Spring security - How to configure multiple authentication providers using java config

Question

I m trying to configure an application which has multiple authentication mechanisms(DB and LDAP) and which uses spring security as its underlying framework. I m using java configuration to set up the web and http security. I understand that we would need multiple WebSecurityConfigurerAdapter instances for multiple http elements(as used in xml based config); but when I do that, the application only picks up the first authentication configured(database auth) and never authenticates with the 2nd authentication(ldap auth). Any reason why ? Here is the code snippet

@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true, securedEnabled = true)
public class SecurityConfiguration{

@Configuration
@Order(1)
public static class DBSecurityConfig extends WebSecurityConfigurerAdapter {

 @Inject
    public void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth
            .userDetailsService(userDetailsService);
    }

    @Override
    public void configure(WebSecurity web) throws Exception {
        web.ignoring()
            .antMatchers("/scripts/**/*.{js,html}")
            .antMatchers("/console*");
    }

 protected void configure(HttpSecurity http) throws Exception {

        http.csrf()
            .addFilterAfter(new CsrfCookieGeneratorFilter(), CsrfFilter.class)
            .exceptionHandling()
            .authenticationEntryPoint(authenticationEntryPoint)
            .and()
            .formLogin()
            .loginProcessingUrl("/api/authentication")
            .successHandler(ajaxAuthenticationSuccessHandler)
            .failureHandler(ajaxAuthenticationFailureHandler)
            .usernameParameter("j_username")
            .passwordParameter("j_password")
            .permitAll()
            .and()
            .logout()
            .logoutUrl("/api/logout")
            .logoutSuccessHandler(ajaxLogoutSuccessHandler)
            .deleteCookies("JSESSIONID")
            .permitAll()
            .and()
            .headers()
            .frameOptions()
            .disable()
            .and()
            .authorizeRequests()
            .antMatchers("/api/**").permitAll()
            .antMatchers("/api*//**").authenticated();
         }
     }

@Configuration
public static class LDAPSecurityConfig extends WebSecurityConfigurerAdapter {


    @Inject
    public void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.ldapAuthentication()
            .userDnPatterns("uid={0},ou=people")
            .groupSearchBase("ou=groups")
            .contextSource()
            .ldif("classpath:users.ldif");
    }

    @Override
    public void configure(WebSecurity web) throws Exception {
        web.ignoring()
            .antMatchers("/console*");
    }

    protected void configure(HttpSecurity http) throws Exception {
        http.csrf()
            .addFilterAfter(new CsrfCookieGeneratorFilter(), CsrfFilter.class)
            .exceptionHandling()
            .authenticationEntryPoint(ldapAuthenticationEntryPoint)
            .and()
            .formLogin()
            .loginProcessingUrl("/api/ldapAuthentication")
            .successHandler(ldapAjaxAuthenticationSuccessHandler)
            .failureHandler(ldapAjaxAuthenticationFailureHandler)
            .usernameParameter("j_username")
            .passwordParameter("j_password")
            .permitAll()
            .and()
            .logout()
            .logoutUrl("/api/logout")
            .logoutSuccessHandler(ajaxLogoutSuccessHandler)
            .deleteCookies("JSESSIONID")
            .permitAll()
            .and()
            .headers()
            .frameOptions()
            .disable()
            .and()
            .authorizeRequests()
            .antMatchers("/api/**").permitAll()
            .antMatchers("/api*//**").authenticated();
    }
}

I edited some of the code for brevity. Any insight as to why it is not picking up the ldap authentication is appreciated.

Thanks

Peter Larson Peter Larson · Accepted Answer · 2016-11-18T19:41:02

Old posting, but I just discovered the answer myself. The builder that is implemented in the auth object builds an AuthenticationManager with what you provider. Each instance of the configurer you have will attempt to do the same thing, but only one of the resulting AuthenticationManager objects will actually be used by your app.

Spring security - How to configure multiple authentication providers using java config

1 Answers