java - Using multiple WebSecurityConfigurerAdapter with different AuthenticationProviders (basic auth for API and LDAP for web app) -

according spring security reference section 5.7 should possible define more 1 security adapter.

i try same without success. after server reboot, first x times api works fine basic auth, after couple of times i'm redirected login (form) page, should happen our web app, not api calls.

my code:

@enablewebsecurity public class multihttpsecurityconfig  {      @configuration     @order(1)     public static class apiwebsecurityconfigurationadapter extends websecurityconfigureradapter {          @autowired         private environment env;          @autowired         public void configureglobal(authenticationmanagerbuilder auth) throws exception {             auth.inmemoryauthentication().                 withuser("admin").password("pw_test").roles(api_role);         }          protected void configure(httpsecurity http) throws exception {             http               .antmatcher("/services/**")               .authorizerequests()               .anyrequest().hasrole(api_role)               .and()               .httpbasic()               .and()               .csrf()               .disable();         }     }      @configuration     @order(2)     public static class formloginwebsecurityconfigureradapter extends websecurityconfigureradapter {          @autowired         private environment env;          @autowired         public void configureglobal(authenticationmanagerbuilder auth) throws exception {             auth.authenticationprovider(activedirectoryldapauthenticationprovider());             auth.erasecredentials(false);         }          @override         protected void configure(httpsecurity http) throws exception {             // ldap form authentication             http.authorizerequests()                 .antmatchers("/login.html").permitall()                 .antmatchers("/css/**").permitall()                  .antmatchers("/js/**").permitall()                  .antmatchers("/images/**").permitall()                  .anyrequest().authenticated()             .and().formlogin()                 .failureurl("/login.html?error=1")                 .loginpage("/login.html")                 .loginprocessingurl("/j_spring_security_check")                 .defaultsuccessurl("/success.html")                 .usernameparameter("j_username")                 .passwordparameter("j_password")                 .permitall();              http.csrf().disable();              // iframes settings             http                 .headers()                 .frameoptions().sameorigin()                 .httpstricttransportsecurity().disable();              // https             http                 .requireschannel()                 .anyrequest()                 .requiressecure();              //map 8080 https port             http.portmapper().http(8080).mapsto(443);         }          @bean         public authenticationprovider activedirectoryldapauthenticationprovider() {             customldapauthenticationprovider provider = new customldapauthenticationprovider(env.getproperty("ldap.domain"), env.getproperty("ldap.url"), env.getproperty("ldap.base"));             provider.setconvertsuberrorcodestoexceptions(true);             provider.setuseauthenticationrequestcredentials(true);             return provider;         }     } } 

any idea?

i'm using spring boot version 1.4.1-release , spring security version 4.1.3-release.

you use same authenticationmanager both configurations, because autowire same authenticationmanagerbuilder.

see spring security architecture:

@configuration public class applicationsecurity extends websecurityconfigureradapter {      ... // web stuff here      @autowired     public initialize(authenticationmanagerbuilder builder, datasource datasource) {         auth.jdbcauthentication().datasource(datasource).withuser("dave")             .password("secret").roles("user");     }  } 

this example relates web application, usage of authenticationmanagerbuilder more applicable (see below more detail on how web application security implemented). note authenticationmanagerbuilder @autowired method in @bean - makes build global (parent) authenticationmanager. in contrast if had done way:

@configuration public class applicationsecurity extends websecurityconfigureradapter {      @autowired     datasource datasource;      ... // web stuff here      @override     public configure(authenticationmanagerbuilder builder) {         auth.jdbcauthentication().datasource(datasource).withuser("dave")             .password("secret").roles("user");     }  } 

(using @override of method in configurer) authenticationmanagerbuilder used build "local" authenticationmanager, child of global one.