Welcome. Ask away! Unless otherwise specified we assume you're using the latest 6.x version of Spring Security
Perhaps an aspect is a better idea
It seems that exceptions not being handed to authenticationEntryPoint/accessDeniedHandler is caused by them being caught by a global exception handler per this issue: spring-projects/spring-security#6908
@jikramer_gitlab Hi Jeff, what functionality are you looking for? We've started building out authentication in the 5.2.x release train. https://docs.spring.io/spring-security/site/docs/5.2.0.RELEASE/reference/htmlsingle/#saml2
@jikramer_gitlab if that's not sufficient, the older library is https://projects.spring.io/spring-security-saml/
Hi I'm having trouble using an oauth2 resource with an oauth2 client (both reactive): https://stackoverflow.com/q/58595062/329065. Is it a spring security bug or am I missing something?
I find the code repeated Base64 Decoder in
org.springframework.security.web.authentication.rememberme.AbstractRememberMeServices
protected String[] decodeCookie(String cookieValue) throws InvalidCookieException {
for (int j = 0; j < cookieValue.length() % 4; j++) {
cookieValue = cookieValue + "=";
}
//here
try {
Base64.getDecoder().decode(cookieValue.getBytes());
}
catch (IllegalArgumentException e) {
throw new InvalidCookieException(
"Cookie token was not Base64 encoded; value was '" + cookieValue
+ "'");
}
//here
String cookieAsPlainText = new String(Base64.getDecoder().decode(cookieValue.getBytes()));
Using client_credentials grant
AH, maybe
AuthorizedClientServiceOAuth2AuthorizedClientManager is what I'm looking for
Will copy question from spring-boot room here
Hello, after updating spring boot 2.1.4 to 2.2.0 I encountered a problem on starting application Caused by: java.lang.IllegalStateException: Can't configure antMatchers after anyRequest
nothing changed in code except spring boot version and configuration file where that IllegalStateException pointing on looks like that
@Override
protected void configure(HttpSecurity http) throws Exception {
http.antMatcher("/something/**")
.csrf().disable()
.authorizeRequests().anyRequest().hasRole(ROLE)
.antMatchers(PUT, "/api/**").hasRole(ROLE)
.and().httpBasic();
} As I understand spring-security was updated to version 5.2 in boot 2.2.0, maybe I missed something there ?
Also maybe that related to that this project have several security configuration files with @Order annotation ?
Is it expected that @EnableGlobalMethodSecurity cannot be used at the same time as @EnableReactiveMethodSecurity within the same application? They both declare a bean named methodSecurityInterceptor, so spring boot startup fails with:
The bean 'methodSecurityInterceptor', defined in class path resource [org/springframework/security/config/annotation/method/configuration/ReactiveMethodSecurityConfiguration.class], could not be registered. A bean with that name has already been defined in class path resource [org/springframework/security/config/annotation/method/configuration/GlobalMethodSecurityConfiguration.class] and overriding is disabled.I know that the former pulls the SecurityContext from SecurityContextHolder and the latter pulls it from ReactiveSecurityContextHolder. However, if I have code that manages propagation of the SecurityContext between SecurityContextHolder and ReactiveSecurityContextHolder, it seems like I should be able to use both @EnableGlobalMethodSecurity and @EnableReactiveMethodSecurity
Consider a WebFlux application that dispatches some requests to some "older" synchronous code (on the proper Scheduler) in some situations. The synchronous code uses @PreAuthorize sporadically. When the dispatch occurs, I copy the
SecurityContextfrom ReactiveSecurityContextHolder to SecurityContextHolder. Ideally, this would allow @PreAuthorize to continue to work in the old code
why spring security jwt is not mentioned in the documentation ?
@amirensit , JWT support is mentioned throughout the spring security reference documentation.. particularly in the OAuth2 Resource Server sections
https://docs.spring.io/spring-security/site/docs/5.2.1.RELEASE/reference/htmlsingle/#oauth2resourceserver
https://docs.spring.io/spring-security/site/docs/5.2.1.RELEASE/reference/htmlsingle/#oauth2resourceserver
Hi, I have a resource server that use oauth2 with https://github.com/spring-projects/spring-security-oauth/blob/master/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/token/store/redis/RedisTokenStore.java to store the tokens, with spring-security-ouath2 version 2.0.8.RELEASE, and the application use spring boot 1.5.4.RELEASE and java 8. My team with to upgrade the application to spring boot 2.1.9 and java 11 and the last version of spring-security-ouath2 version, but they have some concerns about it, because in our business we can't let our customers loose their session, sou we gave then 1 year to expire their token. If we try to update our application, it's possible to keep the same objects stored at our redis, without need to ask to our customers to login again? The current implementation of the RedisTokenStore use JdkSerializationStrategy https://github.com/spring-projects/spring-security-oauth/blob/master/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/token/store/redis/JdkSerializationStrategy.java , so we don't know if an object stored with jdk 8 will be able to be deserialized with jdk 11 and the last version of spring-security-ouath2.
