Spring boot security - multiple WebSecurityConfigurerAdapter - spring-security

Question

I have an auth-cas library that provides authentication to my spring boot project.
In this auth-cas library there is a class that extends
WebSecurityConfigurerAdapter with following configure function
#Override
#ConditionalOnProperty(value = "ugent.cas.serviceUrl", matchIfMissing = true)
#ConditionalOnClass(Cas.class)
protected void configure(HttpSecurity http) throws Exception {
http.exceptionHandling().authenticationEntryPoint(casAuthenticationEntryPoint());
if (basicAuthenticationProviders != null) {
http.addFilter(basicAuthFilter());
}
http.addFilter(casAuthenticationFilter())
.addFilter(requestSSOLogoutToCASServerLogoutFilter())
.logout()
.deleteCookies("JSESSIONID")
.permitAll()
.logoutSuccessUrl("/logout.html")
.and()
.csrf()
.disable()
.headers()
.frameOptions()
.disable();
http.authorizeRequests()
.antMatchers(HttpMethod.OPTIONS, "/api/**").permitAll()
.antMatchers("/**").authenticated();
}
As this should be black box I've added my own WebSecurityConfigurerAdapter that looks like this:
#Configuration
//#Order(Integer.MAX_VALUE)
//#Order(SecurityProperties.ACCESS_OVERRIDE_ORDER)
#Order(1)
public class AuthSecurityConfiguration extends WebSecurityConfigurerAdapter {
#Override
public void configure(WebSecurity webSecurity) throws Exception {
webSecurity
.ignoring()
// All of Spring Security will ignore the requests
.antMatchers("/choose.html")
.antMatchers("/account/*");
}
#Override
protected void configure(HttpSecurity http) throws Exception {
http/*.addFilter(usernamePasswordAuthenticationFilter())
.formLogin()
.permitAll()
.and()
.logout()
.deleteCookies("JSESSIONID")
.permitAll()
.logoutSuccessUrl("/logout.html")
.and()
.csrf()
.disable()
.headers()
.frameOptions()
.disable();
*/
.authorizeRequests()
.anyRequest().authenticated()
.and()
.authenticationProvider(AuthenticationProvider())
.formLogin()
.permitAll()
.and()
.csrf()
.disable()
.headers()
.frameOptions()
.disable()
;
}
#Bean
public AuthenticationProvider AuthenticationProvider() {
return new LCAAuthenticationProvider();
}
#Bean
public UsernamePasswordAuthenticationFilter usernamePasswordAuthenticationFilter () throws Exception{
UsernamePasswordAuthenticationFilter filter = new UsernamePasswordAuthenticationFilter ();
filter.setAuthenticationManager(authenticationManager());
return filter;
}
}
My Custom AuthenticationProvider implements ´AuthenticationProvider´ and works as in the page redirects me to the /login page and I can login with credentials in my user base.
Only problem is when I am already logged in on another auth cas network I should be authenticated but it still prompts me with my custom Authentication Provider.
How Do I need to configure HttpSecurity so that it works with my 2 Authentication Providers.
Other related question, how can I from the ignored page /choose.html give the option between logging in with one of the 2 authentication providers?
EDIT
This is my current configuration of ´WebSecurityConfigurererAdapter´
#Configuration
//#Order(Integer.MAX_VALUE)
//#Order(SecurityProperties.ACCESS_OVERRIDE_ORDER)
#Order(0)
public class AuthSecurityConfiguration extends WebSecurityConfigurerAdapter {
/**
* The authProvider bean used as a cas authentication provider.
*/
#Autowired
private LCAAuthenticationProvider authProvider;
#Override
public void configure(WebSecurity webSecurity) throws Exception {
webSecurity
.ignoring()
// All of Spring Security will ignore the requests
.antMatchers("/choose.html")
.antMatchers("/account/*");
}
#Autowired
public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
auth.authenticationProvider(authProvider);
}
/**
* The authenticationManagerBean bean.
