Access is denied when user login as 'ADMIN' role but not in 'USER' role - spring-boot

Question

WebSecurityConfiguration
#Configuration
#EnableWebSecurity
public class WebSecurityConfiguration extends WebSecurityConfigurerAdapter {
#Autowired
private BCryptPasswordEncoder bCryptPasswordEncoder;
#Autowired
private MyUserDetailsService userDetailsService;
#Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
auth
.userDetailsService(userDetailsService)
.passwordEncoder(bCryptPasswordEncoder);
}
#Override
protected void configure(HttpSecurity http) throws Exception {
String loginPage = "/login";
String logoutPage = "/logout";
http
.authorizeRequests()
.antMatchers("/").permitAll()
.antMatchers(loginPage).permitAll()
//.antMatchers("/registration").permitAll()
.antMatchers("/user/**").hasAnyAuthority("USER","ADMIN")
.anyRequest().authenticated()
.and()
.csrf().disable()
.formLogin()
.loginPage(loginPage)
.loginPage("/")
.failureUrl("/login?error=true")
.defaultSuccessUrl("/user")
.usernameParameter("username")
.passwordParameter("password")
.and()
.logout()
.logoutRequestMatcher(new AntPathRequestMatcher(logoutPage))
.logoutSuccessUrl(loginPage).and().exceptionHandling();
}
}
MyUserDetailsService
#Service
public class MyUserDetailsService implements UserDetailsService {
#Autowired
private UserService userService;
#Override
#Transactional
public UserDetails loadUserByUsername(String userName) {
User user = userService.findUserByUserName(userName);
List<GrantedAuthority> authorities = getUserAuthority(user.getRoles());
return buildUserForAuthentication(user, authorities);
}
private List<GrantedAuthority> getUserAuthority(Set<Role> userRoles) {
Set<GrantedAuthority> roles = new HashSet<>();
for (Role role : userRoles) {
roles.add(new SimpleGrantedAuthority(role.getRole()));
}
return new ArrayList<>(roles);
}
private UserDetails buildUserForAuthentication(User user, List<GrantedAuthority> authorities) {
return new org.springframework.security.core.userdetails.User(user.getUserName(), user.getPassword(),
user.getActive(), true, true, true, authorities);
}
}
Model
#Entity
#Table(name = "users")
public class User {
#Id
#GeneratedValue(strategy = GenerationType.IDENTITY)
#Column(name = "user_id")
private long id;
#Column(name = "username")
private String userName;
#Column(name = "password")
private String password;
#Column(name = "active")
private Boolean active;
#ManyToMany(cascade = CascadeType.MERGE)
#JoinTable(name = "user_role", joinColumns = #JoinColumn(name = "user_id"), inverseJoinColumns = #JoinColumn(name = "role_id"))
private Set<Role> roles;
// getters and setters
}
#Entity
#Table(name = "roles")
public class Role {
#Id
#GeneratedValue(strategy = GenerationType.AUTO)
#Column(name = "role_id")
private int id;
#Column(name = "role")
private String role;
// getters and setters
}
I got error Spring Boot security login. I got error in admin role login. But when I logged in user role it is working well. I don't understand why this is happening?
When I am trying to login as admin it redirects me http://localhost:8080/error page show this in body:
{"timestamp":"2020-09-11T14:10:05.108+00:00","status":999,"error":"None","message":""}
But when trying to login as user it works fine.

Answer 1

Probably you may have messed up with antMatchers!!
In your code you've mentioned like
.antMatchers("/user/**").hasAnyAuthority("USER","ADMIN")
Which means both user and admin can have access to url's that match "/user/**" ie,. all url's with prefix "/user/"
If incase you have a url for admin which with "/admin/*
" , then you should give access to "/admin/**" too!
Then you have to add one more antMatcher like
.antMatchers("/admin/**).hasRole("ADMIN")
which will give access only to admin url's ie,. with prefix "/admin/**"