spring security config xml to java

Question

please can somebody help me with migration from xml based spring configuration to java based?

here is my xml config:

<!--suppress SpringFacetInspection, SpringSecurityFiltersConfiguredInspection -->
<beans:beans xmlns="http://www.springframework.org/schema/security"
             xmlns:beans="http://www.springframework.org/schema/beans"
             xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
             xmlns:context="http://www.springframework.org/schema/context"
             xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-4.0.xsd
                                 http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.2.xsd http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd">


    <global-method-security pre-post-annotations="enabled"/>
    <context:annotation-config/>
    <context:spring-configured/>


    <beans:bean name="userLoginService" class="service.UserLoginService"/>

    <beans:bean name="standardPasswordEncoder"
                class="org.springframework.security.crypto.password.StandardPasswordEncoder">
        <beans:constructor-arg name="secret" value="supersecret"/>
    </beans:bean>

    <http auto-config="true" use-expressions="true">
        <intercept-url pattern="/javax.faces.resources/**" access="permitAll"/>
        <intercept-url pattern="/view/unsecured/**" access="permitAll"/>
        <intercept-url pattern="/view/secured/**" access="isAuthenticated()" />
        <intercept-url pattern="/view/admin/**" access="hasRole('ROLE_SUPERUSER')"/>
        <intercept-url pattern="/admin/**" access="hasRole('ROLE_SUPERUSER')"/>

        <form-login login-page="/view/unsecured/login.xhtml"/>
        <logout logout-success-url="/index.xhtml" invalidate-session="true" delete-cookies="true"/>
    </http>

    <authentication-manager alias="authenticationManager">
        <authentication-provider user-service-ref="userLoginService">
            <password-encoder ref="standardPasswordEncoder"/>
        </authentication-provider>
    </authentication-manager>

</beans:beans>

and here is my java attempt:

@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

    @Bean(name = "standardPasswordEncoder")
    public PasswordEncoder standardPasswordEncoder() {
        return new StandardPasswordEncoder("supersecret");
    }

    @Bean(name = "userDetailService")
    @Override
    public UserDetailsService userDetailsServiceBean() {
        return new UserLoginService();
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
                //.userDetailsService(userDetailsService())
                .authorizeRequests()
                .antMatchers("/view/secured/**").fullyAuthenticated()
                .antMatchers("/admin/**", "/view/admin/**").access("hasRole('ROLE_SUPERUSER')")
                .antMatchers("/index.xhtml", "/view/unsecured/**", "/javax.faces.resources/**").permitAll()
                .and()
                .formLogin().loginPage("/view/unsecured/login.xhtml")
                .usernameParameter("email").passwordParameter("password")
                .and()
                .logout().logoutSuccessUrl("/index.xhtml").invalidateHttpSession(true).deleteCookies("JSESSIONID")
                .and()
                .exceptionHandling().accessDeniedPage("/error.xhtml")
                .and()
                .csrf().disable();
    }

    @Autowired
    public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
        auth.userDetailsService(userDetailsService()).passwordEncoder(standardPasswordEncoder());
    }
}

When I try to login I get exception

Caused by: java.lang.StackOverflowError: null
        at org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter$UserDetailsServiceDelegator.loadUserByUsername(WebSecurityConfigurerAdapter.java:386)
        at org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter$UserDetailsServiceDelegator.loadUserByUsername(WebSecurityConfigurerAdapter.java:387)
...

What am I missing, or what's wrong? Thanks

Answer 1

Override the userDetailsService() method, not the userDetailsServiceBean() method. That's what is causing your infinite recursion. And no need to declare that as a @Bean then.

Should just be:

@Override
public UserDetailsService userDetailsService() {
    return new UserLoginService();
}

---

Alternatively - if you have a @Service annotation on your UserLoginService (and a component-scan that will pick up that class), you can avoid the manual bean creation and just inject your UserLoginService straight into your configuration method:

@Autowired
public void configureGlobal(AuthenticationManagerBuilder auth, UserLoginService userDetailsService) throws Exception {
    auth.userDetailsService(userDetailsService).passwordEncoder(standardPasswordEncoder());
}

Then you wouldn't need to override userDetailsServiceBean or userDetailsService : as all they are doing is creating an instance of that bean.