Unable to create AuthenticationManager bean-CodePudding

We are trying to user @PreAuthorize with token authentication.

When we try to use @PreAuthorize then SpringSecurity popsup with login page before an API gets called. We don't need that page as we have our own authentication process.

To skip that page we added @SpringBootApplication( exclude = { SecurityAutoConfiguration.class, ManagementWebSecurityAutoConfiguration.class }) on our main class.

After this the login page was skipped, but then all our API's when we trigger them gave error that Authentication needs to be there in the context.

For this we did below changes

@Configuration
public class MethodSecurityConfig extends WebSecurityConfigurerAdapter {

@Bean
    @Override
    public AuthenticationManager authenticationManagerBean() throws Exception {
        return super.authenticationManagerBean();
    }

    @Override
    public void configure(HttpSecurity http) throws Exception {

        http.csrf().disable().addFilter(new AuthFilter(authenticationManagerBean())).authorizeRequests().anyRequest().permitAll();
        
    }
    
}

@Component
public class AuthFilter implements Filter {

    
    private AuthenticationManager authenticationManager;

    
    public AuthFilter(AuthenticationManager authenticationManager) {
        this.authenticationManager = authenticationManager;
    }

    @Override
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain filterchain)
            throws IOException, ServletException {

        final String authorizationHeader = ((HttpServletRequest) request).getHeader("Authorization");
        System.out.println("===========Filter called================");

        final Authentication authentication = authenticationManager
                .authenticate(SecurityContextHolder.getContext().getAuthentication());

        System.out.println("===========Authentication================" authentication);
        
        if (authentication != null && !(authentication instanceof AnonymousAuthenticationToken)
                && authentication.isAuthenticated()) {

            // set authentication in security context holder
            SecurityContextHolder.getContext().setAuthentication(authentication);

        }
        filterchain.doFilter(request, response);
    }
}

Now when I'm getting error that no bean is present for AuthenticationManager.

I tried by many other ways still the bean is not getting injected in the filter

Can you comment on this ?

CodePudding user response：

@Configuration
public class MethodSecurityConfig extends WebSecurityConfigurerAdapter {

@Bean
@Override
public AuthenticationManager authenticationManagerBean() throws Exception    {
    return super.authenticationManagerBean();
}

@Override
public void configure(HttpSecurity http) throws Exception {

    http.csrf().disable().addFilter(new AuthFilter(authenticationManagerBean())).authorizeRequests().anyRequest().permitAll();
    
    }

}

@Component
public class AuthFilter implements Filter {

@Autowired //--->use this
private AuthenticationManager authenticationManager;


public AuthFilter(AuthenticationManager authenticationManager) {
    this.authenticationManager = authenticationManager;
}

@Override
public void doFilter(ServletRequest request, ServletResponse response, FilterChain filterchain)
        throws IOException, ServletException {

    final String authorizationHeader = ((HttpServletRequest) request).getHeader("Authorization");
    System.out.println("===========Filter called================");

    final Authentication authentication = authenticationManager
            .authenticate(SecurityContextHolder.getContext().getAuthentication());

    System.out.println("===========Authentication================" authentication);
    
    if (authentication != null && !(authentication instanceof AnonymousAuthenticationToken)
            && authentication.isAuthenticated()) {

        // set authentication in security context holder
        SecurityContextHolder.getContext().setAuthentication(authentication);

    }
    filterchain.doFilter(request, response);
}

}

CodePudding user response：

try something like this it might help:

@Bean(name = BeanIds.AUTHENTICATION_MANAGER)
   @Override
   public AuthenticationManager authenticationManagerBean() throws Exception {
       return super.authenticationManagerBean();
   }

you can also refer this How To Inject AuthenticationManager using Java Configuration in a Custom Filter