Spring Boot Security WebFlux functional, cannot created configuration for two authentication methods

Viewed 330

I would like to have two ways of authentication in Spring Boot application. App is written with WebFlux and with functional approach. For some of my endpoints I'd like to have authentication with basicHttp and for some endpoints I would like to have JWT authentication using custom HTTP header. However I cannot merge two WebFilterChains or make it work as one. Only one of the methods works at the time, cannot make them both work. Code for JWT is not finished, but I would like to see 401 when I send request with httpBasic auth method. Paths in examples are fake.

My atttemps:

1)

First bean:

          http
            .securityMatcher(ServerWebExchangeMatchers.pathMatchers(HttpMethod.GET, "/api/1/**"))
            .csrf().disable()
            .formLogin().disable()
            .logout().disable()
            .httpBasic().and()
            .authenticationManager(authenticationManager(userService))
            .build();

Second bean:

          http
            .securityMatcher(ServerWebExchangeMatchers.pathMatchers("/api/2/**"))
            .httpBasic().disable()
            .csrf().disable()
            .formLogin().disable()
            .logout().disable()
            .authenticationManager(tokenAuthManager)
            .authorizeExchange()
            .anyExchange().authenticated()
            .and()
            .build();

2)

           http
            .securityMatcher(ServerWebExchangeMatchers.pathMatchers(HttpMethod.GET, "/api/1/**"))
            .csrf().disable()
            .formLogin().disable()
            .logout().disable()
            .httpBasic().and()
            .authenticationManager(authenticationManager(userService))
            .securityMatcher(ServerWebExchangeMatchers.pathMatchers("/api/2/**"))
            .httpBasic().disable()
            .csrf().disable()
            .formLogin().disable()
            .logout().disable()
            .authenticationManager(tokenAuthManager)
            .authorizeExchange()
            .anyExchange().authenticated()
            .and()
            .build();
0 Answers
Related