Spring Security XML Config Vs Java Config

Question

I have XML config for Spring Security, that I've made through tonnes of guides. It supposed to intercepts url and with custom filters provide authentication with ldap authentication manager.

So here it is:

   <http create-session="stateless" auto-config='false' use-expressions="true">
    <anonymous enabled="true"/>
    <intercept-url pattern="/index.html" access="permitAll()" method="GET"/>
    <intercept-url pattern="/login" access="permitAll()" method="GET"/>


    <custom-filter before="LAST" ref="statelessLoginFilter"/>
    <custom-filter before="PRE_AUTH_FILTER" ref="statelessAuthFilter"/>

    <intercept-url pattern="/one*" access="hasRole('ROLE_ONE')" method="GET"/>
    <intercept-url pattern="/two*" access="hasRole('ROLE_TWO')" method="GET"/>

    <!-- another intercept-url stuff -->

    <csrf disabled="true"/>

    <!-- authentication manager and stuff -->
</http>

Right now I'm trying to rewrite it with Java Config. But I can't get how to use custom filters in there. There's .addFilterBefore but I can't just put before="LAST" or before="PRE_AUTH_FILTER" there. Because there's no such thing. How can I rewrite this?

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

@Autowired
GenericFilterBean statelessAuthFilter;
@Autowired
AbstractAuthenticationProcessingFilter statelessLoginFilter;

public  SecurityConfig(){

}

@Override
protected void configure(HttpSecurity http) throws Exception {
    http
            .authorizeRequests()
            .antMatchers("/one**", "/two**").access("hasRole('ONE')")
            .antMatchers("/login").permitAll()
            .anyRequest().authenticated()

            .and()
            .addFilterBefore(statelessAuthFilter, GenericFilterBean.class)
            .addFilterBefore(statelessLoginFilter, BasicAuthenticationFilter.class)
            .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS)

            .and().anonymous()
            .and().csrf().disable();
}}

OrangeDog · Accepted Answer · 2016-06-22 14:11:39Z

4

You have to identify the specific filter classes.

For example, the default LAST filter should be FilterSecurityInterceptor - Filter Ordering.

The PRE_AUTH_FILTER could be anything extending AbstractPreAuthenticatedProcessingFilter, depending on what you've configured.

Basically, the Java Config forces you to be explicit in your ordering, to avoid nasty surprises later.

answered Jun 22, 2016 at 14:11

OrangeDog

39.3k18 gold badges141 silver badges227 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Spring Security XML Config Vs Java Config

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related