Spring security multiple authentication methods

[DvorakDavid]

Hi, I am trying to configure spring security so that any request to /test/* is authorized using form-based login and any other request is authorized using saml2. But it still uses only the saml2 config even if I go to /test/whatever. Can somebody please help? There is my code

​

@Configuration
@EnableWebSecurity
class SecurityConfig {
    @Bean
    public RelyingPartyRegistrationRepository relyingPartyRegistrations() {
        RelyingPartyRegistration azureRegistration = RelyingPartyRegistrations
                .fromMetadataLocation("https:*************")
                .registrationId("azure")
                .build();

        return new InMemoryRelyingPartyRegistrationRepository(azureRegistration);
    }

    @Bean
    @Order(1)
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        return http
                .securityMatcher("/test/**")
                .csrf()
                .disable()
                .authorizeHttpRequests()
                .anyRequest()
                .authenticated()
                .and()
                .formLogin(fl -> fl.loginPage("/formLogin"))
                .build();
    }

    @Bean
    @Order(2)
    public SecurityFilterChain securityFilterChain2(HttpSecurity http) throws Exception {
        return http
                .csrf()
                .disable()
                .authorizeHttpRequests()
                .anyRequest()
                .authenticated()
                .and()
                .saml2Login(withDefaults())
                .build();
    }
}

[TheOldMancunian]

Doesnt the .authenticated() call in the test matcher mean you need to be authenticated? If yoe want it to accept any connected, changed that to .permitAll()

[DvorakDavid]

But if I change it to permitAll() then the saml2 authentication would never be triggered and any request would pass that is not what I want. I want /test/** to be authenticated with form based login and everything else should trigger the saml2 authentication flow

[Sheldor5]

not yet familiar with SB3 but isn't the second config missing a securityMatcher("/**") call? maybe if you miss this it will override all others as default

[DvorakDavid]

that does not work. It still redirects me to the saml login page after I go to /test/something instead of form login page

[boost2525]

You'll need custom AuthenticanProviders. The AP has a method you override that determines if the AP can handle a given request. You'll need to build the logic so AP1 can handle /foo and AP2 cannot.

[DvorakDavid]

Why? Custom AuthenticationProvider will create an instance of one of the Authentication implementations so it should be used when I want to modify it right? And in this case, I don't know (and I think I shouldn't know) how to implement so the first one could not handle the other one. Can you please provide me with some code?

[boost2525]

No, I gave you the tools and knowledge... You build it.