Spring Security Basic Auth not using CustomUserDetailsService - spring

Question

my project is in newest Spring Boot + Jersey and I have a problem with login validation.
My security config is:
#Configuration
#EnableWebSecurity
#EnableGlobalMethodSecurity(prePostEnabled = true)
public class SecurityConfiguration extends WebSecurityConfigurerAdapter
{
#Autowired
private DataSource datasource;
#Override
protected void configure(HttpSecurity http) throws Exception
{
http.csrf().disable().authorizeRequests()
.antMatchers("/api/user/**").permitAll()
.antMatchers("/api/**").authenticated().and().httpBasic();
}
#Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception
{
auth.userDetailsService(userDetailsService()).passwordEncoder(new BCryptPasswordEncoder());
auth.jdbcAuthentication().dataSource(datasource);
}
#Bean
public UserDetailsService userDetailsService()
{
return new CustomUserDetailsService(datasource);
}
}
but when I do this:
#POST
#Path("authenticate")
#Produces(MediaType.APPLICATION_JSON)
public Response authenticate(#HeaderParam("username") String username, #HeaderParam("password") String password)
{
UsernamePasswordAuthenticationToken authenticationToken =
new UsernamePasswordAuthenticationToken(username, password);
Authentication authentication = this.authManager.authenticate(authenticationToken);
SecurityContextHolder.getContext().setAuthentication(authentication);
UserDetails userDetails = this.userService.loadUserByUsername(username);
return createOkResponse(userDetails.getUsername());
}
authenticate method is using inside InMemoryUserDetailsManager not CustomUserDetailsService which I need for login validation.
How do I change that?
if needed:
public class CustomUserDetailsService extends JdbcUserDetailsManager implements UserDetailsService
{
#Autowired
private UserRepository userRepository;
public CustomUserDetailsService(DataSource datasource)
{
setDataSource(datasource);
}
#Override
public CurrentUserInfo loadUserByUsername(String email)
throws UsernameNotFoundException
{
User user = userRepository.findByPrimaryEmailAndEnabledTrue(email);
handleUserNotFound(email, user);
return new CurrentUserInfo(user);
}
private void handleUserNotFound(String email, User user)
{
if (user == null)
{
throw new UsernameNotFoundException("No user found with email: " + email);
}
}
}
Starter dependencies:
compile("org.springframework.boot:spring-boot-starter-web") {
exclude module: 'spring-boot-starter-tomcat'
}
compile "org.springframework.boot:spring-boot-starter-jetty"
compile "org.springframework.boot:spring-boot-starter-security"
compile "org.springframework.boot:spring-boot-starter-aop"
compile "org.springframework.boot:spring-boot-starter-data-jpa"
compile "org.springframework.boot:spring-boot-starter-thymeleaf"
compile "org.springframework.boot:spring-boot-starter-jersey"
compile("org.springframework.boot:spring-boot-starter-actuator") { exclude module: 'hsqldb' }

Answer 1

The problem is that you are "registering" a AuthenticationManager only usable for the /api URIs and it isn't exposed as a bean to the ApplicationContext. When using Spring Boot that will add a global one and inject a default user with a generated password in it.
Spring Boot autoconfig will detect the presence of an already availabe AuthenticationManager. To register a global one just create a method which takes a AuthenticationManagerBuilder as an argument and annotate if with #Autowired. Just make sure it isn't named configure as that will not work.
#Autowired
public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
auth.userDetailsService(userDetailsService()).passwordEncoder(new BCryptPasswordEncoder());
auth.jdbcAuthentication().dataSource(datasource);
}