Spring Boot Role Based Authentication

Question

I have a problem concerning Spring Boot role based authentication. Basically, I would like to have users and admins and I want to prevent users from accessing admin resources. So I created a SecurityConfig class:

package test;

import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.config.annotation.web.servlet.configuration.EnableWebMvcSecurity;

@Configuration
@EnableWebMvcSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

   @Override
   protected void configure(AuthenticationManagerBuilder auth) throws Exception {
       auth.inMemoryAuthentication()
           .withUser("user1").password("password1").roles("USER, ADMIN")
           .and()
           .withUser("user2").password("password2").roles("USER");
   }

   @Override
   protected void configure(HttpSecurity http) throws Exception {
       http.authorizeRequests()
           .antMatchers("/service/test").access("hasRole('USER') or hasRole('ADMIN')")
           .antMatchers("/service/admin").access("hasRole('ADMIN')");
   }
}

This is my little REST service:

package test;

import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RequestMethod;
import org.springframework.web.bind.annotation.RestController;

@RestController
@RequestMapping("/service")
public class RestService {

    @RequestMapping(value = "/test", method = RequestMethod.GET)
    public String echo() {
        return "This is a test";
    }

    @RequestMapping(value = "/admin", method = RequestMethod.GET)
    public String admin() {
        return "admin page";
    }
}

And my Application class:

package test;

import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.EnableAutoConfiguration;
import org.springframework.boot.autoconfigure.SpringBootApplication;

@SpringBootApplication
@EnableAutoConfiguration 
public class Application {

    public static void main(String[] args) {
        SpringApplication.run(Application.class, args);
    }
}

Unfortunately, I always get a 403 "forbidden/access denied" error message when executing "curl user1:password1@localhost:8080/service/admin"... Did I miss anything in the configure method?

Thank you very much in advance!

Answer 1

Can you please check this.

withUser("user1").password("password1").roles("USER", "ADMIN")

write "USER" and "ADMIN" in separate qoutes.

Answer 2

I changed it in the following way, now it seems to be working:

@Configuration
@EnableWebMvcSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

     @Autowired
     protected void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
         auth.inMemoryAuthentication()
            .withUser("user1").password("password1").roles("USER", "ADMIN")
            .and()
            .withUser("user2").password("password2").roles("USER");
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.formLogin().permitAll()
            .and()
            .authorizeRequests()
            .antMatchers("/service/test").hasAnyRole("USER", "ADMIN")
            .antMatchers("/service/admin").hasRole("ADMIN")
            .anyRequest().authenticated();
    }
}

Thank you very much for your answers!

Answer 3

following setup works fine for my spring boot app:

http.authorizeRequests()
            .antMatchers(HttpMethod.OPTIONS, "/**").permitAll()//allow CORS option calls
            .antMatchers("/home", "/").hasAnyAuthority(Role.ROLE_ADMIN, Role.ROLE_USER)
            .antMatchers("/admin").hasAuthority(Role.ROLE_ADMIN)enter code here