Configuring Multiple Spring Security

Question

I have the following configuration

@Configuration
@EnableWebSecurity
public class SecurityConfig {

    @Configuration
    @Order(1)
    public static class SamlConfig extends WebSecurityConfigurerAdapter {
        
        @Value("${enable_csrf}")
        private Boolean enableCsrf;

        @Autowired
        private SamlUserService samlUserService;

        public SamlWebSecurityConfig() {
            super();
        }

        @Override
        protected void configure(HttpSecurity http) throws Exception {
            http
                    .authorizeRequests()
                    .antMatchers("/secure/sso").permitAll()
                    .antMatchers("/saml/**").permitAll()
                    .anyRequest().authenticated()
                    .and()
                    .apply(saml())
                    .userDetailsService(samlUserService)
                    .serviceProvider()
                    .keyStore()
                    .storeFilePath("path")
                    .password("password")
                    .keyname("alias")
                    .keyPassword("password")
                    .and()
                    .protocol("https")
                    .hostname(String.format("%s:%s","localhost", "8080"))
                    .basePath("/")
                    .and()
                    .identityProvider()
                    .metadataFilePath("metadata");
            if(!enableCsrf) {
                http.csrf().disable();
            }
        }
    }

    @Configuration
    @Order(2)
    public static class BasicConfig extends WebSecurityConfigurerAdapter {
        
        public BasicWebSecurityConfig() {
            super();
        }
        protected void configure(HttpSecurity http) throws Exception {
            http.
                    .authorizeRequests()
                    .antMatchers("/secure/basic").permitAll()
                    .anyRequest().authenticated();
            if(!enableCsrf) {
                http.csrf().disable();
            }
        }
    }

This works for the saml, but the basic login error "403 forbidden". I modified the BasicConfig with this, and saml doesn't work anymore but Basic works. All the endpoints are for both saml and basic, just different login page.

public static class BasicConfig extends WebSecurityConfigurerAdapter {
        
        public BasicWebSecurityConfig() {
            super();
        }
        protected void configure(HttpSecurity http) throws Exception {
            http.
                    .authorizeRequests()
                    .antMatchers("/secure/basic").permitAll()
                    .antMatchers("/**").permitAll()
                    .anyRequest().authenticated();
            if(!enableCsrf) {
                http.csrf().disable();
            }
        }
    }

For some reasons sometimes it works, sometimes not. I also tried to modify the @Order and till not working.

Answer 1

In Spring Security, there are two things that are alike but do things completely differently, requestMatchers().antMatchers() and authorizeRequests().antMatchers() .

The requestMatchers tells HttpSecurity to only invoke the SecurityFilterChain if the provided RequestMatcher was matched.

The authorizeRequests allows restricting access based upon the HttpServletRequest using RequestMatcher implementations.

In your case, you have two SecurityFilterChain s. But only the one with the highest priority is being invoked, this happens because you did not give any requestMatchers to it, therefore it will match every request. And only one SecurityFilterChain is called per request, thus it will not invoke the next one.

So, you should inform the requestMatchers for your configurations, like so:

http
        .requestMatchers((requests) -> requests
                .antMatchers("/secure/sso", "/saml/**")
        )
        .authorizeRequests()
        .antMatchers("/secure/sso").permitAll()
        .antMatchers("/saml/**").permitAll()
        .anyRequest().authenticated()
        ...

http
         .requestMatchers((requests) -> requests
                .antMatchers("/secure/basic", "/**")
         )
         .authorizeRequests()
         .antMatchers("/secure/basic").permitAll()
         .anyRequest().authenticated();