BAEL-3338: A Guide to AuthenticationManagerResolver in Spring Security

spring-5-security/pom.xml

@@ -1,5 +1,5 @@
 <project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-    xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
     <modelVersion>4.0.0</modelVersion>
     <groupId>com.baeldung</groupId>
     <artifactId>spring-5-security</artifactId>
@@ -60,5 +60,8 @@
             </plugin>
         </plugins>
     </build>
+    <properties>
+        <spring-boot.version>2.2.1.RELEASE</spring-boot.version>
+    </properties>
 
 </project>

spring-5-security/src/main/java/com/baeldung/authresolver/AuthResolverApplication.java

@@ -0,0 +1,11 @@
+package com.baeldung.authresolver;
+
+import org.springframework.boot.SpringApplication;
+import org.springframework.boot.autoconfigure.SpringBootApplication;
+
+@SpringBootApplication
+public class AuthResolverApplication {
+    public static void main(String[] args) {
+        SpringApplication.run(AuthResolverApplication.class, args);
+    }
+}

spring-5-security/src/main/java/com/baeldung/authresolver/AuthResolverController.java

@@ -0,0 +1,18 @@
+package com.baeldung.authresolver;
+
+import org.springframework.security.core.Authentication;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.RestController;
+
+@RestController
+public class AuthResolverController {
+    @GetMapping("/customer/welcome")
+    public String sayWelcomeToCustomer(Authentication authentication) {
+        return String.format("Welcome to our site, %s!", authentication.getPrincipal());
+    }
+
+    @GetMapping("/employee/welcome")
+    public String sayWelcomeToEmployee(Authentication authentication) {
+        return String.format("Welcome to our company, %s!", authentication.getPrincipal());
+    }
+}

spring-5-security/src/main/java/com/baeldung/authresolver/AuthResolverWebSecurityConfigurer.java

@@ -0,0 +1,92 @@
+package com.baeldung.authresolver;
+
+import java.util.Arrays;
+import javax.servlet.http.HttpServletRequest;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.security.authentication.AuthenticationManager;
+import org.springframework.security.authentication.AuthenticationManagerResolver;
+import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
+import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
+import org.springframework.security.config.annotation.web.builders.HttpSecurity;
+import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
+import org.springframework.security.core.Authentication;
+import org.springframework.security.core.authority.SimpleGrantedAuthority;
+import org.springframework.security.core.userdetails.UsernameNotFoundException;
+import org.springframework.security.web.authentication.AuthenticationConverter;
+import org.springframework.security.web.authentication.AuthenticationFilter;
+import org.springframework.security.web.authentication.www.BasicAuthenticationConverter;
+import org.springframework.security.web.authentication.www.BasicAuthenticationFilter;
+
+@Configuration
+public class AuthResolverWebSecurityConfigurer extends WebSecurityConfigurerAdapter {
+
+    public AuthenticationConverter authenticationConverter() {
+        return new BasicAuthenticationConverter();
+    }
+
+    public AuthenticationManagerResolver<HttpServletRequest> authenticationManagerResolver() {
+        return request -> {
+            if (request
+              .getPathInfo()
+              .startsWith("/employee")) return employeesAuthenticationManager();
+            return customersAuthenticationManager();
+        };
+    }
+
+    public AuthenticationManager customersAuthenticationManager() {
+        return authentication -> {
+            if (isCustomer(authentication)) {
+                return new UsernamePasswordAuthenticationToken(authentication.getPrincipal(), authentication.getCredentials(), Arrays.asList(new SimpleGrantedAuthority("ROLE_USER")));
+            }
+            throw new UsernameNotFoundException(authentication
+              .getPrincipal()
+              .toString());
+        };
+    }
+
+    public boolean isCustomer(Authentication authentication) {
+        return (authentication
+          .getPrincipal()
+          .toString()
+          .startsWith("customer"));
+    }
+
+    public boolean isEmployee(Authentication authentication) {
+        return (authentication
+          .getPrincipal()
+          .toString()
+          .startsWith("employee"));
+    }
+
+    public AuthenticationFilter authenticationFilter(AuthenticationManagerResolver<HttpServletRequest> resolver, AuthenticationConverter converter) {
+        AuthenticationFilter ret = new AuthenticationFilter(resolver, converter);
+        ret.setSuccessHandler((httpServletRequest, httpServletResponse, authentication) -> {
+        });
+        return ret;
+    }
+
+    public AuthenticationManager employeesAuthenticationManager() {
+        return authentication -> {
+            if (isEmployee(authentication)) {
+                return new UsernamePasswordAuthenticationToken(authentication.getPrincipal(), authentication.getCredentials(), Arrays.asList(new SimpleGrantedAuthority("ROLE_USER")));
+            }
+            throw new UsernameNotFoundException(authentication
+              .getPrincipal()
+              .toString());
+        };
+    }
+
+    @Override
+    protected void configure(HttpSecurity http) throws Exception {
+        http
+          .addFilterBefore(
+          authenticationFilter(
+            authenticationManagerResolver(), authenticationConverter()),
+          BasicAuthenticationFilter.class);
+    }
+
+    @Override
+    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
+        super.configure(auth);
+    }
+}

