org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint Java Examples

@Override
protected void configure(HttpSecurity http) throws Exception {
    http
        .addFilterAfter(new OAuth2ClientContextFilter(), AbstractPreAuthenticatedProcessingFilter.class)
        .addFilterAfter(openIdConnectFilter, OAuth2ClientContextFilter.class)
        .authorizeRequests()
        .antMatchers("/").permitAll().and()
        .authorizeRequests()
        .antMatchers(apiBaseUri).authenticated().and()
        .authorizeRequests().anyRequest().authenticated().and()
        .httpBasic().authenticationEntryPoint(
            new LoginUrlAuthenticationEntryPoint(callbackUri)).and()
            .logout()
            .logoutSuccessUrl("/")
            .permitAll().and()
            .csrf().disable();
}
 

@Override
protected void configure(HttpSecurity http) throws Exception {
    http
            .addFilterAfter(new OAuth2ClientContextFilter(), AbstractPreAuthenticatedProcessingFilter.class)
            .addFilterAfter(openIdConnectFilter, OAuth2ClientContextFilter.class)
            .authorizeRequests()
            .antMatchers("/").permitAll().and()
            .authorizeRequests()
            .antMatchers(apiBaseUri).authenticated().and()
            .authorizeRequests().anyRequest().authenticated().and()
            .httpBasic().authenticationEntryPoint(
            new LoginUrlAuthenticationEntryPoint(callbackUri)).and()
            .logout()
            .logoutSuccessUrl("/")
            .permitAll().and()
            .csrf().disable();
}
 

@Override
protected void configure(HttpSecurity http) throws Exception {
    http
        .addFilterAfter(new OAuth2ClientContextFilter(), AbstractPreAuthenticatedProcessingFilter.class)
        .addFilterAfter(facebookLoginFilter, OAuth2ClientContextFilter.class)
        .authorizeRequests()
        .antMatchers("/", "/callback").permitAll().and()
        .authorizeRequests()
        .antMatchers("/profile/*").authenticated().and()
        .authorizeRequests().anyRequest().authenticated().and()
        .httpBasic().authenticationEntryPoint(
            new LoginUrlAuthenticationEntryPoint("/callback")).and()
            .logout().logoutSuccessUrl("/").permitAll().and()
            .headers().frameOptions().disable().and()
            .csrf().disable();
}
 

@Override
protected void configure(HttpSecurity http) throws Exception {
    boolean usingFacebookAuthentication = facebook().getClientId() != null && !facebook().getClientId().isEmpty();
    if (usingFacebookAuthentication) {
        // @formatter:off
        http.antMatcher("/**").authorizeRequests().antMatchers("/**").permitAll().anyRequest()
                .authenticated().and().exceptionHandling()
                .authenticationEntryPoint(new LoginUrlAuthenticationEntryPoint("/login")).and().logout()
                .logoutSuccessUrl("/").permitAll().and().csrf()
                .csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse()).and()
                .addFilterBefore(ssoFilter(), BasicAuthenticationFilter.class);
        // @formatter:on
    } else {
        http.antMatcher("/**").authorizeRequests().anyRequest().permitAll();
    }
}
 

@Bean

    public ExceptionTranslationFilter exceptionTranslationFilter() {
        final AuthenticationEntryPoint loginUrlAuthenticationEntryPoint
                = new LoginUrlAuthenticationEntryPoint("/login.jsp");

        final AccessDeniedHandlerImpl accessDeniedHandlerImpl = new AccessDeniedHandlerImpl();
        accessDeniedHandlerImpl.setErrorPage("/accessDenied.jsp");

        final ExceptionTranslationFilter eTranslationFilter = new ExceptionTranslationFilter(loginUrlAuthenticationEntryPoint);
        eTranslationFilter.setAccessDeniedHandler(accessDeniedHandlerImpl);
        return eTranslationFilter;
    }
 

@Override
protected void configure(HttpSecurity http) throws Exception {
	
	http.exceptionHandling()			
		.authenticationEntryPoint(new LoginUrlAuthenticationEntryPoint("/"))
			.and()
		.authorizeRequests()								
			.antMatchers("/**").permitAll()
			.and()		
		.rememberMe()
			.key("vaadin4spring")
			.rememberMeServices(persistentTokenBasedRememberMeServices())
			.and()				
		.csrf().disable();
}
 