I had the exact same problem and tried to find another serialisation format, but the objects involved are not designed as beans, so things like Jackson don't work.
Hello.
Going deeper understanding features in Spring Security. Here mentioned that UserDetailsService will be used if
the AuthenticationManagerBuilder has not been populated.
What is meant by populated ?
Does it mean create a bean of that type ?
Injecting the AuthenticationManagerBuilder does it mean populating it ?
@OrangeDog
I also got this error:
I also got this error:
2019-11-07 09:37:11.896 ERROR 6933 --- [ XNIO-1 task-63] o.s.s.o.provider.endpoint.TokenEndpoint : Handling error: SerializationFailedException, Failed to deserialize payload; nested exception is java.io.InvalidClassException: org.springframework.security.core.authority.SimpleGrantedAuthority; local class incompatible: stream classdesc serialVersionUID = 400, local class serialVersionUID = 510
org.springframework.core.serializer.support.SerializationFailedException: Failed to deserialize payload; nested exception is java.io.InvalidClassException: org.springframework.security.core.authority.SimpleGrantedAuthority; local class incompatible: stream classdesc serialVersionUID = 400, local class serialVersionUID = 510
@OrangeDog do you think there is another alternative, maybe override this version, or just ignore it?
I found this issue spring-projects/spring-security-oauth#662 , but without any tip to help us to migrate to the new version. I'm thinking about a strategy that I can create 2 services, one that read the old version and return the OAuth2Authentication, and other service that just write the old version in another redis instance with the new serialVersionUID , but I don't know if it will be possible because the objects from the old version might be incompatible with the new version.
Hey @rwinch we are working on a project for a big telecom in Bulgaria and we are using spring security. But now the client wants to use multi-factor authentication with some hardware dongels. I was reading at this issue: spring-projects/spring-security#2603 and from what I understand this is still in the TODO list. To me this looks like a very fundamental issue and I was hoping you could share some thoughts on whether it is expected any time soon.
what’s the webflux equivalent of this implementation?
public class AuthenticationFilter extends OncePerRequestFilter {
@Override
protected void doFilterInternal(HttpServletRequest request,
HttpServletResponse response,
FilterChain filterChain) throws ServletException, IOException {
}
this won’t work anymore on webflux since it doesn’t have a servlet object
Hi, Can someone help me here please? I'm newbie to Spring-Security and just for warm-up I decided to do a little example. The problem in the code below is that, when I'm trying to pass the "right username and password" to the login page, it direct me to a page which says
Here is the code:
access forbidden code 403 .Here is the code:
@org.springframework.context.annotation.Configuration
@EnableWebSecurity
public class Configuration extends WebSecurityConfigurerAdapter {
@Override
public void configure (AuthenticationManagerBuilder auth) throws Exception {
PasswordEncoder encoder = PasswordEncoderFactories.createDelegatingPasswordEncoder();
auth.inMemoryAuthentication()
.withUser("Ian").roles("user").password(encoder.encode("password"))
.and()
.withUser("Charlize").password(encoder.encode("password")).roles("admin","user");
}
@Override
public void configure(HttpSecurity http) throws Exception{
http.authorizeRequests()
.antMatchers("/dir","/dir/*").access("hasRole('user')")
.antMatchers("/","/*").permitAll()
.and().formLogin().loginPage("/login/form").permitAll()
.loginProcessingUrl("/login")
.usernameParameter("userParam")
.passwordParameter("passParam");
}
}
This is how the form looks like:
<form method="post" action="/login" >
Username:<br>
<input type="text" name="userParam" id="userParam" value="Mickey">
<br>
Password:<br>
<input type="password" name="passParam" id="passParam" value="Mouse">
<br><br>
<input type="submit" value="Submit">
</form>
Question, does the sequence of the ServerHttpSecurity matter?
I’m trying to convert the following from an existing non-reactive code:
I’m trying to convert the following from an existing non-reactive code:
@Bean
SecurityWebFilterChain springWebFilterChain(ServerHttpSecurity http) {
// Spaces show where the old code use to be separated.
return http
.csrf()
.disable()
.addFilterBefore(new AuthenticationWebFilter(), SecurityWebFiltersOrder.HTTP_BASIC)
.authorizeExchange()
.pathMatchers("/v1/**")
.authenticated()
.and()
.exceptionHandling()
.authenticationEntryPoint(authenticationExceptionHandler)
.accessDeniedHandler(customAccessDeniedHandler)
// This used to be part of configure() in SecurityConfiguration()
.and()
.authenticationManager(customAuthenticationProvider)
.cors()
.and()
.build();
}