Spring Boot differentiate authN/authZ based on HTTP verb + URL pattern - spring-boot

Question

I want to switch authentication and authorization scheme based on http verb and url pattern in a spring boot application, below is a simplification of my use-case.
Most /mgmt/... requests will be authorized based on basic auth.
Some /mgmt/... will be be publicly open, and require no authentication.
Any path not previously defined, should be ignored/blocked.
My plan was to define rules and evaluate them in order.
For the ones used in this example there would be three rules, evaluated in order, whichever matches first will be used.
GET /mgmt/configuration/** -> Publicly open (anonymous)
ANY /mgmt/** -> ADMIN role user
ANY /** -> deny
I'm having problem with rules for public and admin, specifically that they overlap (both starts with /mgmt).
If I put the public under it's own context path (/public) the below code works - but I don't want to do that (nor have I control over these patterns).
Perhaps I need to group configurators by context path rather than authentication scheme. Configurations are actually not static as in this example, but comes from other modules (microservices) and are assembled in a security lib in an attempt to centralize auth code.
#EnableWebSecurity
public class MultiHttpSecurityConfig {
private static final String MGMT_PATTERN = "/mgmt/**";
private static final String PUBLIC_PATTERN = "/public/**";
#Configuration
#Order(1)
public static class PublicConfigurationAdapter extends WebSecurityConfigurerAdapter {
protected void configure(HttpSecurity http) throws Exception {
http.antMatcher(PUBLIC_PATTERN).authorizeRequests().anyRequest().permitAll();
}
}
#Configuration
#Order(2)
public static class AdminConfigurationAdapter extends WebSecurityConfigurerAdapter {
protected void configure(HttpSecurity http) throws Exception {
http.antMatcher(MGMT_PATTERN)
.authorizeRequests().anyRequest()
.hasRole("ADMIN")
.and()
.httpBasic()
.and().csrf().disable()
.sessionManagement()
.sessionCreationPolicy(SessionCreationPolicy.STATELESS);
}
/**
* Some operation.
*
* #return some value.
*/
#Bean
public UserDetailsService userDetailsService() {
PasswordEncoder encoder = PasswordEncoderFactories.createDelegatingPasswordEncoder();
UserDetails user = User.withUsername("user")
.password(encoder.encode("password"))
.roles("ADMIN").build();
InMemoryUserDetailsManager manager = new InMemoryUserDetailsManager();
manager.createUser(user);
return manager;
}
}
#Configuration
#Order(3)
public static class DenyConfigurationAdapter extends WebSecurityConfigurerAdapter {
protected void configure(HttpSecurity http) throws Exception {
http.antMatcher("/**").authorizeRequests().anyRequest().denyAll();
}
}
}

Answer 1

I changed configurations and grouped them by url pattern rather than type and that solves the issue I had with different configurations overlapping each other.