0

I have two configuration files in two different projects First one:

 @Configuration
@Order(2)
public class SecurityConfig {

    /**адрес сервера LDAP*/
    @Value("${ldap.server}")
    private String ldapServer;

    /**номер порта LDAP сервера*/
    @Value("${ldap.port}")
    private int ldapPort;

    /**домен для LDAP*/
    @Value("${ldap.suffix}")
    private String suffix;

    @Autowired
    private HttpSecurity httpSecurity;

    @PostConstruct
    public void init() throws Exception {
        httpSecurity
            .httpBasic()
            .and()
            .authorizeRequests().antMatchers("/**").authenticated()
            .and()
            .authenticationProvider(adAuthProvider())     
            .csrf().disable();      
    }

    /**провайдер для аутентификации через LDAP*/
    @Bean
    public ActiveDirectoryLdapAuthenticationProvider adAuthProvider() {

        String ldapUrl = String.format("ldap://%s:%s", ldapServer, ldapPort);

        ActiveDirectoryLdapAuthenticationProvider adAuthProvider = new ActiveDirectoryLdapAuthenticationProvider(suffix, ldapUrl);
        adAuthProvider.setConvertSubErrorCodesToExceptions(true);
        adAuthProvider.setUseAuthenticationRequestCredentials(true);
        return adAuthProvider;
    }

}

And second one:

    @Configuration
@Order(3)
public class ECommonConfig extends WebSecurityConfigurerAdapter{

    @Autowired
    private HttpSecurity httpSecurity;

    @Autowired
    private UserDetailsService userDetailsService;

    @Bean(name = "requestAuthorization")
    public RequestAuthorization requestAuthorization() {
        return new RequestAuthorization();
    }

    /**провайдер для аутентификации через базу данных*/
    @Bean
    public DaoAuthenticationProvider jdbcAuthProvider() {
        DaoAuthenticationProvider authProvider = new DaoAuthenticationProvider();
        authProvider.setUserDetailsService(userDetailsService);
        authProvider.setPasswordEncoder(passwordEncoder());
        return authProvider;
    }

    /**бин для шифрования паролей*/
    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }


    /**бин для фильтра проверки наличия LDAP-пользователя в базе данных*/
    @Bean
    public LDAPAuthenticationFilter ldapAuthenticationFilter() throws Exception {
        return new LDAPAuthenticationFilter(authenticationManager());
    }

    @PostConstruct
    public void init() throws Exception {
        httpSecurity.httpBasic()
            .and()
            .authorizeRequests().antMatchers("/**").authenticated()
            .and()
            .authenticationProvider(jdbcAuthProvider())
            .csrf().disable();
        httpSecurity.addFilterAt(ldapAuthenticationFilter(), LDAPAuthenticationFilter.class);
        httpSecurity.authorizeRequests().antMatchers("/**").access("@requestAuthorization.checkRequestPermissions(authentication, request)");
    }
}

And MainConfig in main project

@Configuration
@EnableWebSecurity
@Order(value = Ordered.HIGHEST_PRECEDENCE)
public class MainConfig extends WebSecurityConfigurerAdapter{

    @Bean(name = "httpSecurity")
    public HttpSecurity httpSecurity() throws Exception {
        return getHttp();
    }       
}

Works only authentication. Filter and .access not working. No errors showing. I used debug - filters and @requestAuthorization bean even not used

These two configuration classes placed in different projects and need two work together (if both projects included) or one of them (if one of these projects included).

How can I make these two configuration classes work torgether?

art
  • 95
  • 1
  • 12
  • Only one configuration could be applied for one URL. You have to use only one configuration or different URLs. – dur May 21 '19 at 07:25
  • Possible duplicate of [Using multiple WebSecurityConfigurerAdapter with different AuthenticationProviders (basic auth for API and LDAP for web app)](https://stackoverflow.com/questions/40258583/using-multiple-websecurityconfigureradapter-with-different-authenticationprovide) – Andy Brown May 21 '19 at 15:12
  • I made two authentications work together. But my filters not working now – art May 22 '19 at 04:42
  • @art What does *But my filters not working now* mean? What did you changed, what error do you get? – dur May 22 '19 at 08:40
  • 1
    @art Your first configuration `SecurityConfig` doesn't extend `WebSecurityConfigurerAdapter`. And both configurations are still applied for the same URLs, so the first one is only used. – dur May 23 '19 at 21:23
  • I extended first configuration `SecurityConfig` from `WebSecurityConfigurerAdapter`. No effects. I think you are right about appling last ordered configuration for same URL – art May 24 '19 at 04:51

0 Answers0