L
L
LS Timer2019-04-19 15:04:18
Java
LS Timer, 2019-04-19 15:04:18

Two types of authorization. Login, password + oAuth2 in spring security. How to do?

There is a Spring boot project with authorization: login + password.

class WebSecurityConfig extends WebSecurityConfigurerAdapter
@Configuration
@EnableWebSecurity
//@EnableOAuth2Sso
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired
    private AuthUserService authUserService;

    @Override
    protected void configure(HttpSecurity http) throws Exception {

        http
                .csrf().disable()
                .authorizeRequests()
                .antMatchers("/admin", "/user", "/new-event", "/dict/**", "/data/**").authenticated() // только для зарегистрированных
                .antMatchers("/**", "/static/**", "/publish/**").permitAll() // общий доступ
                .anyRequest().authenticated() // только для зарегистрированных

                .and();

        http.formLogin()
                .loginPage("/login")
                .failureUrl("/login?error")
                .permitAll()
                .and();

        http.logout()
                .permitAll()
                .logoutUrl("/logout")
                .logoutSuccessUrl("/")
                .invalidateHttpSession(true);

    }

    @Override
    protected void configure(AuthenticationManagerBuilder authenticationManagerBuilder) throws Exception {
        authenticationManagerBuilder.userDetailsService(authUserService)
                .passwordEncoder(NoOpPasswordEncoder.getInstance());
    }
}


Added authorization settings via google
oAuth google

security.oauth2.client.client-id=id
security.oauth2.client.client-secret=secret
security.oauth2.client.client-authentication-scheme=form
security.oauth2.client.scope=openid,email,profile
security.oauth2.client.access-token-uri=https://www.googleapis.com/oauth2/v4/token
security.oauth2.client.user-authorization-uri=https://accounts.google.com/o/oauth2/v2/auth
security.oauth2.resource.user-info-uri=https://www.googleapis.com/oauth2/v3/userinfo
security.oauth2.resource.prefer-token-info=true

If you uncomment @EnableOAuth2Sso from WebSecurityConfig,
authorization via google oAuth works properly, but login + password authorization does not work.
How to link two types of authorization through Spring security?

Answer the question

In order to leave comments, you need to log in

Didn't find what you were looking for?

Ask your question

Ask a Question

731 491 924 answers to any question