*
* #return the authenticationManagerBean
* #throws Exception
*/
#Override
public AuthenticationManager authenticationManagerBean() throws Exception {
return super.authenticationManagerBean();
}
/**
* The loginUrlAuthenticationEntryPoint bean
*
* #return the loginUrlAuthenticationEntryPoint
*/
#Bean
public LoginUrlAuthenticationEntryPoint loginUrlAuthenticationEntryPoint() {
LoginUrlAuthenticationEntryPoint ep = new LoginUrlAuthenticationEntryPoint("/choose.html");
//ep.setLoginUrl(cas.getLoginUrl());
return ep;
}
#Override
protected void configure(HttpSecurity http) throws Exception {
http.exceptionHandling().authenticationEntryPoint(loginUrlAuthenticationEntryPoint());
http.addFilter(usernamePasswordAuthenticationFilter())
.formLogin()
.permitAll()
.and()
.logout()
.deleteCookies("JSESSIONID")
.permitAll()
.logoutSuccessUrl("/logout.html")
.and()
.csrf()
.disable()
.headers()
.frameOptions()
.disable();
/*
.authorizeRequests()
.anyRequest().authenticated()
.and()
.authenticationProvider(AuthenticationProvider())
.formLogin()
.loginPage("choose.html")
.permitAll()
.and()
.csrf()
.disable()
.headers()
.frameOptions()
.disable()
;
*/
}
#Bean
public LCAAuthenticationProvider lcaAuthenticationProvider() {
return new LCAAuthenticationProvider();
}
#Bean
public UsernamePasswordAuthenticationFilter usernamePasswordAuthenticationFilter () throws Exception{
UsernamePasswordAuthenticationFilter filter = new UsernamePasswordAuthenticationFilter ();
filter.setAuthenticationManager(authenticationManager());
return filter;
}
}
But I'm getting following error:
Exception in thread "main" java.lang.RuntimeException: java.lang.reflect.InvocationTargetException
at org.springframework.boot.loader.MainMethodRunner.run(MainMethodRunner.java:62)
at java.lang.Thread.run(Unknown Source)
Caused by: java.lang.reflect.InvocationTargetException
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(Unknown Source)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
at java.lang.reflect.Method.invoke(Unknown Source)
at org.springframework.boot.loader.MainMethodRunner.run(MainMethodRunner.java:54)
... 1 more
Caused by: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'springSecurityFilterChain' defined in class path resource [org/springframework/security/config/annotation/web/configuration/WebSecurityConfiguration.class]: Bean instantiation via factory method failed; nested exception is org.springframework.beans.BeanInstantiationException: Failed to instantiate [javax.servlet.Filter]: Factory method 'springSecurityFilterChain' threw exception; nested exception is org.springframework.security.config.annotation.AlreadyBuiltException: This object has already been built
at org.springframework.beans.factory.support.ConstructorResolver.instantiateUsingFactoryMethod(ConstructorResolver.java:599)
at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.instantiateUsingFactoryMethod(AbstractAutowireCapableBeanFactory.java:1123)
at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBeanInstance(AbstractAutowireCapableBeanFactory.java:1018)
at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:510)
at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:482)
at org.springframework.beans.factory.support.AbstractBeanFactory$1.getObject(AbstractBeanFactory.java:306)
at org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:230)
at org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:302)
at org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:197)
at org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:296)
at org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:197)
at org.springframework.beans.factory.support.DefaultListableBeanFactory.preInstantiateSingletons(DefaultListableBeanFactory.java:772)
at org.springframework.context.support.AbstractApplicationContext.finishBeanFactoryInitialization(AbstractApplicationContext.java:839)
at org.springframework.context.support.AbstractApplicationContext.refresh(AbstractApplicationContext.java:538)
at org.springframework.boot.context.embedded.EmbeddedWebApplicationContext.refresh(EmbeddedWebApplicationContext.java:118)
at org.springframework.boot.SpringApplication.refresh(SpringApplication.java:766)
at org.springframework.boot.SpringApplication.createAndRefreshContext(SpringApplication.java:361)
at org.springframework.boot.SpringApplication.run(SpringApplication.java:307)
