The first thing to note is that Spring Security OAuth 2.4.0 officially deprecates all its classes. The second thing is that according to the Spring Security – OAuth 2.0 Features Matrix – FAQ: We are no longer planning on adding Authorization Server support to Spring Security. One solution is to use an OAuth2 authorization server … Read more
You can either set the session timeout (say 60 minutes) for all sessions in web.xml: <session-config> <session-timeout>60</session-timeout> </session-config> or on a per-session basis using session.setMaxInactiveInterval(60*60); the latter you might want to do in a authorizationSuccessHandler. <form-login authentication-success-handler-ref=”authenticationSuccessHandler”/>
You have to add @EnableGlobalMethodSecurity(prePostEnabled = true) in your WebSecurityConfig. You can find it here: http://www.baeldung.com/spring-security-expressions-basic @Configuration @EnableWebSecurity @EnableGlobalMethodSecurity(prePostEnabled = true) public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
I’ll mark this as answered, as I solved my problem and no other comments or answers were given: Edit 1 – Alternative 1 answers the original question BUT I had to learn that customized password salting is a legacy approach that is not needed in Spring Security 3.1 any more, as I describe in Edit … Read more
The security’s authorization check part gets the authenticated object from SecurityContext, which will be set when a request gets through the spring security filter. My assumption here is that soon after the login this is not being set. You probably can use a hack as given below to set the value. try { SecurityContext ctx … Read more
I have an application with the same requirement and to solve it I basically restricted Spring Security to a given ant match patter (using antMatcher) as follows: http .antMatcher(“/api/**”) .authorizeRequests() // .anyRequest().authenticated() // .and() .addFilterBefore(authenticationTokenFilterBean(), UsernamePasswordAuthenticationFilter.class); You can read it as follows: for http only invoke these configurations on requests matching the ant pattern /api/** … Read more
You need a spring-security-config.jar on your classpath. The exception means that the security: xml namescape cannot be handled by spring “parsers”. They are implementations of the NamespaceHandler interface, so you need a handler that knows how to process <security: tags. That’s the SecurityNamespaceHandler located in spring-security-config
Same solution for maven: <dependency> <groupId>org.springframework.boot</groupId> <artifactId>spring-boot-starter-thymeleaf</artifactId> <version>1.5.1.RELEASE</version> <exclusions> <exclusion> <groupId>ch.qos.logback</groupId> <artifactId>logback-classic</artifactId> </exclusion> </exclusions> </dependency>
you can use java based configuration like this : @Configuration @EnableWebSecurity public class SecurityConfig extends WebSecurityConfigurerAdapter { @Override protected void configure(HttpSecurity security) throws Exception { security.httpBasic().disable(); } } and restart your application if it’s refresh automatically.
Here is what you need: Extend spring User (org.springframework.security.core.userdetails.User) class and what ever properties you need. Extend spring UserDetailsService (org.springframework.security.core.userdetails.UserDetailsService) and fill the above object. Override loadUserByUsername and return your extended user class Set your custom UserDetailsService in AuthenticationManagerBuilder For example public class CurrentUser extends User{ //This constructor is a must public CurrentUser(String username, String … Read more