@Override
protected void configure(HttpSecurity aHttp) throws Exception
{
    aHttp
        .rememberMe()
        .and()
        .csrf().disable()
        .authorizeRequests()
            .antMatchers("/login.html*").permitAll()
            // Resources need to be publicly accessible so they don't trigger the login
            // page. Otherwise it could happen that the user is redirected to a resource
            // upon login instead of being forwarded to a proper application page.
            .antMatchers("/favicon.ico").permitAll()
            .antMatchers("/favicon.png").permitAll()
            .antMatchers("/assets/**").permitAll()
            .antMatchers("/images/**").permitAll()
            .antMatchers("/resources/**").permitAll()
            .antMatchers("/wicket/resource/**").permitAll()
            .antMatchers("/swagger-ui.html").access("hasAnyRole('ROLE_REMOTE')")
            .antMatchers("/admin/**").access("hasAnyRole('ROLE_ADMIN')")
            .antMatchers("/doc/**").access("hasAnyRole('ROLE_ADMIN', 'ROLE_USER')")
            .antMatchers("/**").access("hasAnyRole('ROLE_ADMIN', 'ROLE_USER')")
            .anyRequest().denyAll()
        .and()
        .exceptionHandling()
            .defaultAuthenticationEntryPointFor(
                    new LoginUrlAuthenticationEntryPoint("/login.html"), 
                    new AntPathRequestMatcher("/**"))
        .and()
            .headers().frameOptions().sameOrigin();
}
 

@Override
public void afterPropertiesSet() throws Exception {
	if(defaultAuthenticationEntryPoint==null){
		LoginUrlAuthenticationEntryPoint entryPoint = new LoginUrlAuthenticationEntryPoint(securityConfig.getLoginUrl());
		entryPoint.setForceHttps(forceHttps);
		entryPoint.setPortMapper(new PortMapperImpl(){
			public Integer lookupHttpsPort(Integer httpPort) {
				Integer port = super.lookupHttpsPort(httpPort);
				return port==null?httpsPort:port;
			}
		});
		PropertyAccessorFactory.forDirectFieldAccess(entryPoint).setPropertyValue("redirectStrategy.contextRelative", contextRelative);
		this.defaultAuthenticationEntryPoint = entryPoint;
	}
}
 

@SuppressWarnings("ProhibitedExceptionDeclared")
@Override
protected void configure(final HttpSecurity http) throws Exception {
    final LinkedHashMap<RequestMatcher, AuthenticationEntryPoint> entryPoints = new LinkedHashMap<>();
    entryPoints.put(new AntPathRequestMatcher("/api/**"), new Http403ForbiddenEntryPoint());
    entryPoints.put(AnyRequestMatcher.INSTANCE, new LoginUrlAuthenticationEntryPoint(FindController.DEFAULT_LOGIN_PAGE));
    final AuthenticationEntryPoint authenticationEntryPoint = new DelegatingAuthenticationEntryPoint(entryPoints);

    http
        .csrf()
            .disable()
        .exceptionHandling()
            .authenticationEntryPoint(authenticationEntryPoint)
            .accessDeniedPage("/authentication-error")
            .and()
        .logout()
            .logoutUrl("/logout")
            .logoutSuccessUrl(FindController.DEFAULT_LOGIN_PAGE)
            .and()
        .authorizeRequests()
            .antMatchers(FindController.APP_PATH + "/**").hasAnyRole(FindRole.USER.name())
            .antMatchers(FindController.CONFIG_PATH).hasRole(FindRole.CONFIG.name())
            .antMatchers("/api/public/**").hasRole(FindRole.USER.name())
            .antMatchers("/api/bi/**").hasRole(FindRole.BI.name())
            .antMatchers("/api/config/**").hasRole(FindRole.CONFIG.name())
            .antMatchers("/api/admin/**").hasRole(FindRole.ADMIN.name())
            .antMatchers(FindController.DEFAULT_LOGIN_PAGE).permitAll()
            .antMatchers(FindController.LOGIN_PATH).permitAll()
            .antMatchers("/").permitAll()
            .anyRequest().denyAll()
            .and()
        .headers()
            .defaultsDisabled()
            .frameOptions()
            .sameOrigin();

    idolSecurityCustomizer.customize(http, authenticationManager());
}
 

@Override
protected void configure(HttpSecurity http) throws Exception {
    logger.debug("Configuring web security");

    http.headers().cacheControl().disable();

    http.csrf().ignoringAntMatchers("/shutdown", "/api/rotation");

