Spring Boot - Disable default login page

Viewed 88

I'm currently working on a small Project. I want to use keycloak as authorization server and my applicationn as spring gateway and oauth2 client.

Here is the Problem:

When entering a endpoint, i get redirected to the keycloak login page witch is fine. But whenever i enter the endpoint "localhost:9090/login" i get to the default oauth2 login page: Login page

Since i use oauth2 client dependency and using ServerHttpSecurity instead of HttpSecurity, i cannot use:

httpSecurity
        .oauth2Login()
        .loginPage("/redirect");

Here is my current configration:

If you have Questions, i pushed the demo into this github repo

Gateway pom.xml

    <parent>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-parent</artifactId>
        <version>2.7.3</version>
        <relativePath/> <!-- lookup parent from repository -->
    </parent>

    <groupId>at.matkollin</groupId>
    <artifactId>spring-demo</artifactId>
    <version>1.0.0-SNAPSHOT</version>

    <properties>
        <java.version>17</java.version>
        <spring-cloud.version>2021.0.1</spring-cloud.version>
    </properties>

    <dependencies>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-oauth2-client</artifactId>
        </dependency>
        <dependency>
            <groupId>org.springframework.cloud</groupId>
            <artifactId>spring-cloud-starter-gateway</artifactId>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-actuator</artifactId>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-test</artifactId>
            <scope>test</scope>
        </dependency>
    </dependencies>

Gateway application.yaml:

spring:
  security:
    oauth2:
      client:
        registration:
          keycloak-spring-gateway-client:
            provider: my-keycloak-provider
            scope: openid
            client-id: spring-gateway-client
            client-secret: xxxxxxxxxx
            authorization-grant-type: authorization_code
            redirect-uri: "{baseUrl}/login/oauth2/code/keycloak"
        provider:
          my-keycloak-provider:
            issuer-uri: http://172.31.0.2:8080/realms/Demo
            token-uri: http://172.31.0.2:8080/auth/realms/Demo/protocol/openid-connect/token
            authorization-uri: http://172.31.0.2:8080/auth/realms/Demo/protocol/openid-connect/auth
            userinfo-uri: http://172.31.0.2:8080/auth/realms/Demo/protocol/openid-connect/userinfo
            user-name-attribute: preferred_username

server:
  port: 9090

management:
  endpoints:
    web:
      exposure:
        include: "*"

Security Config:

@Configuration
public class SecurityConfig {

    @Bean
    public SecurityWebFilterChain springSecurityFilterChain(ServerHttpSecurity http) {
        http
                        .authorizeExchange()
                        .pathMatchers("/actuator/**", "/")
                        .permitAll()
                        .and()
                        .authorizeExchange()
                        .anyExchange()
                        .authenticated()
                        .and()
                        .oauth2Login();

        return http.build();
    }
1 Answers

You can disable it with following configuration

spring.autoconfigure.exclude[0]=org.springframework.boot.autoconfigure.security.servlet.SecurityAutoConfiguration
spring.autoconfigure.exclude[1]=org.springframework.boot.actuate.autoconfigure.security.servlet.ManagementWebSecurityAutoConfiguration

Second line is to disable actuator security

Related