Spring Security Web + OAuth2

Question

I'm trying to integrate both normal forms + session login and OAuth2 in the same Spring Boot MVC application. This may be my misunderstanding of how the Spring Security configuration works. I've also tried to adapt the config in the Sparklr sample app but I just can't work it out.

I would like any url matching "/web/**" to be authenticated with forms login (including the redirect to the login page) except "resources/**", "/web/register" and of course "/login" I also need any url matching "/api/**" to require an OAuth2 token except "/api/register"

Currently it seems that only the ResourceServerConfigurerAdapter is taking effect. I have tried numerous combinations of rules but I cannot seem to get the effect that I want. When looking at the debug output I can see it attempting to match the OAuth endpoints and then my API endpoints but not any web endpoints.

If I get the forms login working then the urls I need to be secured by OAuth2 allow anonymous access. Any help in understanding this/getting it to work is appreciated.

Here's my configuration:

@Configuration
@EnableWebSecurity
public class SecurityConfiguration extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
                .authorizeRequests()
                .antMatchers("/login", "/resources/**", "/web/register").permitAll()
                //.anyRequest().authenticated()
                .antMatchers("/web/**").authenticated()
                .and()
                .exceptionHandling().accessDeniedPage("/login?authorization_error=true")
                .and()
                .csrf().requireCsrfProtectionMatcher(new AntPathRequestMatcher("/api/users/register")).disable()
                .logout().logoutUrl("/logout").logoutSuccessUrl("/login")
                .and()
                .formLogin().loginProcessingUrl("/login").failureUrl("/login?authorization_error=true").defaultSuccessUrl("/web/home").loginPage("/login");
    }

    @Autowired
    private CustomDetailsService userDetailsService;

    @Autowired
    private PasswordEncoder passwordEncoder;

    @Autowired
    public void globalUserDetails(AuthenticationManagerBuilder auth) throws Exception {
                auth.userDetailsService(userDetailsService).passwordEncoder(passwordEncoder);
    }

    @Override
    @Bean
    public AuthenticationManager authenticationManagerBean() throws Exception {
        return super.authenticationManagerBean();
    }
}

@Configuration
public class OAuth2ServerConfig {

    private static final String TEST_RESOURCE_ID = "test";

    @Configuration
    @EnableResourceServer
    protected static class ResourceServerConfiguration extends ResourceServerConfigurerAdapter {

        @Override
        public void configure(ResourceServerSecurityConfigurer resources) {
            resources.resourceId(TEST_RESOURCE_ID).stateless(false);             }

        @Override
        public void configure(HttpSecurity http) throws Exception {


            http
//                     Since we want the protected resources to be accessible in the UI as well we need
//                     session creation to be allowed (it's disabled by default in 2.0.6)
                    .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.IF_REQUIRED)
                    .and().authorizeRequests()
                    .antMatchers("/api/users/register").permitAll()
                    .antMatchers("/api/**").access("#oauth2.isOAuth() and hasRole('ROLE_USER')")
            ;
        }
    }

    @Configuration
    @EnableAuthorizationServer
    protected static class AuthorizationServerConfiguration extends AuthorizationServerConfigurerAdapter {

        @Autowired
        private TokenStore tokenStore;

        @Autowired
        private UserApprovalHandler userApprovalHandler;

        @Autowired
        @Qualifier("authenticationManagerBean")
        private AuthenticationManager authenticationManager;

        @Autowired
        private CustomUserDetailsService userDetailsService;

        @Override
        public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
            clients.inMemory().withClient("testapp")
                    .resourceIds(TEST_RESOURCE_ID)
                    .authorizedGrantTypes("authorization_code", "refresh_token",
                            "password")
                    .authorities("USER")
                    .scopes("read", "write")
                    .secret("secret");
        }

        @Bean
        public TokenStore tokenStore() {
            return new InMemoryTokenStore();
        }

        @Override
        public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {
            endpoints
                    .tokenStore(tokenStore)
                    .userApprovalHandler(userApprovalHandler)
                    .authenticationManager(authenticationManager)
                    .userDetailsService(userDetailsService);
        }

        @Bean
        @Primary
        public DefaultTokenServices tokenServices() {
            DefaultTokenServices tokenServices = new DefaultTokenServices();
            tokenServices.setSupportRefreshToken(true);
            tokenServices.setTokenStore(this.tokenStore);
            return tokenServices;
        }
        @Override
        public void configure(AuthorizationServerSecurityConfigurer oauthServer) throws Exception {
            oauthServer.realm("test/client");
        }
    }

    protected static class Approvals {

        @Autowired
        private ClientDetailsService clientDetailsService;

        @Autowired
        private TokenStore tokenStore;

        @Bean
        public ApprovalStore approvalStore() throws Exception {
            TokenApprovalStore store = new TokenApprovalStore();
            store.setTokenStore(tokenStore);
            return store;
        }

        @Bean
        @Lazy
        @Scope(proxyMode = ScopedProxyMode.TARGET_CLASS)
        public CustomUserApprovalHandler userApprovalHandler() throws Exception {
            CustomUserApprovalHandler handler = new CustomUserApprovalHandler();
            handler.setApprovalStore(approvalStore());
            handler.setRequestFactory(new DefaultOAuth2RequestFactory(clientDetailsService));
            handler.setClientDetailsService(clientDetailsService);
            handler.setUseApprovalStore(true);
            return handler;
        }
    }
}

Answer 1

See Multiple HttpSecurity

Create another instance of WebSecurityConfigurerAdapter. If the URL does not start with /api/ this configuration will be used. This configuration is considered after ApiWebSecurityConfigurationAdapter since it has an @Order value after 1 (no @Order defaults to last).

@EnableWebSecurity
public class MultiHttpSecurityConfig {
    @Autowired
    public void configureGlobal(AuthenticationManagerBuilder auth) { 
        auth
            .inMemoryAuthentication()
                .withUser("user").password("password").roles("USER").and()
                .withUser("admin").password("password").roles("USER", "ADMIN");
    }

    @Configuration
    @Order(1)                                                        
    public static class ApiWebSecurityConfigurationAdapter extends WebSecurityConfigurerAdapter {
        protected void configure(HttpSecurity http) throws Exception {
            http
                .antMatcher("/api/**")                               
                .authorizeRequests()
                    .anyRequest().hasRole("ADMIN")
                    .and()
                .httpBasic();
        }
    }

    @Configuration                                                   
    public static class FormLoginWebSecurityConfigurerAdapter extends WebSecurityConfigurerAdapter {

        @Override
        protected void configure(HttpSecurity http) throws Exception {
            http
                .authorizeRequests()
                    .anyRequest().authenticated()
                    .and()
                .formLogin();
        }
    }
}

You should specify antMatcher in your ResourceServerConfigurerAdapter http block:

@Override
public void configure(HttpSecurity http) throws Exception {
    http.sessionManagement().
            sessionCreationPolicy(SessionCreationPolicy.STATELESS);
    http.antMatcher("/api/**").authorizeRequests()
            .antMatchers("/api/register").permitAll()

            ......

            .expressionHandler(webExpressionHandler());
    http.csrf().disable();
    http.exceptionHandling().authenticationEntryPoint(new OAuth2AuthenticationEntryPoint());

}

Hope it helps