2

I have the following configuration with multiple <http.../> elements (in order to separately support REST authetication via basic auth, and user form login):

<security:http auto-config="false" pattern="/service/**" create-session="never" 
               entry-point-ref="basicAuthenticationEntryPoint" >
    <security:intercept-url pattern="/service/**" requires-channel="any" access="ROLE_REST_SERVICE" />
    <security:custom-filter position="BASIC_AUTH_FILTER" ref="basicAuthenticationFilter" />
</security:http>

<security:http auto-config="false" pattern="/**"
               entry-point-ref="loginUrlAuthenticationEntryPoint" >
    <security:logout logout-url="/logout" />
    <security:anonymous enabled="false"/>
    <security:custom-filter position="FORM_LOGIN_FILTER" ref="usernamePasswordAuthenticationFilter" />
    <security:custom-filter position="ANONYMOUS_FILTER" ref="anonymousAuthFilter" />
</security:http>

In each of my two filters requiring authentication (FORM_LOGIN_FILTER, and BASIC_AUTH_FILTER) I reference two different authentication managers.

But I get an error that I've already registered an authentication manager.

Why would I use one authentication manager when I know before hand which Authentication provider is going to be needed for each filter?

Should I not use the authentication manager and just start my AuthenticationProvider as a bean and pass it into the filter directly as the AuthenticationManager?

Trygve Laugstøl
  • 7,440
  • 2
  • 36
  • 40
David Parks
  • 30,789
  • 47
  • 185
  • 328
  • This is the kind of question that you should ask of the SpringSecurity developers on the relevant SpringSource forum. In my experience, they do answer this kind of thing, though the answers aren't always what you want to hear. – Stephen C Mar 18 '11 at 04:52
  • I've done that now as well. I've found the response on spring forums to be lackluster, at least the spring framework forums. Perhaps the security community is more active. – David Parks Mar 18 '11 at 09:26

1 Answers1

4

In spring security 3.1 you can have multiple http elements, each with their own authentication manager.

The only thing you need to do is add the following attribute authentication-manager-ref="your ref" to the http element.

Littm
  • 4,923
  • 4
  • 30
  • 38
Sagar R. Kapadia
  • 56
  • 2