multiple entry points in spring security

Question

I have a spring boot application that should allow form based authentication against database and SSO CAS based authentication.

I have followed the example from here (https://www.baeldung.com/spring-security-multiple-entry-points) and seems to me that Order is not working as expected. it is always using the one that is annotated as Order(1) as entry point.

here is my code,

@Configuration
@EnableWebSecurity
public class SecurityConfig {

    @Configuration
    @Order(2)
    public static class WebSecurityCASConfig extends WebSecurityConfigurerAdapter {
        public WebSecurityCASConfig() {
            super();
        }

        @Autowired 
        private AuthenticationEntryPoint authenticationEntryPoint;



        @Override
        protected void configure(HttpSecurity http) throws Exception {

            http

            .authorizeRequests()
            .antMatchers(
                    "/js/**",
                    "/css/**",
                    "/images/**").permitAll()
            .regexMatchers("/login1")
            .authenticated()
            .and()
            .authorizeRequests()
            .and()
            .httpBasic()
            .authenticationEntryPoint(authenticationEntryPoint);


        }


    }



    //second

    @Configuration
    @Order(1)
    public static class WebSecurityDatabaseConfig extends WebSecurityConfigurerAdapter {

        public WebSecurityDatabaseConfig() {
            super();
        }

        @Autowired                                                                                                                                                                                                                                                                      
        UserDetailServiceImpl userDetailsService;

        @Autowired   
        BCryptPasswordEncoder passwordEncoder;




        @Autowired
        public void configure(AuthenticationManagerBuilder auth) throws Exception { 

            auth.userDetailsService(userDetailsService)
            .passwordEncoder(passwordEncoder);   

        }

        @Override
        protected void configure(HttpSecurity http) throws Exception {
            http
            .authorizeRequests()
            .antMatchers(
                    "/js/**",
                    "/css/**",
                    "/images/**").permitAll()
            //.antMatchers("/catalog").access("hasAnyRole('ROLE_USER', 'ROLE_ADMIN')")
            ////.antMatchers("/login1").permitAll()
            .anyRequest().authenticated()
            .and()
            .formLogin()
            .loginPage("/login")
            .defaultSuccessUrl("/catalog", true)
            .permitAll()
            .usernameParameter("username")
            .passwordParameter("password")
            .and()
            .logout()
            .permitAll()
            .logoutUrl("/logout").logoutSuccessUrl("/logout")
            .and().exceptionHandling().accessDeniedPage("/403");


        }
    }

}

I want both configurations work based on url pattern. Any solutions/help/suggestions would be highly appreciated. Thanks.

Answer 1

I found a solution for this. I just simply followed what the spring document says in 5.9 (https://docs.spring.io/spring-security/site/docs/5.0.0.RELEASE/reference/htmlsingle/) and also another question on stackoverflow, Spring Security : Multiple HTTP Config not working