Spring Security multiple configuration - spring

Question

I try to make spring boot multiple configuration. There are next configurations. First filter, I use for verify client. It should be in every request. I wanna try make extra rule for verify user permission. It's mean, when someone wants to save something, he/she have to be authorized user and send personal token in header. If that token is valid, I can allow to save file. But JWT token must to be too. Finally, for save I would like to use two tokens. First is JWT and second is user token.
This part of code verify permission for access to API. It should be in header in each request. Now, it works.
#Configuration
#EnableWebSecurity
public class SecurityConfiguration {
#Order(1)
#Configuration
public static class JwtTokenSecurityConfiguration extends WebSecurityConfigurerAdapter {
#Override
protected void configure(HttpSecurity http) throws Exception {
http.csrf().disable()
.addFilterAfter(new JWTAuthorizationFilter(), UsernamePasswordAuthenticationFilter.class)
.authorizeRequests()
.antMatchers(HttpMethod.POST, "/user/new").hasAuthority("ADMIN")
.anyRequest().authenticated();
}
}
This part of code have to verify user. logged in or no. It doesn't work now. When I try to get access to "/v1/save_file", it check only JWT token, not user-token. Finally, I would like to make to checks for that endpoint. first is verify JWT token, second is verify user-token for save.
#Order(2)
#Configuration
public static class UserTokenSecurityConfiguration extends WebSecurityConfigurerAdapter {
#Value("${fc.security.header.user-token:User-Token}")
private String usrTokenHeaderName;
#Override
protected void configure(HttpSecurity httpSecurity) throws Exception {
UserTokenSecurityConfig userToken = new UserTokenSecurityConfig(usrTokenHeaderName);
userToken.setAuthenticationManager(new AuthenticationManager() {
#Override
public Authentication authenticate(Authentication authentication) throws AuthenticationException {
String principal = (String) authentication.getPrincipal();
if (!usrTokenHeaderName.equals(principal)) {
throw new BadCredentialsException("The Application token was not found or not the expected value.");
}
System.out.println(principal + " " + usrTokenHeaderName);
authentication.setAuthenticated(true);
return authentication;
}
});
httpSecurity.antMatcher("/v1/save_file")
.csrf()
.disable()
.sessionManagement()
.sessionCreationPolicy(SessionCreationPolicy.STATELESS)
.and()
.addFilter(userToken)
.addFilterBefore(new ExceptionTranslationFilter(new Http403ForbiddenEntryPoint()), userToken.getClass())
.authorizeRequests()
.anyRequest()
.authenticated();
}
}
}
JWTAuthorizationFilter class
public class JWTAuthorizationFilter extends OncePerRequestFilter {
private final String HEADER = "Authorization";
private final String PREFIX = "Bearer ";
#Override
protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain chain) throws ServletException, IOException {
try {
if (checkJWTToken(request, response)) {
Claims claims = validateToken(request);
if (claims.get("authorities") != null) {
setUpSpringAuthentication(claims);
} else {
SecurityContextHolder.clearContext();
}
} else {
SecurityContextHolder.clearContext();
}
chain.doFilter(request, response);
} catch (ExpiredJwtException | UnsupportedJwtException | MalformedJwtException e) {
response.setStatus(HttpServletResponse.SC_FORBIDDEN);
((HttpServletResponse) response).sendError(HttpServletResponse.SC_FORBIDDEN, e.getMessage());
return;
}
}
private Claims validateToken(HttpServletRequest request) {
String jwtToken = request.getHeader(HEADER).replace(PREFIX, "");
return Jwts.parser().setSigningKey(Constants.SECRET_KEY.getBytes()).parseClaimsJws(jwtToken).getBody();
}
/**
* Authentication method in Spring flow
*
* #param claims
*/
private void setUpSpringAuthentication(Claims claims) {
#SuppressWarnings("unchecked")
List<String> authorities = (List<String>) claims.get("authorities");
UsernamePasswordAuthenticationToken auth = new UsernamePasswordAuthenticationToken(claims.getSubject(), null,
authorities.stream().map(SimpleGrantedAuthority::new).collect(Collectors.toList()));
SecurityContextHolder.getContext().setAuthentication(auth);
}
private boolean checkJWTToken(HttpServletRequest request, HttpServletResponse res) {
String authenticationHeader = request.getHeader(HEADER);
if (authenticationHeader == null || !authenticationHeader.startsWith(PREFIX))
return false;
return true;
}
}
very simple UserTokenSecurityConfig class
public class UserTokenSecurityConfig extends AbstractPreAuthenticatedProcessingFilter {
private String userHeader;
public UserTokenSecurityConfig(String userHeader) {
this.userHeader = userHeader;
}
#Override
protected Object getPreAuthenticatedPrincipal(HttpServletRequest httpServletRequest) {
return httpServletRequest.getHeader(userHeader);
}
#Override
protected Object getPreAuthenticatedCredentials(HttpServletRequest httpServletRequest) {
return "NA";
}
}