Spring Security中的IP身份验证

Question

I have Spring Security 4.2.2 in my web-app and configured LDAP based authentication. In addition i also need to authenticate all users with specified ip without log-in form and set the "local_user" role for them. How can i perform that authentication scenario?

upd: I mean, that "local users" must view the same content as the users that have authorized through login form.

Answer 1

You can do that using antMatchers like below code:

    @EnableWebSecurity
    @Configuration
    public class BasicSecurityConfig extends WebSecurityConfigurerAdapter{

    @Override
    protected void configure(HttpSecurity http) throws Exception {
         http.authorizeRequests().antMatchers("/baseUrl/anything-else/**").hasIpAddress("ipAddressExpression")
    }
}

Updated

http.authorizeRequests()
        .antMatchers("/baseUrl/anything-else/**").access("hasIpAddress('ipAddressExpression') or fullyAuthenticated()");