Spring security - create 2 filter chains with specific matchers

Question

I'm in the process of implementing ADFS support to an existing spring project. Since we already have our own JWT authentication, which we want to work in parallel to ADFS authentication, I want to implement a new filter chain that will handle only certain API request paths. By this I mean I want to create:

ADFS filter chain that will handle all the /adfs/saml/** API calls
Leave the default filter chain that will handle all the rest API calls

I'm using the ADFS spring security lib that defines the filter chain like this:

public abstract class SAMLWebSecurityConfigurerAdapter extends WebSecurityConfigurerAdapter {

//some code

 protected final HttpSecurity samlizedConfig(final HttpSecurity http) throws Exception {
        http.httpBasic().authenticationEntryPoint(samlEntryPoint())
                .and()
                .csrf().ignoringAntMatchers("/saml/**")
                .and()
                .authorizeRequests().antMatchers("/saml/**").permitAll()
                .and()
                .addFilterBefore(metadataGeneratorFilter(), ChannelProcessingFilter.class)
                .addFilterAfter(filterChainProxy(), BasicAuthenticationFilter.class);

        // store CSRF token in cookie
        if (samlConfigBean().getStoreCsrfTokenInCookie()) {
            http.csrf()
                    .csrfTokenRepository(csrfTokenRepository())
                    .and()
                    .addFilterAfter(new CsrfHeaderFilter(), CsrfFilter.class);
        }

        return http;
    }
}

And I extend this class:

@EnableWebSecurity
@Configuration
@Order(15)
@RequiredArgsConstructor
public class ADFSSecurityConfiguration extends SAMLWebSecurityConfigurerAdapter {
   @Override
    protected void configure(final HttpSecurity http) throws Exception {
        samlizedConfig(http)
                .authorizeRequests()
                .antMatchers("/adfs")
                .authenticated();
    }

}

But when debugging I see that this new filter chain is set to match "any" request. So I'm probably setting the matchers wrong.

score 2 · Accepted Answer · answered Feb 28 '21 at 06:14

Actually, after reading the official docs the answer was a simple one: (see "Creating and Customizing Filter Chains" section)

    @Override
    protected void configure(final HttpSecurity http) throws Exception {
        samlizedConfig(http)
                .antMatcher("/adfs/**");
    }

It should not be put after .authorizeRequests() but strait on the first matcher.

Spring security - create 2 filter chains with specific matchers

1 Answers1