0

Base on this Answer, I'm trying to secure everything but the login page in my spring app.

So I'm using this Java configuration files for OAuth2

The extends for the ResourceServerConfigurerAdapter:

@Override
public void configure(final HttpSecurity http) throws Exception {
    http
        .requestMatchers()
        .antMatchers("/**")
    .and()
        .authorizeRequests()
        .anyRequest()
        .authenticated()
        .antMatchers("/login")
        .permitAll()

The extends for OAuth2SsoConfigurerAdapter {

 @Override
 public void match(RequestMatchers matchers) {
     matchers.antMatchers("/login");
 }

 @Override
 public void configure(HttpSecurity http) throws Exception {
     http
        .authorizeRequests()                    
        .anyRequest()       
        .authenticated()
}

So, what I looking for is to have a http 401 for every request but for /login.

If a login request is perform the @EnableOAuth2Sso annotation would be used to redirect it to the OAuth2 server.

Update 1

After changing the order of the filter ResourceServerConfigurerAdapter, the /login request is not found.

  http
  .requestMatchers()
    .antMatchers("/**")
    .and()
.authorizeRequests()
    .antMatchers("/login")
    .permitAll()
    .anyRequest()
    .authenticated()

This request would be Unauthorized because any token is provided

  • ~/ http 401 Unauthorized (good)
  • ~/resource http 401 Unauthorized (good)

But the login page is not found:

~/login http 404 Not Found (bad)

The correct functionality should be a http 302 redirection to the OAuth2 server when the ~/login is hit.

Community
  • 1
  • 1
Coyolero
  • 2,353
  • 4
  • 25
  • 34
  • 2
    Switch the order. The order in which you specify matchers is also the order they are consulted in. The first match wins, in your case that is `anyRequest()` the `/login` one is never going to be consulted. – M. Deinum Jul 24 '15 at 16:48
  • thanks @M. Deinum it makes sense. I think that was one of the problems, but now the `/login` page is not found. It's like the `OAuth2SsoConfigurerAdapter` configuration were overridden, – Coyolero Jul 24 '15 at 17:19

0 Answers0