    http.authorizeRequests()
            .antMatchers("/intl/*", "/img/*", "/fonts/*", "/login/**", "/webjars/**", "/cli/**", "/health").permitAll()
            .antMatchers("/shutdown", "/api/rotation").hasIpAddress("127.0.0.1").anyRequest().permitAll()
            .anyRequest().fullyAuthenticated()
            .and()
            .formLogin()
            .loginPage("/login")
            .successHandler(new ShowPageAuthenticationSuccessHandler())
            .and()
            .logout().logoutSuccessUrl("/login?logout").permitAll();

    if (headerAuth) {
        http.addFilterBefore(requestHeaderAuthenticationFilter(), BasicAuthenticationFilter.class);
    }

    if (oauth2Enabled) {
        http.addFilterBefore(oauthFilter(), BasicAuthenticationFilter.class);
    }

    http.exceptionHandling().defaultAuthenticationEntryPointFor(new Http401AuthenticationEntryPoint("API_UNAUTHORIZED"), new AntPathRequestMatcher("/api/*"));
    http.exceptionHandling().defaultAuthenticationEntryPointFor(new LoginUrlAuthenticationEntryPoint(oauth2Enabled ? "/login/oauth" : "/login"), new AntPathRequestMatcher("/*"));
}
 

@Override
protected void configure(HttpSecurity http) throws Exception {
  http.csrf().disable();
  http.headers().frameOptions().sameOrigin();
  http.authorizeRequests()
      .antMatchers(BY_PASS_URLS).permitAll()
      .antMatchers("/**").authenticated();
  http.formLogin().loginPage("/signin").defaultSuccessUrl("/", true).permitAll().failureUrl("/signin?#/error").and()
          .httpBasic();
  http.logout().logoutUrl("/user/logout").invalidateHttpSession(true).clearAuthentication(true)
          .logoutSuccessUrl("/signin?#/logout");
  http.exceptionHandling().authenticationEntryPoint(new LoginUrlAuthenticationEntryPoint("/signin"));
}
 

@Override
protected void configure(HttpSecurity http) throws Exception {
  http.csrf().disable();
  http.headers().frameOptions().sameOrigin();
  http.authorizeRequests()
      .antMatchers(BY_PASS_URLS).permitAll()
      .antMatchers("/**").hasAnyRole(USER_ROLE);
  http.formLogin().loginPage("/signin").defaultSuccessUrl("/", true).permitAll().failureUrl("/signin?#/error").and()
      .httpBasic();
  http.logout().logoutUrl("/user/logout").invalidateHttpSession(true).clearAuthentication(true)
      .logoutSuccessUrl("/signin?#/logout");
  http.exceptionHandling().authenticationEntryPoint(new LoginUrlAuthenticationEntryPoint("/signin"));
}
 

@Override
protected void configure(HttpSecurity aHttp) throws Exception
{
    aHttp
        .rememberMe()
        .and()
        .csrf().disable()
        .authorizeRequests()
            .antMatchers("/login.html*").permitAll()
            // Resources need to be publicly accessible so they don't trigger the login
            // page. Otherwise it could happen that the user is redirected to a resource
            // upon login instead of being forwarded to a proper application page.
            .antMatchers("/favicon.ico").permitAll()
            .antMatchers("/favicon.png").permitAll()
            .antMatchers("/assets/**").permitAll()
            .antMatchers("/images/**").permitAll()
            .antMatchers("/resources/**").permitAll()
            .antMatchers("/wicket/resource/**").permitAll()
            .antMatchers("/swagger-ui.html").access("hasAnyRole('ROLE_REMOTE')")
            .antMatchers("/admin/**").access("hasAnyRole('ROLE_ADMIN')")
            .antMatchers("/doc/**").access("hasAnyRole('ROLE_ADMIN', 'ROLE_USER')")
            .antMatchers("/**").access("hasAnyRole('ROLE_ADMIN', 'ROLE_USER')")
            .anyRequest().denyAll()
        .and()
        .exceptionHandling()
            .defaultAuthenticationEntryPointFor(
                    new LoginUrlAuthenticationEntryPoint("/login.html"), 
                    new AntPathRequestMatcher("/**"))
        .and()
            .headers().frameOptions().sameOrigin();
}
 

@Bean
public LoginUrlAuthenticationEntryPoint loginUrlAuthenticationEntryPoint(){
    return new LoginUrlAuthenticationEntryPoint("/login/form");
}
 

public RestAwareExceptionTranslationFilter(final String loginFormUrl) {
    super(new LoginUrlAuthenticationEntryPoint(loginFormUrl));
}
 

