Configuring Spring Security for Oauth and Http Basic authentication

Question

Within my Spring-Boot app using spring-security, I would like have some REST calls (API) to be authenticated via http basic authentication only, but all other requests should be handled via OAUTH2 (standard Oauth2 webapp with redirection to an authorization endpoint).

Http basic authentication is activated using http.httpBasic(), and oauth is activated using the @EnableOAuth2Sso annotation. But with the following configuration also my API calls are redirected to the authorization endpoint, which is not what I am aiming for. Any ideas?

@EnableOauth2Sso
@Configuraiton
@EnableWebSecurity
public class SecurityConfig {
  @Override
  protected void configure(HttpSecurity http) throws Exception {
    http.httpBasic().and().authorizeRequests().anyRequest().authenticated();
  }
}

Answer 1

您可以使用authorizeRequests（）。antMatchers（）并基于URI模式对基于OAuth或Http基本安全性的资源进行分类。