Spring Security and Cognito : CustomAuthenticationProvider never invoked - spring-security

Question

I'm trying to make a project with APIs with cognito authentication. For this, I need a CustomAuthenticationProvider to get user's roles from another microservice. But it is never invoked.
application.yml
spring:
security:
oauth2:
client:
registration:
cognito:
clientId: xxxx
clientSecret: xxxxx
scope: openid
redirectUriTemplate: "http://localhost:8080/login/oauth2/code/cognito"
clientName: xxxx
provider:
cognito:
issuerUri: https://cognito-idp.us-west-2.amazonaws.com/us-west-2_xxxx
usernameAttribute: cognito:username
build.gradle
dependencies {
implementation 'org.springframework.boot:spring-boot-starter-security'
compile 'org.springframework.security:spring-security-oauth2-jose:5.3.3.RELEASE'
compile 'org.springframework.boot:spring-boot-starter-oauth2-client'
implementation 'org.springframework.boot:spring-boot-starter-web'
implementation 'org.springframework:spring-tx:5.2.7.RELEASE'
compileOnly 'org.projectlombok:lombok'
annotationProcessor 'org.projectlombok:lombok'
testImplementation 'org.springframework.boot:spring-boot-starter-test'
}
securityConfig
#Configuration
#EnableWebSecurity
#EnableGlobalMethodSecurity( securedEnabled = true )
#ComponentScan( "com.project" )
public class SecurityConfig extends WebSecurityConfigurerAdapter {
#Autowired
private CustomAuthenticationProvider authProvider;
#Override
protected void configure ( final AuthenticationManagerBuilder auth ) throws Exception {
auth.authenticationProvider( this.authProvider );
}
#Override
protected void configure ( final HttpSecurity http ) throws Exception {
http.cors();
http.csrf().disable();
http.authorizeRequests()
.antMatchers( "/public/**" )
.permitAll()
.antMatchers( "/user/**" )
.hasRole( "USER" )
.anyRequest()
.authenticated()
.and()
.oauth2Client()
.and()
.authenticationProvider( new CustomAuthenticationProvider() );
}
}
CustomAuthenticationProvider
#Component
public class CustomAuthenticationProvider implements AuthenticationProvider {
#Override
public Authentication authenticate ( final Authentication authentication ) throws AuthenticationException {
String userName = authentication.getName();
System.out.println( userName );
return new AWSAuthentication( userName, Arrays.asList( new SimpleGrantedAuthority( "ROLE_USER" ) ) );
}
#Override
public boolean supports ( Class<?> authentication ) {
return authentication.equals( AWSAuthentication.class );
}
}
No error occur, only 403.
I saw this example, but it is deprecated.
Could anyone help me with some clue or example?

Answer 1

I solved my problem adapting the code of this lib to my necessity.