RolesAllowed and antMatchers.hasRole are returning access denied caused by #Order - spring-boot

Question

I restricted /api/topics and GET: /api/users to admins only and when I try to access them, I'm getting the following message:
{
"timestamp": "2020-04-05T09:26:49.938+0000",
"status": 403,
"error": "Forbidden",
"message": "Access Denied",
"path": "/api/topics"
}
It is caused by #Order(2) under WebSecurityConfiguration, but if I remove the #Order annotation, antMatchers.permitAll won't let me visit any REST endpoint without a token. That's the message:
{
"error": "unauthorized",
"error_description": "Full authentication is required to access this resource"
}
More information about #Order here. And you can check my previous thread on stackoverflow.
The order is totally messed up. Any ideas how to solve it?
It works if I do the following instead of antMatches.permitAll but then what is the point of permitAll and that entire http configuration?
#Override
public void configure(WebSecurity web) throws Exception {
web.ignoring().antMatchers("/api/topics/**");
}
Full code:
#Configuration
#EnableWebSecurity
#EnableGlobalMethodSecurity(jsr250Enabled = true)
#Order(2)
public class WebSecurityConfiguration extends WebSecurityConfigurerAdapter {
#Bean
#Override
public AuthenticationManager authenticationManagerBean() throws Exception {
return super.authenticationManagerBean();
}
#Override
protected void configure(HttpSecurity http) throws Exception {
http
.csrf().disable()
.authorizeRequests()
.antMatchers("/api/topics/**").hasRole("ADMIN")
.antMatchers("/api/users/**").permitAll()
.anyRequest().authenticated();
}
#Bean
public BCryptPasswordEncoder bCryptPasswordEncoder() {
return new BCryptPasswordEncoder();
}
}
#Configuration
#EnableAuthorizationServer
public class AuthorizationServerConfiguration extends AuthorizationServerConfigurerAdapter {
#Autowired
private BCryptPasswordEncoder bCryptPasswordEncoder;
#Autowired
private TokenStore tokenStore;
#Autowired
private AuthenticationManager authenticationManager;
#Override
public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
clients
.inMemory()
.withClient("trusted")
.secret(bCryptPasswordEncoder.encode("secret"))
.authorizedGrantTypes("password", "get_token", "refresh_token")
.scopes("read", "write")
.autoApprove(true)
.accessTokenValiditySeconds(15 * 60)
.refreshTokenValiditySeconds(30 * 60);
}
#Override
public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {
endpoints
.authenticationManager(authenticationManager)
.tokenStore(tokenStore);
}
#Bean
public TokenStore tokenStore() {
return new InMemoryTokenStore();
}
}
#Configuration
#EnableResourceServer
public class ResourceServerConfiguration {
}
// UserController.java
#RolesAllowed("ADMIN")
#GetMapping
public ResponseEntity<List<UserDTO>> getAll() {
return ResponseEntity.ok(userMapper.toUserDTOs(userService.getAll()));
}

Answer 1

You have to authenticated() after hasRole()
#Override
protected void configure(HttpSecurity http) throws Exception {
http
.csrf().disable()
.authorizeRequests()
.antMatchers("/api/topics/**").hasRole("ADMIN").authenticated() // You need to authenticate here
.antMatchers("/api/users/**").permitAll()
.anyRequest().authenticated();
}