CODEWITHSUNDEEP
spring-bootspring-security-oauth2
Thisara Jayaweera
Thisara Jayaweera

Reputation: 129

Oauth2 security configuration antmatchers request filtering not working as expected

I am working on a simple spring boot project along with spring security oauth2 to use google authentication for a specified endpoint which is /google/login.

With following security configurations everything is working perfectly.

@Configuration
public class SecurityConfigure extends WebSecurityConfigurerAdapter {

    @Override
    public void configure(HttpSecurity http) throws Exception {
        http
                .requestMatchers().antMatchers("/**")
                .and()
                .authorizeRequests().antMatchers("/ldap/login").permitAll()
                .anyRequest().fullyAuthenticated()
                .and()
                .oauth2Login();
    }
}

But I need to specify only /google/login endpoint to authenticate with oauth2. Therefore I specified it like this.

@Configuration
public class SecurityConfigure extends WebSecurityConfigurerAdapter {

    @Override
    public void configure(HttpSecurity http) throws Exception {
        http
                .requestMatchers().antMatchers("/google/**")
                .and()
                .authorizeRequests().antMatchers("/ldap/**").permitAll()
                .anyRequest().fullyAuthenticated()
                .and()
                .oauth2Login();
    }
}

with this security configuration http://localhost:8080/google/login endpoint call redirects to another endpoint called http://localhost:8081/oauth2/authorization/google which is I haven't defined.

enter image description here

Please help me to overcome this problem. Thank you.

Upvotes: 0

Views: 1058

Answers (1)

Thisara Jayaweera
Thisara Jayaweera

Reputation: 129

This configuration works for me. I had to allow all endpoints that were redirecting while Google's authentication process was running. 

@Override
        protected void configure(HttpSecurity http) throws Exception {
            http
                    .csrf().disable()
                    .requestMatchers().antMatchers("/google/**","/oauth2/authorization/google","/login/oauth2/code/google")
                    .and()
                    .authorizeRequests().antMatchers("/ldap/**").permitAll()
                    .anyRequest().fullyAuthenticated()
                    .and()
                    .oauth2Login();
        }

Upvotes: 1

Related Questions