EnableWebSecurity will provide configuration via HttpSecurity. It’s the configuration you could find with <http></http> tag in xml configuration, it allows you to configure your access based on urls patterns, the authentication endpoints, handlers etc… EnableGlobalMethodSecurity provides AOP security on methods. Some of the annotations that it provides are PreAuthorize, PostAuthorize. It also has support for … Read more
I believe that the problem is in the order of your rules: .antMatchers(“/admin/**”).hasRole(“ADMIN”) .antMatchers(“/admin/login”).permitAll() The order of the rules matters and the more specific rules should go first. Now everything that starts with /admin will require authenticated user with ADMIN role, even the /admin/login path (because /admin/login is already matched by the /admin/** rule and … Read more
The answer is inside your question. when you are using a different authentication system, and the password is not provided in your own database/data model, you have to use the AuthenticationProvider. for example, I’ve worked in a project that the customer had a centralized authentication system (CAS), so my system had no idea about the … Read more
What happens after login (to which url the user is redirected) is handled by the AuthenticationSuccessHandler. This interface (a concrete class implementing it is SavedRequestAwareAuthenticationSuccessHandler) is invoked by the AbstractAuthenticationProcessingFilter or one of its subclasses like (UsernamePasswordAuthenticationFilter) in the method successfulAuthentication. So in order to have an other redirect in case 3 you have to … Read more
It depends on how you configured it (or lets say, you can configure a different behaviour). In a Web application you will use the ThreadLocalSecurityContextHolderStrategy which interacts with SecurityContextPersistenceFilter. The Java Doc of SecurityContextPersistenceFilter starts with: Populates the {@link SecurityContextHolder} with information obtained from the configured {@link SecurityContextRepository} prior to the request and stores it … Read more
So you want to use Oauth2 in your application, and you want to use the password flow. You can use the spring security oauth2-resource-server project to implement a resource server. In your resource server you can use the ResourceOwnerPasswordResourceDetails to provide the client_id, client_secret, username and password, The Oauth2RestTemplate can be used to call the … Read more
The @EnableWebSecurity is a marker annotation. It allows Spring to find (it’s a @Configuration and, therefore, @Component) and automatically apply the class to the global WebSecurity. If I don’t annotate any of my class with @EnableWebSecurity still the application prompting for username and password. Yes, it is the default behavior. If you looked at your … Read more
Turns out the no-cache HTTP headers are set by Spring Security. This is discussed in http://docs.spring.io/spring-security/site/docs/current/reference/htmlsingle/#headers. The following disables the HTTP response header Pragma: no-cache, but doesn’t otherwise solve the problem: import org.springframework.context.annotation.Configuration; import org.springframework.security.config.annotation.web.builders.HttpSecurity; import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter; import org.springframework.security.config.annotation.web.servlet.configuration.EnableWebMvcSecurity; @Configuration @EnableWebMvcSecurity public class SecurityConfig extends WebSecurityConfigurerAdapter { @Override protected void configure(HttpSecurity http) throws Exception { … Read more
If you already know for sure that the user is logged in (in your example if /index.html is protected): UserDetails userDetails = (UserDetails)SecurityContextHolder.getContext().getAuthentication().getPrincipal(); To first check if the user is logged in, check that the current Authentication is not a AnonymousAuthenticationToken. Authentication auth = SecurityContextHolder.getContext().getAuthentication(); if (!(auth instanceof AnonymousAuthenticationToken)) { // userDetails = auth.getPrincipal() }
You don’t need to create /j_spring_security_check_for_employee and /j_security_check_for_customer filterProcessingUrl. The default one will work just fine with radio button field idea. In the custom login LoginFilter, you need to create different tokens for employee and customer. Here are the steps: Use default UsernamePasswordAuthenticationToken for employee login. Create CustomerAuthenticationToken for customer login. Extend AbstractAuthenticationToken so that … Read more