableOAuth2Client @Configuration class MyConfig{ @Value(“${oauth.resource:http://localhost:8082}”) private … Read more