spring-security

spring security AuthenticationManager vs AuthenticationProvider?

by

I think the AuthenticationManager delegates the fetching of persistent user information to one or more AuthenticationProviders. The authentication-providers (DaoAuthenticationProvider, JaasAuthenticationProvider, LdapAuthenticationProvider, OpenIDAuthenticationProvider for example) specialize in accessing specific user-info repositories. Something else is mentioned in this part of the reference manual. It says: You may want to register additional AuthenticationProvider beans with the ProviderManager and … Read more

How can I have list of all users logged in (via spring security) my web application

by

For accessing the list of all logged in users you need to inject SessionRegistry instance to your bean. @Autowired @Qualifier(“sessionRegistry”) private SessionRegistry sessionRegistry; And then using injcted SessionRegistry you can access the list of all principals: List<Object> principals = sessionRegistry.getAllPrincipals(); List<String> usersNamesList = new ArrayList<String>(); for (Object principal: principals) { if (principal instanceof User) { … Read more

What’s the “principal” in Spring Security?

by

The principal is the currently logged in user. However, you retrieve it through the security context which is bound to the current thread and as such it’s also bound to the current request and its session. SecurityContextHolder.getContext() internally obtains the current SecurityContext implementation through a ThreadLocal variable. Because a request is bound to a single … Read more

Disable Spring Security for OPTIONS Http Method

by

If you’re using an annotation based security config file (@EnableWebSecurity & @Configuration) you can do something like the following in the configure() method to allow for the OPTION requests to be permitted by Spring Security without authentication for a given path: @Override protected void configure(HttpSecurity http) throws Exception { http .csrf().disable() .authorizeRequests() .antMatchers(HttpMethod.OPTIONS,”/path/to/allow”).permitAll()//allow CORS option … Read more

Spring Security Configuration – HttpSecurity vs WebSecurity

by

General use of WebSecurity ignoring() method omits Spring Security and none of Spring Security’s features will be available. WebSecurity is based above HttpSecurity. @Override public void configure(WebSecurity web) throws Exception { web .ignoring() .antMatchers(“/resources/**”) .antMatchers(“/publics/**”); } @Override protected void configure(HttpSecurity http) throws Exception { http .authorizeRequests() .antMatchers(“/admin/**”).hasRole(“ADMIN”) .antMatchers(“/publics/**”).hasRole(“USER”) // no effect .anyRequest().authenticated(); } WebSecurity in … Read more

disabling spring security in spring boot app [duplicate]

by

Use security.ignored property: security.ignored=/** security.basic.enable: false will just disable some part of the security auto-configurations but your WebSecurityConfig still will be registered. There is a default security password generated at startup Try to Autowired the AuthenticationManagerBuilder: @Override @Autowired protected void configure(AuthenticationManagerBuilder auth) throws Exception { … }

When to use Spring Security`s antMatcher()?

by

You need antMatcher for multiple HttpSecurity, see Spring Security Reference: 5.7 Multiple HttpSecurity We can configure multiple HttpSecurity instances just as we can have multiple <http> blocks. The key is to extend the WebSecurityConfigurationAdapter multiple times. For example, the following is an example of having a different configuration for URL’s that start with /api/. @EnableWebSecurity … Read more