Spring Boot and Spring Security not honoring configureGlobal

Question

I created a simple SpringBoot app and added spring security. When I login it is only accepting the default password it is generating.

It won't let me login using the username/password I have configured in WebSecurityConfigurerAdapter.

Here is my code. SsFirstApplication.java

 @SpringBootApplication
@EnableAutoConfiguration
public class SsFirstApplication {

    public static void main(String[] args) {
        SpringApplication.run(SsFirstApplication.class, args);

    }
}

My custom security config "SecurityConfig.java"

@Configuration
@EnableWebSecurity
@Order(SecurityProperties.ACCESS_OVERRIDE_ORDER)
public class SecurityConfig extends WebSecurityConfigurerAdapter{

    @Autowired
    public void configureGlobal(AuthenticationManagerBuilder authBuilder) throws Exception{
        logInfo("configureGlobal");
        authBuilder
            .inMemoryAuthentication()
                .withUser("user")
                    .password("password123");
                    //.roles("USER");
    }

    private void logInfo(String strToken){
        for(int index=0;index<1;index++){
            System.out.println("************************** "+strToken+" ****************************");
        }
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception{
        logInfo("configure");
        http
            .authorizeRequests()
                .anyRequest().authenticated();
    }

}

And finally the Web App Initializer "SecurityWebApplicationInitializer"

import org.springframework.security.web.context.AbstractSecurityWebApplicationInitializer;

public class SecurityWebApplicationInitializer extends AbstractSecurityWebApplicationInitializer{

    public SecurityWebApplicationInitializer(){
        super(SecurityConfig.class);
    }

    protected Class<?>[] getRootConfigClasses() {
        return new Class[] { SecurityConfig.class };
    }
}

When I start the SpringBoot app (I am using STS/Eclipse IDE) in the console it is generating and printing out the password for username "user".

When I try http://localhost:8080/admin it won't let me use the username/password I configured.

Here is my pom.xml

<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>

    <groupId>org.test</groupId>
    <artifactId>demo</artifactId>
    <version>0.0.1-SNAPSHOT</version>
    <packaging>jar</packaging>

    <name>ss-first</name>
    <description>Demo project for Spring Boot</description>

    <parent>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-parent</artifactId>
        <version>1.2.3.RELEASE</version>
        <relativePath/> <!-- lookup parent from repository -->
    </parent>

    <properties>
        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
        <start-class>demo.SsFirstApplication</start-class>
        <java.version>1.8</java.version>
    </properties>

    <dependencies>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-security</artifactId>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-web</artifactId>
        </dependency>

        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-test</artifactId>
            <scope>test</scope>
        </dependency>
    </dependencies>

    <build>
        <plugins>
            <plugin>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-maven-plugin</artifactId>
            </plugin>
        </plugins>
    </build>

</project>

i added security.basic.enabled=false to application.properties file and i no longer get the login popup . How ever i don't get the login screen either.As i specified anyRequest().authenticated(). How come i am getting access to the default page with out being authenticated ?? — Sateesh K
How are you rendering your view(JSP or something else) ? If you need to show the login page your configuration has to be changed. You need to specify a login page. Also I cannot see any controllers in your configuration. How will the view be resolved ? can you please confirm if you have posted your full configuration or only snippets for security ? — ArunM
The default password being generated will not create any issue for you .. Also the class SecurityWebApplicationInitializer is not needed when using Boot. — ArunM
Thanks a lot Arun. I didn't have any views or controllers in my sample app yet. I was under the impression Spring Security will create a sample login screen automatically. I will add the login view and controller and will check. thanks again — Sateesh K

ArunM ArunM · Accepted Answer · 2015-05-13T05:43:57

The configuration of Spring MVC and Spring security needs to be corrected. Following will be the configuration for you.

@SpringBootApplication 
@Controller
public class App extends WebMvcConfigurerAdapter {

    @Override
    public void addViewControllers(ViewControllerRegistry registry) {
        registry.addViewController("/login").setViewName("login");
    }

    @RequestMapping(value="/")
    public String home() {
        return "admin";
    }

The SecurityConfig is more or less correct except you need to add the login url information as shown below.

    @Override
        protected void configure(HttpSecurity http) throws Exception {
            http.authorizeRequests().anyRequest().fullyAuthenticated().and().formLogin()
                    .loginPage("/login").failureUrl("/login?error").permitAll();
             http.csrf().disable();
        }

As menionted in the comments above SecurityWebApplicationInitializer is also not needed in your config.

Spring Boot and Spring Security not honoring configureGlobal

1 Answers