How to do for authorize endpoints for anonymous user with spring security

Question

I am working on a SOAP webservice with spring boot and spring security with basic authentication. The authentication works, but I would like to authorize anonymous user to access at many endpoints. I don't know how to do. I think to create 2 wsdl, one for endpoints with authentication and another for endpoints without authentication. Is it possible ? Else is it possible to annotate an endpoint with something like @PreAuthorize(permitAll) or customize spring security ?

What is the proper way to do and how ?

Thanks in advance.

I tried this :

    @PayloadRoot(namespace = NAMESPACE_URI, localPart = "createAuthorRequest")
@ResponsePayload
@PreAuthorize("permitAll()")
public CreateAuthorResponse createAuthor(
        @RequestPayload CreateAuthorRequest request
) throws WSException {
    return authorService.createAuthor(request);
}

or customize spring security :

           public void configure(HttpSecurity httpSecurity) throws Exception {

    httpSecurity
    .httpBasic()
            .and()
         .authorizeRequests().antMatchers(HttpMethod.POST, "/ws/createAuthor", "/ws/createAuthorRequest", "/ws/createAuthor**").permitAll()
            .antMatchers(HttpMethod.GET, "/ws/createAuthor", "/ws/createAuthorRequest", "/ws/createAuthor**").permitAll()
            .antMatchers(HttpMethod.PUT, "/ws/createAuthor", "/ws/createAuthorRequest", "/ws/createAuthor**").permitAll()
            .anyRequest().authenticated()

            .and()
            .csrf().disable().headers().frameOptions().disable();

But it doesn't change. With SOAP, I don't know how to get the name of endpoint called. Here the log of spring security :


    2019-05-29 22:49:39.060  INFO 8228 --- [io-8080-exec-10] Spring Security Debugger                 : 

************************************************************

Request received for POST '/ws':

org.apache.catalina.connector.RequestFacade@7445a104

servletPath:/ws
pathInfo:null
headers: 
accept-encoding: gzip,deflate
content-type: text/xml;charset=UTF-8
soapaction: ""
content-length: 516
host: localhost:8080
connection: Keep-Alive
user-agent: Apache-HttpClient/4.1.1 (java 1.5)

score -1 · Accepted Answer · answered May 29 '19 at 04:36

-1

is it possible to annotate an endpoint with something like @PreAuthorize(permitAll)

if you are using @PreAuthorize in your controllers, you can just add @PreAuthorize("permitAll()").

or customize spring security ?

In you custom security config., add all the endpoints that you want to be available in public or with no authorization in antMatchers then set it to permitAll.

Sample:

@Configuration
@EnableWebSecurity
public class SecSecurityConfig extends WebSecurityConfigurerAdapter {

        @Override
        protected void configure(HttpSecurity http) throws Exception {
            http.authorizeRequests()
                // permit all access to these endpoints.
                .antMatchers("/endpoint1", "/endpoint2", "endpoint3/**").permitAll()
                // any other request needs to be authenticated
                .anyRequest().authenticated();
        }
}

You may also specify the httpmethod to that you want to permit by adding the method as parameter before the list endpoints.

.antMatchers(HttpMethod.GET, "/endpoint1", "/endpoint2", "endpoint3/**").permitAll()
.antMatchers(HttpMethod.PUT, "/endpoint1", "endpoint3/**").permitAll()
.antMatchers(HttpMethod.POST, "endpoint3/**").permitAll()

answered May 29 '19 at 04:36

Royts

501
6
14

Thanks for your answer. – Bulan May 29 '19 at 20:22
I updated the post with your answer – Bulan May 29 '19 at 20:48
as you can see in your log, you accessed `servletPath:/ws` which is not included in your `antmatchers`. Also, you can check in your `configuration class` the name of the endpoint that you are using, if I'm not wrong. You should have there a method that returns `ServletRegistrationBean` and `Endpoint`. – Royts May 30 '19 at 03:55
I tried with 2 files wsdl, one for endpoints authentication and another for others. I changed my `configuration class`, I wrote two methods `DefaultWsdl11Definition` one per wsdl file and in the `@Bean` method `messageDispatcherServlet` that return `ServletRegistrationBean` I return `return new ServletRegistrationBean(servlet, "/ws/*","/anonymous/*");`. It works. Thank you @Royts for your help, your answers help me a lot. – Bulan May 30 '19 at 21:26
Congratulations. Glad to help. – Royts May 31 '19 at 06:26

How to do for authorize endpoints for anonymous user with spring security

1 Answers1