oauth2 and basic auth - spring-boot

Question

I use spring boot 2.4.6 with spring security.
Actually we use oauth 2
#Configuration
#EnableWebSecurity
#EnableGlobalMethodSecurity(prePostEnabled = true, securedEnabled = true)
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
private JwtAuthenticationConverter jwtAuthenticationConverter() {
JwtGrantedAuthoritiesConverter jwtGrantedAuthoritiesConverter = new JwtGrantedAuthoritiesConverter();
jwtGrantedAuthoritiesConverter.setAuthoritiesClaimName("roles");
jwtGrantedAuthoritiesConverter.setAuthorityPrefix("ROLE_");
JwtAuthenticationConverter jwtAuthenticationConverter = new JwtAuthenticationConverter();
jwtAuthenticationConverter.setJwtGrantedAuthoritiesConverter(jwtGrantedAuthoritiesConverter);
return jwtAuthenticationConverter;
}
#Override
protected void configure(HttpSecurity http) throws Exception {
http.cors().configurationSource(request -> new CorsConfiguration().applyPermitDefaultValues())
.and() // (1)
.authorizeRequests()
.antMatchers("/actuator/**").permitAll()
.antMatchers("/v2/api-docs").permitAll()
.anyRequest().authenticated() // (2)
.and()
.oauth2ResourceServer().jwt() // (3)
.jwtAuthenticationConverter(jwtAuthenticationConverter());
}
}
For some endpoint, I need to support a login / password.
Is there a way to do that?

Answer 1

You can set up multiple HttpSecurity instances, each matching one or more paths and implementing different authentication schemes. You can add them as separate inner classes extending from WebSecurityConfigurerAdapter. See docs for more information and an example.
Make sure to include an #Order if order matters. In your provided example, the config is generic and matches all requests, so it should be #Order(2). The additional config would be #Order(1) and start with http.antMatcher("/some/path/**").formLogin()... or similar.
Note: Similar (older) questions here and here.