Spring Security has several different authorizations. How to implement?

Question

Spring

Hello. Write a web project in Spring MVC. There will be several authorizations on the site, one by Email and Password, the second by a unique code, and 1 more (it doesn’t matter why). Here is the question. How to make multiple authorizations? Here is an example of my code with 1 authorization:

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

  @Autowired
  @Qualifier("authenticationProvider")
  AuthenticationProvider authenticationProvider;

  @Autowired
  public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
    auth.authenticationProvider(authenticationProvider);
  }

  @Override
  protected void configure(HttpSecurity http) throws Exception {

    http.authorizeRequests().antMatchers("/admin/**")
      .access("hasRole('ROLE_USER')").and().formLogin()
      .loginPage("/login").failureUrl("/login?error")
        .usernameParameter("username")
        .passwordParameter("password")
        .and().logout().logoutSuccessUrl("/login?logout").and().csrf();
  }
}

Thanks in advance

Answer 1

For each authorization mechanism, you describe your configuration class inherited from WebSecurityConfigurerAdapter, and add the @Order annotation with a serial number to the configuration classes. Thus, Spring Security will bypass the configurations when requested and check their applicability to the request.
You can also narrow the applicability of the authorization mechanism using the http.antMatcher() filter method (not to be confused with antMatchers(), which is used for access settings).