Estoy intentando configurar un acceso mediante formulario para un portal web y otro acceso mediante seguridad básica para acceder a una Api Rest pero no consigo que el de la Api funcione bien, ya que o deja acceder sin credenciales o, aunque las pongas bien, creo que el filtro de seguridad de la página web bloquea el acceso a la api. Si dejo solo seguridad para la página web funciona todo correcto.
Clase UserDetailsService:
@Service
@Qualifier("customUserDetailsService")
public class CustomUserDetailsService implements UserDetailsService {
@Autowired
private UserRepository userRepository;
@Transactional(readOnly = true)
@Override
public UserDetails loadUserByUsername(final String username) throws UsernameNotFoundException {
System.err.println(username);
User user = userRepository.findByEmail(username);
List<GrantedAuthority> authorities = buildUserAuthority(user.getRoles());
return buildUserForAuthentication(user, authorities);
}
private org.springframework.security.core.userdetails.User buildUserForAuthentication(User user,
List<GrantedAuthority> authorities) {
return new org.springframework.security.core.userdetails.User(user.getEmail(), user.getPassword(), authorities);
}
private List<GrantedAuthority> buildUserAuthority(List<Role> userRoles) {
Set<GrantedAuthority> setAuths = new HashSet<GrantedAuthority>();
// Build user's authorities
for (Role userRole : userRoles) {
setAuths.add(new SimpleGrantedAuthority(userRole.getRoleName()));
}
return new ArrayList<GrantedAuthority>(setAuths);
}
}
Clase configuración seguridad solo para web:
@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
/** Roles */
public static final String ROLE_ADMIN = "ADMIN";
public static final String ROLE_TEACHER = "TEACHER";
public static final String ROLE_STUDENT = "STUDENT";
private static PasswordEncoder encoder;
@Autowired
private UserDetailsService customUserDetailsService;
@Override
protected void configure(HttpSecurity http) throws Exception {
// http.authorizeRequests().antMatchers("/auth/**").authenticated();
//
// http.formLogin().defaultSuccessUrl("/auth").loginPage("/login").permitAll().and().logout()
// .logoutSuccessUrl("/logout").permitAll();
//Para poder hacer POST en rest
http.csrf().disable();
// @formatter:off
http
.authorizeRequests()
.antMatchers("/forgotPassword", "/passwordReset", "/register", "/registerStudent", "/resources/**", "/js/**", "**/js/**", "/static/**", "/login" ,"/","/api/**").permitAll()
.antMatchers("/admin/**").hasAuthority(ROLE_ADMIN)
.antMatchers("/teacher/**").hasAuthority(ROLE_TEACHER)
.antMatchers("/student/**").hasAuthority(ROLE_STUDENT)
.antMatchers("/**").hasAnyAuthority(ROLE_TEACHER, ROLE_ADMIN, ROLE_STUDENT)
.antMatchers(HttpMethod.POST, "/api/**").authenticated()
.antMatchers(HttpMethod.PUT, "/api/**").authenticated()
.antMatchers(HttpMethod.DELETE, "/api/**").authenticated()
//.antMatchers("/").permitAll()
.anyRequest().authenticated()
.and()
.formLogin()
.loginPage("/login")
.successHandler(successHandler())
.permitAll()
.and()
.logout()
.permitAll();
// @formatter:on
}
private AuthenticationSuccessHandler successHandler() {
SimpleUrlAuthenticationSuccessHandler handler = new SimpleUrlAuthenticationSuccessHandler();
handler.setDefaultTargetUrl("/home");
return handler;
}
@Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
auth.userDetailsService(customUserDetailsService).passwordEncoder(passwordEncoder());
}
@Bean
public PasswordEncoder passwordEncoder() {
if (encoder == null) {
encoder = new BCryptPasswordEncoder();
}
return encoder;
}
}
Configuración múltiple:
@Configuration
@EnableWebMvcSecurity
@Order(99)
@EnableGlobalMethodSecurity(securedEnabled = true, prePostEnabled = true, proxyTargetClass = true)
public class MultiHttpSecurityConfig extends WebSecurityConfigurerAdapter {
/** Roles */
public static final String ROLE_ADMIN = "ADMIN";
public static final String ROLE_TEACHER = "TEACHER";
public static final String ROLE_STUDENT = "STUDENT";
@Autowired
protected UserDetailsService customUserDetailsService;
@Autowired
protected void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
auth.userDetailsService(customUserDetailsService).passwordEncoder(passwordEncoder());
}
private static PasswordEncoder encoder;
@Bean
public PasswordEncoder passwordEncoder() {
if (encoder == null) {
encoder = new BCryptPasswordEncoder();
}
return encoder;
}
@Configuration
@Order(1)
public static class ApiWebSecurityConfigurationAdapter extends WebSecurityConfigurerAdapter {
protected void configure(HttpSecurity http) throws Exception {
http.csrf().disable();
http.antMatcher("/api/**").authorizeRequests().anyRequest().hasAnyAuthority("ADMIN","STUDENT","TEACHER").anyRequest().authenticated().and().httpBasic();
}
}
@Configuration
public static class FormLoginWebSecurityConfigurerAdapter extends WebSecurityConfigurerAdapter {
@Override
protected void configure(HttpSecurity http) throws Exception {
//Para poder hacer POST en rest
http.csrf().disable();
http
.authorizeRequests()
.antMatchers("/forgotPassword", "/passwordReset", "/register", "/resources/**", "/js/**", "**/js/**", "/static/**", "/login" ,"/").permitAll()
.antMatchers("/admin/**").hasAuthority(ROLE_ADMIN)
.antMatchers("/teacher/**").hasAuthority(ROLE_TEACHER)
.antMatchers("/student/**").hasAuthority(ROLE_STUDENT)
.antMatchers("/**").hasAnyAuthority(ROLE_TEACHER, ROLE_ADMIN, ROLE_STUDENT)
//.antMatchers("/").permitAll()
.anyRequest().authenticated()
.and()
.formLogin()
.loginPage("/login").permitAll()
.successHandler(successHandler())
.permitAll()
.and()
.logout()
.permitAll();
}
private AuthenticationSuccessHandler successHandler() {
SimpleUrlAuthenticationSuccessHandler handler = new SimpleUrlAuthenticationSuccessHandler();
handler.setDefaultTargetUrl("/home");
return handler;
}
}
}
Espero que podáis ayudarme ya que llevo bastante tiempo intentando solucionar este error. ¡Un saludo y gracias de antemano!