How to assign auth success handler to multiple spring security realms

Question

I have the following Spring security configuration class for two separate security realms, the admin area and the frontend area:

@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled=true)
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
    @Autowired
    private CustomUserDetailsServiceImpl userDetailsService;

    @Configuration
    @Order(1)
    public static class AdminAreaConfiguration  extends WebSecurityConfigurerAdapter {
        @Autowired
        private AuthSuccessAdmin authSuccessAdmin; 

        @Override
        protected void configure(HttpSecurity http) throws Exception {
            http
                .requestMatcher(new AntPathRequestMatcher("/admin/**"))
                .csrf().disable()  
                .authorizeRequests()
                    .antMatchers("/admin/login/login.html").permitAll()
                    .antMatchers("/admin/**").hasRole("ADMIN")
                    .anyRequest().authenticated()
                    .and()
                .formLogin()
                    .loginPage("/admin/login.html")
                    .permitAll()
                    .successHandler(authSuccessAdmin)
                    .and()
                .logout()
                    .permitAll();

        }
    }

    @Configuration
    @Order(2)
    public static class UserAreaConfiguration  extends WebSecurityConfigurerAdapter {

        @Autowired
        private AuthSuccessFrontend authSuccessFrontend;

        @Override
        protected void configure(HttpSecurity http) throws Exception {

            http
                    .requestMatcher(new AntPathRequestMatcher("/**"))
                    .csrf().disable()  
                    .authorizeRequests()
                        .antMatchers("/about", "/register").permitAll()
                        .antMatchers("/**").hasRole("USER")
                        .anyRequest().authenticated()
                        .and()
                    .formLogin()
                        .loginPage("/login")
                        .permitAll()
                        .successHandler(authSuccessFrontend)
                        .and()
                    .logout()
                        .permitAll();
        }
    }
}

When the app is started, the authentication success handler of the admin area is overwritten by the authentication handler of the frontend area, which is loaded after the first. This results in a wrong redirect when logging into the admin area (redirects to url defined in the frontend auth success handler). How can I assign disctinct handlers to the separate configurations?

Answer 1

The issue seems to be in RequestMatcher pattern. Your USER app has the RequestMatcher pattern '/**'(means anything after / which will include path /admin as well) which will override your ADMIN RequestMatcher pattern /admin/** Change the user RequestMatcher to /user/**