I set a parent to my Authentication Manager in Spring security but it didn't work

user_17278011 0
Viewed 583

I am trying to practice spring security and this is my spring security configuration

@Configuration
@EnableWebSecurity
public class ProjectConfig extends WebSecurityConfigurerAdapter {

  @Autowired
  AuthenticationProvider authenticationProvider;

  @Autowired
  AuthenticationManagerBuilder builder;

  @Bean
  public AuthenticationManager global() throws Exception {
    builder
        .inMemoryAuthentication()
        .passwordEncoder(NoOpPasswordEncoder.getInstance())
        .withUser("admin")
        .password("123")
        .authorities(() -> "ADMIN");
    return builder.build();
  }

  @Override
  protected void configure(HttpSecurity http) throws Exception {
    http
        .antMatcher("/hello")
        .authorizeRequests()
        .anyRequest()
        .authenticated();
  }

  @Bean
  @Override
  public AuthenticationManager authenticationManagerBean() throws Exception {
    return super.authenticationManagerBean();
  }

  @Override
  protected void configure(AuthenticationManagerBuilder auth) throws Exception {

    auth.authenticationProvider(authenticationProvider);
    auth.parentAuthenticationManager(global());
  }
}

and this is my custom authentication provider:

@Component
public class CustomProvider implements AuthenticationProvider {

  @Override
  public Authentication authenticate(Authentication authentication) throws AuthenticationException {
    return BadCredentialsException("error");
  }

  @Override
  public boolean supports(Class<?> authentication) {
    return true;
  }
}

I read about how we can create a parent for authentication manager and tried to test it. every time I make a request using Postman I get 403 error. what is wrong with my configuration? Postman

spring-boot spring-security java
1 Answers

First Spring uses ProviderManager class as the implementation of AuthenticationManager interface and if you see the implementation of the authenticate method you figure out that it only uses parent authentication manager if the child result is null not exception in your case.

if (result == null && this.parent != null) {
            // Allow the parent to try.
            try {
                parentResult = this.parent.authenticate(authentication);
                result = parentResult;
            }
  // other stuff
}

so change the following code in CustomProvider to returns null

  @Override
  public Authentication authenticate(Authentication authentication) throws AuthenticationException {
    return AuthenticationException("error");
  }

also from the image I noticed you are using http basic authentication but you didn't enable it in your configuration.

http
    .antMatcher("/hello")
    .authorizeRequests()
    .anyRequest()
    .authenticated()
    .and()
    .httpBasic();
user_78381690
Related