Spring Boot Security双认证：Basic Auth与OAuth2共存及超级用户配置问询

Hey Chris, great questions! Both of your requirements are totally achievable with Spring Boot Security—let’s break down how to implement them step by step.

To make an endpoint support both authentication methods, you need to configure Spring Boot Security to recognize multiple authentication mechanisms in a single filter chain. Here's how to do it:

Core Implementation Steps: #

• Enable both HttpBasic (for Basic Auth) and OAuth2 Resource Server (for JWT tokens) in your security configuration.
• Set up a composite authentication manager that handles both Basic Auth credentials and OAuth2 JWT tokens.

Example Code: #

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.authentication.ProviderManager;
import org.springframework.security.authentication.dao.DaoAuthenticationProvider;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.oauth2.server.resource.authentication.JwtAuthenticationProvider;
import org.springframework.security.provisioning.InMemoryUserDetailsManager;
import org.springframework.security.web.SecurityFilterChain;

import static org.springframework.security.config.Customizer.withDefaults;

@Configuration
@EnableWebSecurity
public class MultiAuthConfig {

    // Composite authentication manager supporting both Basic and OAuth2
    @Bean
    public AuthenticationManager authenticationManager(UserDetailsService userDetailsService, JwtAuthenticationProvider jwtAuthProvider) {
        DaoAuthenticationProvider basicAuthProvider = new DaoAuthenticationProvider();
        basicAuthProvider.setUserDetailsService(userDetailsService);
        
        return new ProviderManager(basicAuthProvider, jwtAuthProvider);
    }

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
            .authorizeHttpRequests(auth -> auth
                .anyRequest().authenticated()
            )
            // Enable Basic Auth processing
            .httpBasic(withDefaults())
            // Enable OAuth2 Resource Server (JWT validation)
            .oauth2ResourceServer(oauth2 -> oauth2.jwt(withDefaults()));
        
        return http.build();
    }

    // UserDetailsService for Basic Auth users (replace with your database setup if needed)
    @Bean
    public UserDetailsService userDetailsService() {
        UserDetails regularUser = User.withUsername("regular-user")
            .password("{bcrypt}$2a$10$Z8YxQkF...") // Use BCrypt-encrypted password
            .roles("USER")
            .build();
        return new InMemoryUserDetailsManager(regularUser);
    }
}

How It Works: #

• When a request arrives, Spring Security first checks for a Authorization: Basic ... header. If valid, it authenticates the user via the DaoAuthenticationProvider.
• If no valid Basic Auth header exists, it checks for a Authorization: Bearer <token> header and validates the JWT via the JwtAuthenticationProvider.
• Both mechanisms populate the security context with an authenticated user, granting access if they meet the endpoint's authorization rules.

Absolutely, this is feasible! The solution uses ordered security filter chains: a high-priority chain handles the super user's Basic Auth requests, while your existing OAuth2 chain processes regular users. Here's the setup:

Core Implementation Steps: #

1. Create a high-priority filter chain that matches all endpoints, validates Basic Auth, and only allows access to users with a SUPER_ADMIN role.
2. Keep your existing OAuth2 filter chain as the default (lower priority) for regular users.
3. Define the super user in your UserDetailsService.

Example Code: #

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.core.annotation.Order;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.provisioning.InMemoryUserDetailsManager;
import org.springframework.security.web.SecurityFilterChain;

import static org.springframework.security.config.Customizer.withDefaults;

@Configuration
@EnableWebSecurity
public class SuperUserAuthConfig {

    // High-priority chain for super user Basic Auth
    @Bean
    @Order(1)
    public SecurityFilterChain superUserFilterChain(HttpSecurity http) throws Exception {
        http
            .securityMatcher("/**") // Apply to all endpoints
            .authorizeHttpRequests(auth -> auth
                .anyRequest().hasRole("SUPER_ADMIN")
            )
            .httpBasic(withDefaults())
            .csrf(csrf -> csrf.disable()); // Optional: Disable CSRF for API-only endpoints
        
        return http.build();
    }

    // Default chain for regular OAuth2 users (your existing configuration)
    @Bean
    @Order(2)
    public SecurityFilterChain defaultOAuth2FilterChain(HttpSecurity http) throws Exception {
        http
            .authorizeHttpRequests(auth -> auth
                .anyRequest().authenticated()
            )
            .oauth2ResourceServer(oauth2 -> oauth2.jwt(withDefaults()));
        
        return http.build();
    }

    // Super user setup (can be replaced with database-backed user service)
    @Bean
    public UserDetailsService userDetailsService() {
        UserDetails superUser = User.withUsername("superadmin")
            .password("{bcrypt}$2a$10$E5XyZ...") // Replace with your BCrypt-encrypted password
            .roles("SUPER_ADMIN")
            .build();
        
        return new InMemoryUserDetailsManager(superUser);
    }
}

How It Works: #

• The @Order(1) chain runs first: if the request includes valid Basic Auth for the superadmin user, it grants access to any endpoint immediately.
• If the request doesn't match the super user's credentials, it falls through to the @Order(2) chain, which enforces your existing OAuth2 JWT authentication flow.
• Regular users will never interact with the super user's chain—their OAuth2 authentication process remains completely unaffected.

内容的提问来源于stack exchange，提问作者CrizR