at org.springframework.boot.SpringApplication.run(SpringApplication.java:1191)
at org.springframework.boot.SpringApplication.run(SpringApplication.java:1180)
at be.ugent.lca.Application.main(Application.java:16)
... 6 more
Caused by: org.springframework.beans.BeanInstantiationException: Failed to instantiate [javax.servlet.Filter]: Factory method 'springSecurityFilterChain' threw exception; nested exception is org.springframework.security.config.annotation.AlreadyBuiltException: This object has already been built
at org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiate(SimpleInstantiationStrategy.java:189)
at org.springframework.beans.factory.support.ConstructorResolver.instantiateUsingFactoryMethod(ConstructorResolver.java:588)
... 26 more
Caused by: org.springframework.security.config.annotation.AlreadyBuiltException: This object has already been built
at org.springframework.security.config.annotation.AbstractSecurityBuilder.build(AbstractSecurityBuilder.java:44)
at org.springframework.security.config.annotation.web.configuration.WebSecurityConfiguration.springSecurityFilterChain(WebSecurityConfiguration.java:105)
at org.springframework.security.config.annotation.web.configuration.WebSecurityConfiguration$$EnhancerBySpringCGLIB$$699e3cc3.CGLIB$springSecurityFilterChain$2(<generated>)
at org.springframework.security.config.annotation.web.configuration.WebSecurityConfiguration$$EnhancerBySpringCGLIB$$699e3cc3$$FastClassBySpringCGLIB$$e656a0ba.invoke(<generated>)
at org.springframework.cglib.proxy.MethodProxy.invokeSuper(MethodProxy.java:228)
at org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.intercept(ConfigurationClassEnhancer.java:355)
at org.springframework.security.config.annotation.web.configuration.WebSecurityConfiguration$$EnhancerBySpringCGLIB$$699e3cc3.springSecurityFilterChain(<generated>)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(Unknown Source)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
at java.lang.reflect.Method.invoke(Unknown Source)
at org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiate(SimpleInstantiationStrategy.java:162)
I can trace the error to line 44 in https://github.com/spring-projects/spring-security/blob/master/config/src/main/java/org/springframework/security/config/annotation/AbstractSecurityBuilder.java but I can't find what's causing this

Answer 1

You need put the auth filter and username password filter to your own configuration(AuthSecurityConfiguration), and make it first, and then define an entry point for choose.html, and a filter to handle the request from choose.html and then redirect to different url(e.g /login or /auth) depend on the choice. so it will be like following.(I have done something like this before, So I just copy them, you can change to your own)
<security:http xmlns="http://www.springframework.org/schema/security" entry-point-ref="clientAuthenticationEntryPoint">
<intercept-url pattern="/login" access="IS_AUTHENTICATED_ANONYMOUSLY" />
<intercept-url pattern="/choose.html" access="IS_AUTHENTICATED_ANONYMOUSLY" />
<intercept-url pattern="/autherror" access="IS_AUTHENTICATED_ANONYMOUSLY" />
<intercept-url pattern="/**/**" access="IS_AUTHENTICATED_FULLY"/>
<custom-filter ref="logoutFilter" position="LOGOUT_FILTER" />
<custom-filter ref="authenticationBrokerProcessingFilter" after="LOGOUT_FILTER" />
<custom-filter ref="oauth2ClientContextFilter" after="EXCEPTION_TRANSLATION_FILTER"/>
<custom-filter ref="oAuth2AuthenticationProcessingFilter" before="FILTER_SECURITY_INTERCEPTOR"/>
<form-login
login-page="/login"
default-target-url="/main"
username-parameter="username"
password-parameter="password"
login-processing-url="/loginSubmit"
authentication-failure-handler-ref="passwordFailureHandler"
authentication-success-handler-ref="passwordAuthenticationSuccessHandler"
always-use-default-target="false"
/>
<csrf />
<access-denied-handler ref="accessDeniedHandler" />
</security:http>
<bean id="clientAuthenticationEntryPoint" class="org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint">
<constructor-arg name="loginFormUrl" value="/choose.html"/>
</bean>
As you can see the xml, there are two authentication method, auth2 and username password.
authenticationBrokerProcessingFilter will handle the request from choose.html;
username password filter will handle the request /loginSubmit from login page;
auth2 filter will handle the request /oauth2-login from sso with code.