My AuthSecurityConfiguration class has SecurityFilterChain method ->
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
http
.authorizeHttpRequests((authorize) -> .. my auth path
.csrf((csrf) -> csrf.ignoringAntMatchers(path))
.httpBasic(Customizer.withDefaults())
.oauth2ResourceServer(OAuth2ResourceServerConfigurer::jwt)
.sessionManagement((session) -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
.exceptionHandling((exceptions) ->
exceptions
.authenticationEntryPoint(jwtAuthenticationSecurityError)
.accessDeniedHandler(jwtAuthenticationSecurityError)
);
return http.build();
}
I have a separate class which implements AuthenticationEntryPoint , AccessDeniedHandler interfaces and I have logged error there.
@Override
public void commence(HttpServletRequest request, HttpServletResponse response,
AuthenticationException authException) throws IOException, ServletException {
log.error("Unauthorized Request commence.");
resolver.resolveException(request, response, null, authException);
}
@Override
public void handle(HttpServletRequest request, HttpServletResponse response,
AccessDeniedException accessDeniedException) throws IOException, ServletException {
log.error("Unauthorized Request handle.");
response.sendError(401, "Unauthorized cred");
}
Below is my InMemoryUserDetailsManager
@Bean
public InMemoryUserDetailsManager tempDetailsManager() {
PasswordEncoder encoder = PasswordEncoderFactories.createDelegatingPasswordEncoder();
List<com.asite.iotpoc.configuration.AuthUser.User> userList = authUser.getUsers();
List<UserDetails> userDetails = userList.stream().map(user ->
User
.withUsername(user.getName())
.password(user.getPassword())
.passwordEncoder(encoder::encode)
.authorities(user.getAuthority())
.build()
).collect(Collectors.toList());
return new InMemoryUserDetailsManager(userDetails);
}
I want to log error in case of password mismatch during authorization. I want to know how username and passwords are compared and how can I log error if username/password mismatch is there. Also I have tried implementing AuthenticationFailureHandler but that also didn't work, So if this is the right was how do I implement this?