@Override
protected void configure(HttpSecurity http) throws Exception {
	final RequestMatcher textHtmlMatcher = new MediaTypeRequestMatcher(
			contentNegotiationStrategy,
			MediaType.TEXT_HTML);

	final String loginPage = dashboard("/#/login");

	final BasicAuthenticationEntryPoint basicAuthenticationEntryPoint = new BasicAuthenticationEntryPoint();
	basicAuthenticationEntryPoint.setRealmName(securityProperties.getBasic().getRealm());
	basicAuthenticationEntryPoint.afterPropertiesSet();

	http
		.csrf()
		.disable()
		.authorizeRequests()
		.antMatchers("/")
		.authenticated()
		.antMatchers(
				dashboard("/**"),
				"/authenticate",
				"/security/info",
				"/features",
				"/assets/**").permitAll()
	.and()
		.formLogin().loginPage(loginPage)
		.loginProcessingUrl(dashboard("/login"))
		.defaultSuccessUrl(dashboard("/")).permitAll()
	.and()
		.logout().logoutUrl(dashboard("/logout"))
			.logoutSuccessUrl(dashboard("/logout-success.html"))
		.logoutSuccessHandler(new HttpStatusReturningLogoutSuccessHandler()).permitAll()
	.and().httpBasic()
		.and().exceptionHandling()
		.defaultAuthenticationEntryPointFor(
				new LoginUrlAuthenticationEntryPoint(loginPage),
				textHtmlMatcher)
		.defaultAuthenticationEntryPointFor(basicAuthenticationEntryPoint,
				AnyRequestMatcher.INSTANCE)
	.and()
		.authorizeRequests()
		.anyRequest().authenticated();

	final SessionRepositoryFilter<ExpiringSession> sessionRepositoryFilter = new SessionRepositoryFilter<ExpiringSession>(
			sessionRepository());
	sessionRepositoryFilter
			.setHttpSessionStrategy(new HeaderHttpSessionStrategy());

	http.addFilterBefore(sessionRepositoryFilter,
			ChannelProcessingFilter.class).csrf().disable();
	http.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.IF_REQUIRED);
}
 

@Override
protected void configure(final HttpSecurity http) throws Exception {

    final boolean enableOidc = oidcUserService != null && authenticationSuccessHandler != null;

    // workaround regex: we need to exclude the URL /UI/HEARTBEAT here
    // because we bound the vaadin application to /UI and not to root,
    // described in vaadin-forum:
    // https://vaadin.com/forum#!/thread/3200565.
    HttpSecurity httpSec;
    if (enableOidc) {
        httpSec = http.regexMatcher("(?!.*HEARTBEAT)^.*\\/(UI|oauth2).*$");
    } else {
        httpSec = http.regexMatcher("(?!.*HEARTBEAT)^.*\\/UI.*$");
    }
    // disable as CSRF is handled by Vaadin
    httpSec.csrf().disable();

    if (hawkbitSecurityProperties.isRequireSsl()) {
        httpSec = httpSec.requiresChannel().anyRequest().requiresSecure().and();
    } else {

        LOG.info(
                "\"******************\\n** Requires HTTPS Security has been disabled for UI, should only be used for developing purposes **\\n******************\"");
    }

    if (!StringUtils.isEmpty(hawkbitSecurityProperties.getContentSecurityPolicy())) {
        httpSec.headers().contentSecurityPolicy(hawkbitSecurityProperties.getContentSecurityPolicy());
    }

    // UI
    httpSec.authorizeRequests().antMatchers("/UI/login/**", "/UI/UIDL/**").permitAll()
            .anyRequest().authenticated();

    if (enableOidc) {
        // OIDC
        httpSec.oauth2Login().userInfoEndpoint().oidcUserService(oidcUserService).and()
                .successHandler(authenticationSuccessHandler).and().oauth2Client();
    } else {
        // UI login / Basic auth
        httpSec.exceptionHandling().authenticationEntryPoint(new LoginUrlAuthenticationEntryPoint("/UI/login"));
    }

    // UI logout
    httpSec.logout().logoutUrl("/UI/logout*").addLogoutHandler(logoutHandler)
            .logoutSuccessHandler(logoutSuccessHandler);

