Spring Security oauth并关闭某些URL的安全性，但保持基本身份验证处于激活状态

Question

I have project with working spring security oauth2.

The HttpSecurity Config looks like this:

http.antMatcher("/**").authorizeRequests().antMatchers(RESOURCE_LOCATIONS).permitAll().and()
            .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.NEVER)
            .and().httpBasic().disable()
            .authorizeRequests().anyRequest().authenticated();

With this set up, any request except the urls below RESOURCE_LOCATIONS are secured by ouath2 protocol. HTTP Basic is turned off for those requests.

Now I want to have urls below /internal/** being secured, but only via HTTP Basic auth.

I am trying something like this or similar approaches:

http.antMatcher("/**").authorizeRequests().antMatchers(RESOURCE_LOCATIONS).permitAll().and()
            .antMatcher("/internal/**").httpBasic().and() //<--ADDED THIS LINE
            .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.NEVER)
            .and().httpBasic().disable()
            .authorizeRequests().anyRequest().authenticated();

but it surprisingly then ALL requests are public and without basic auth.

Does anyone have a hint to solve this?

BR, Michael

Answer 1

Well,

If you want to have url /internal/** being secured the better form is with hasRole('') and httpBasic. Your application and that needs to be authenticated by simple HTTP basic authentication. But other web pages should not be using HTTP basic but rather a the normal form login. So you can create a WebSecurity just to url 'Internal' like below. I hope this can help you!

@Configuration
@Order(1)
public static class InternalWebSecurityConfig extends WebSecurityConfigurerAdapter{
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.csrf().disable()
                .antMatcher("/internal/**")
                .authorizeRequests()
                    .anyRequest().hasAnyRole("ADMIN", "USER")
                    .and()
                .httpBasic();
    }
}