Quantcast
Channel: Recent Questions - Stack Overflow
Viewing all articles
Browse latest Browse all 11601

Annotations on the API in SecurityFilterChain are blocked from controller access by swagger, only accepted by postman [closed]

$
0
0

API Java - Spring Boot allows access to controllers via postman, but via swagger not even if both are authenticated with the correct token and validated in Azure Dicretory.When I use annotations of the type @Component, @Service or @Configuration, SecurityFilterChain allows requests from controllers through postman, but blocks it in swagger, when removing any of these annotations the problem is reversed.

package br.com.xxxx.authentication.service;import br.com.xxxx.authentication.service.abstraction.interfaces.IMySecurityService;import org.springframework.context.annotation.Bean;import org.springframework.context.annotation.Configuration;import org.springframework.core.Ordered;import org.springframework.core.annotation.Order;import org.springframework.security.config.Customizer;import org.springframework.security.config.annotation.web.builders.HttpSecurity;import org.springframework.security.oauth2.client.oidc.web.logout.OidcClientInitiatedLogoutSuccessHandler;import org.springframework.security.oauth2.client.registration.ClientRegistrationRepository;import org.springframework.security.web.SecurityFilterChain;@Configurationpublic class MySecurityService implements IMySecurityService {    @Order(Ordered.HIGHEST_PRECEDENCE)    @Bean    public SecurityFilterChain clientSecurityFilterChain(HttpSecurity http, ClientRegistrationRepository clientRegistrationRepository) throws Exception {        http.oauth2Login();        final var logoutSuccessHandler = new OidcClientInitiatedLogoutSuccessHandler(clientRegistrationRepository);        logoutSuccessHandler.setPostLogoutRedirectUri("{baseUrl}");        http.logout(logout -> logout.logoutSuccessHandler(logoutSuccessHandler));        http.cors().disable();        http.csrf().disable();        http.oauth2ResourceServer((oauth2) -> oauth2.jwt(Customizer.withDefaults()));        http.authorizeHttpRequests().requestMatchers("/swagger*/**", "/v3/api-docs*/**", "/login/**", "/oauth2/**", "/user/login/**").permitAll().anyRequest().authenticated();        return http.build();    }}
package br.com.xxxx.authentication.service.abstraction.interfaces;import org.springframework.security.config.annotation.web.builders.HttpSecurity;import org.springframework.security.oauth2.client.registration.ClientRegistrationRepository;import org.springframework.security.web.SecurityFilterChain;public interface IMySecurityService {    SecurityFilterChain clientSecurityFilterChain(HttpSecurity http, ClientRegistrationRepository clientRegistrationRepository) throws Exception;}

When removing any of these annotations the problem is reversed, starting to accept requests from the controller through swagger only.

The error that has been occurring is HTTP 401

Debuging log and print-screen Postman
[Postman call - not using anotation @Configurarion][1]
[1]: https://i.stack.imgur.com/nFNx8.png

[Postman call - using anotation @Configurarion][2]
[2]: https://i.stack.imgur.com/SwtaE.png

[Application Log][3]
[3]: https://i.stack.imgur.com/hnnG2.png

Debuging log and print-screen Swagger
[Returning swagger calling controller - using anotation @Configurarion][4]
[4]: https://i.stack.imgur.com/ZIGq0.png

[Swagger calling controller - not using anotation @Configurarion][5]
[5]: https://i.stack.imgur.com/oHktn.png


Viewing all articles
Browse latest Browse all 11601

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>