Pourquoi je reçois 403 sur l'authentification de base de sécurité de démarrage de printemps?

Question

J'ai suivi le tutoriel http://www.concretepage.com/spring-boot/spring-boot-security-rest-jpa-hibernate-mysql-crud-example

Note: Working on Spring-boot, Spring Data JPA, Security and basic authentication

Mon code est ci-dessous

UserDetailsService.java

@Override 
public UserDetails loadUserByUsername(String userName) throws UsernameNotFoundException { 
    System.out.println("UserName: " + userName); 
    User activeUserInfo = userRepository.findByUserName(userName); 

    System.out.println("Role D : " + activeUserInfo.getUserRole().getName()); //This prints 'ADMIN' as expected 
    GrantedAuthority authority = new SimpleGrantedAuthority(activeUserInfo.getUserRole().getName()); 
    System.out.println("User : " + activeUserInfo.getUserName()); //This prints my username 'test123' as expected 
    System.out.println("PWD : " + activeUserInfo.getPassword()); //This prints '$2a$10$PN/MwjCHtCWsI4auW6Q8AOxb4dug4WSO8tfINySqHZ8eYVjFKIAW6' as expected 

    System.out.println("Authority : " + authority); 
    UserDetails userDetails = (UserDetails) new org.springframework.security.core.userdetails.User(activeUserInfo.getUserName(), activeUserInfo.getPassword(), 
      Arrays.asList(authority)); 
    return userDetails; 
} 

Sysout imprime les valeurs correctes de DB.

SecurityConfiguration.java

@Autowired 
public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception { 
      BCryptPasswordEncoder passwordEncoder = new BCryptPasswordEncoder(); 
      auth.userDetailsService(userDetailsService).passwordEncoder(passwordEncoder); 
} 


@Override 
protected void configure(HttpSecurity http) throws Exception { 

    http.csrf().disable().authorizeRequests().antMatchers("/server/rest/secure/**").hasAnyRole("ADMIN", "Non Admin").and() 
      .httpBasic().realmName(REALM).authenticationEntryPoint(new CustomBasicAuthenticationEntryPoint()); 
} 

CustomBasicAuthenticationEntryPoint .JAVA

public class CustomBasicAuthenticationEntryPoint extends BasicAuthenticationEntryPoint { 

@Override 
public void commence(final HttpServletRequest request, 
     final HttpServletResponse response, 
     final AuthenticationException authException) throws IOException, ServletException { 

    response.setStatus(HttpServletResponse.SC_UNAUTHORIZED); 
    response.addHeader("WWW-Authenticate", "Basic realm=" + getRealmName() + ""); 

    PrintWriter writer = response.getWriter(); 
    writer.println("HTTP Status 401 : " + authException.getMessage()); 
    response.setHeader("WWW-Authenticate", "FormBased"); 
    response.sendError(HttpServletResponse.SC_UNAUTHORIZED, "Unauthorized"); 
} 

@Override 
public void afterPropertiesSet() throws Exception { 
    setRealmName("MY_TEST_REALM"); 
    super.afterPropertiesSet(); 
} 

}

Mais au cours de la connexion que je reçois status":403,"error":"Forbidden","message":"Access is denied"

Remarque: Auparavant, j'ai utilisé Base64 pour le mot de passe crypté/décrypté. Mais maintenant mis à jour à BCrypt basé sur cet exemple. Donc, pour le moment, j'ai généré le mot de passe BCrypt en ligne. Mon pwd "teste" BCrypt pwd est "$ 2a $ 10 $ PN/MwjCHtCWsI4auW6Q8AOxb4dug4WSO8tfINySqHZ8eYVjFKIAW6". Ai-je fait une erreur à ce sujet? Quel est le problème avec mon code?

Answer 1

Je pense que vous ne finalement .permit() S'il vous plaît essayer mon code SecurityConfiguration.java:

protected void configure(HttpSecurity http) throws Exception { 
     http.csrf().disable().cors().disable().httpBasic().and().authorizeRequests() 
     .antMatchers(PUBLIC_MATCHERS).permitAll().anyRequest().authenticated(); 
    } 

@Autowired 
public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception { 
    auth.userDetailsService(userSecurityService).passwordEncoder(passwordEncoder()); 
} 

PS: PUBLIC_MATCHERS est

private static final String[] PUBLIC_MATCHERS = { 
with your folders 
    };