java - Spring 2 WebSecurity different Authentifications not working as intended

Question

I'm currently struggling with the WebSecurityConfig from Spring. I do have a service which is protected with an IPAuthProvider (only whitelisted IPs can access the service). For monitoring reasons I exposed a /prometheus endpoint and I don't want the IPAuth there but only Basic Auth. However, the following code adds IPAuth AND Basic Auth to the /prometheus endpoint.

    @Configuration
    @EnableWebSecurity
    @EnableGlobalMethodSecurity(securedEnabled = true)
    public class SecurityConfig {
    
        @Order(2)
        @Configuration
        public static class WebSecurityConfig extends WebSecurityConfigurerAdapter {
    
            private final IpAuth ipAuth;
            private final CustomAuthenticationFailureHandler failureHandler;
            private final CustomAuthenticationSuccessHandler successHandler;
    
            public WebSecurityConfig(IpAuth ipAuth,
                                    CustomAuthenticationFailureHandler failureHandler, CustomAuthenticationSuccessHandler successHandler) {
                this.ipAuth = ipAuth;
                this.failureHandler = failureHandler;
                this.successHandler = successHandler;
            }
    
    
            @Override
            protected void configure(HttpSecurity http) throws Exception {
                http
                    .authorizeRequests()
                    .antMatchers(HttpMethod.POST, "/refresh")
                    .permitAll()
                    .antMatchers("/css/*.css", "/js/*.js")
                    .permitAll()
                    .anyRequest()
                    .authenticated()
                    .and()
                    .formLogin()
                    .loginPage("/loginPage")
                    .failureHandler(failureHandler)
                    .successHandler(successHandler)
                    .and()
                    .logout()
                    .logoutUrl("/logoutPage")
                    .invalidateHttpSession(true)
                    .deleteCookies("JSESSIONID")
                    .permitAll()
                    .and()
                    .csrf()
                    .disable();
            }
    
            @Override
            public void configure(AuthenticationManagerBuilder auth) {
                auth.authenticationProvider(ipAuth);
            }
    
    
        }
    
        @Order(1)
        @Configuration
        public static class PrometheusConfig extends WebSecurityConfigurerAdapter{
    
            private final PrometheusEntryPoint prometheusEntryPoint;
    
            public PrometheusConfig(SystemConfig systemConfig, PrometheusAuthEntryPoint prometheusAuthEntryPoint){
                this.prometheusAuthEntryPoint=prometheusAuthEntryPoint;
                this.systemConfig = systemConfig;
    
            }
    
    
            @Override
            protected void configure(HttpSecurity http) throws Exception{
                
                http
                    .antMatcher("/prometheus")
                    .authorizeRequests()
                    .anyRequest()
                    .authenticated()
                    .and()
                    .httpBasic()
                        .authenticationEntryPoint(prometheusAuthEntryPoint);
    
            }
       }
}

Any help or hint is highly appreciated, I m really stuck at this point.

Thanks in advance!

Answer 1

You can configure your WebSecurityConfig in such way that processes all the request that do not start with /prometheus.

httpSecurity
     .regexMatcher("^(?!/prometheus/).*$")
     .authorizeRequests()
                .antMatchers(HttpMethod.POST, "/refresh")
                .permitAll()
                .antMatchers("/css/*.css", "/js/*.js")
                .permitAll()
                .anyRequest()
                .authenticated()
                .and()
                .formLogin()
                .loginPage("/loginPage")
                .failureHandler(failureHandler)
                .successHandler(successHandler)
                .and()
                .logout()
                .logoutUrl("/logoutPage")
                .invalidateHttpSession(true)
                .deleteCookies("JSESSIONID")
                .permitAll()
                .and()
                .csrf()
                .disable();