spring-5-security/src/test/java/com/baeldung/authresolver/AuthResolverIntegrationTest.java

@@ -0,0 +1,80 @@
+package com.baeldung.authresolver;
+
+import org.junit.Before;
+import org.junit.FixMethodOrder;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.junit.runners.MethodSorters;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.boot.test.context.SpringBootTest;
+import org.springframework.security.web.FilterChainProxy;
+import org.springframework.test.context.junit4.SpringRunner;
+import org.springframework.test.web.servlet.MockMvc;
+import org.springframework.test.web.servlet.setup.MockMvcBuilders;
+import org.springframework.util.Base64Utils;
+import org.springframework.web.context.WebApplicationContext;
+
+import static org.springframework.security.test.web.servlet.setup.SecurityMockMvcConfigurers.springSecurity;
+import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get;
+import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status;
+
+@RunWith(SpringRunner.class)
+@SpringBootTest(webEnvironment = SpringBootTest.WebEnvironment.RANDOM_PORT, classes = AuthResolverApplication.class)
+@FixMethodOrder(MethodSorters.NAME_ASCENDING)
+public class AuthResolverIntegrationTest {
+
+    @Autowired private FilterChainProxy springSecurityFilterChain;
+
+    @Autowired private WebApplicationContext wac;
+
+    private MockMvc mockMvc;
+
+    @Before
+    public void setup() {
+        this.mockMvc = MockMvcBuilders
+          .webAppContextSetup(wac)
+          .apply(springSecurity(springSecurityFilterChain))
+          .build();
+    }
+
+    @Test
+    public void givenCustomerCredential_whenWelcomeCustomer_thenExpectOk() throws Exception {
+        this.mockMvc
+          .perform(get("/customer/welcome")
+            .header(
+              "Authorization", String.format("Basic %s", Base64Utils.encodeToString("customer1:pass1".getBytes()))
+            )
+          )
+          .andExpect(status().is2xxSuccessful());
+    }
+
+    @Test
+    public void givenEmployeeCredential_whenWelcomeCustomer_thenExpect401Status() throws Exception {
+        this.mockMvc
+          .perform(get("/customer/welcome")
+            .header(
+              "Authorization", "Basic " + Base64Utils.encodeToString("employee1:pass1".getBytes()))
+          )
+          .andExpect(status().isUnauthorized());
+    }
+
+    @Test
+    public void givenEmployeeCredential_whenWelcomeEmployee_thenExpectOk() throws Exception {
+        this.mockMvc
+          .perform(get("/employee/welcome")
+            .header(
+              "Authorization", "Basic " + Base64Utils.encodeToString("employee1:pass1".getBytes()))
+          )
+          .andExpect(status().is2xxSuccessful());
+    }
+
+    @Test
+    public void givenCustomerCredential_whenWelcomeEmployee_thenExpect401Status() throws Exception {
+        this.mockMvc
+          .perform(get("/employee/welcome")
+            .header(
+              "Authorization", "Basic " + Base64Utils.encodeToString("customer1:pass1".getBytes()))
+          )
+          .andExpect(status().isUnauthorized());
+    }
+}