}
 

@Override
    protected void configure(HttpSecurity httpSecurity) throws Exception {
        
        httpSecurity
            .csrf().disable()	
//                .csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse())
//            .and()		
				.userDetailsService(userDetailsService)
                .authorizeRequests()
                .antMatchers(HttpMethod.OPTIONS, "/**").permitAll()
                .antMatchers("/login").permitAll()
                .antMatchers("/error").permitAll()
                .antMatchers("/pub/**").permitAll()
                .antMatchers("/v2/api-docs").permitAll()
                .antMatchers("/*.html").permitAll()
                .antMatchers("/**/*.html").permitAll()
                .antMatchers("/swagger-resources").permitAll()
                .antMatchers("/swagger-resources/**").permitAll()
                .antMatchers("/","/admin/").permitAll()
                .antMatchers("/admin/**","/**/favicon.ico", "/webjars/**").permitAll()
                .antMatchers("/**").authenticated()	
             .and()
                .formLogin()
//				.loginPage("/login")
				.usernameParameter("username")
				.passwordParameter("password")
				.successHandler(authenticationSuccessHandler())
				.failureHandler(authenticationFailureHandler())
				.permitAll()
            .and()
            	.oauth2Login()
            	.successHandler(oauth2SuccessHandler())
			.and().
				rememberMe()/* weex下cookie有问题 .alwaysRemember(true)*/
				//.alwaysRemember(true)
				.tokenValiditySeconds(840000)
				.tokenRepository(tokenRepository())
            .and()
            	.logout().logoutUrl("/logout").logoutSuccessHandler(logoutSuccessHandler)
            .and()
                .headers().cacheControl();
        
//        httpSecurity.addFilterBefore(jwtAuthenticationTokenFilter, UsernamePasswordAuthenticationFilter.class);
        // authenticationEntryPoint(entryPointUnauthorizedHandler)
        RequestMatcher preferredMatcher = new AntPathRequestMatcher("/api/**");
        RequestMatcher allMatcher = new AntPathRequestMatcher("/**");
		httpSecurity.exceptionHandling()
				.defaultAuthenticationEntryPointFor(entryPointUnauthorizedHandler, preferredMatcher)
				.defaultAuthenticationEntryPointFor(new LoginUrlAuthenticationEntryPoint("/login"), allMatcher)
				.accessDeniedHandler(restAccessDeniedHandler);

    }
 

@Bean
public AuthenticationEntryPoint authenticationEntryPoint() {
    return new LoginUrlAuthenticationEntryPoint(LOGIN_URL);
}
 

@Override
protected void configure(HttpSecurity http) throws Exception {
    http.csrf().disable()
        .sessionManagement().sessionCreationPolicy(props.isStateless() ?
            SessionCreationPolicy.STATELESS : SessionCreationPolicy.IF_REQUIRED).and()
        .formLogin().disable()
        // 支持跨域，从CorsConfigurationSource中取跨域配置
        .cors()
            .and()
            // 禁用iframe跨域
            .headers()
            .frameOptions()
            .disable();

    // 配置预设置
    presetConfigure(http);

    // 如果是无状态方式
    if (props.isStateless()) {
        // 应用Token认证配置器，忽略登出请求
        http.apply(new CrustAuthenticationConfigurer<>(authFailureHandler())).permissiveRequestUrls(props.getLogoutUrl())
                .and()
                .logout()
                .logoutUrl(props.getLogoutUrl())
                .addLogoutHandler((req, res, auth) -> CrustContext.invalidate())
                .logoutSuccessHandler(new HttpStatusReturningLogoutSuccessHandler());
    } else {
        // 自定义session方式登录
        http.httpBasic().authenticationEntryPoint(new LoginUrlAuthenticationEntryPoint(props.getLoginUrl()))
                .and()
                .sessionManagement()
                .sessionFixation().changeSessionId()
                .sessionAuthenticationErrorUrl(props.getLoginUrl())
                .sessionAuthenticationFailureHandler(authFailureHandler().get()).and()
        .logout()
                .logoutUrl(props.getLogoutUrl())
                .addLogoutHandler((req, res, auth) -> CrustContext.invalidate())
                .logoutSuccessUrl(props.getLoginUrl())
                .invalidateHttpSession(true);
    }
}
 

@Bean
public LoginUrlAuthenticationEntryPoint authenticationEntryPoint() {
  return new AjaxAwareLoginUrlAuthenticationEntryPoint(MolgenisLoginController.URI);
}
 

@Bean
public AuthenticationEntryPoint loginUrlauthenticationEntryPoint(){
    return new LoginUrlAuthenticationEntryPoint("/userLogin");
}
 

@Bean
public AuthenticationEntryPoint loginUrlauthenticationEntryPointWithWarning(){
    return new LoginUrlAuthenticationEntryPoint("/userLoginWithWarning");
}