spring security principal null/user not logged in on permitAll path

spring, spring-boot, spring-mvc, spring-security

Solution

Your '/open' resource is not mapped to any Security filters. It looks to me like you need a default `WebSecurityConfigurer` (with the default path pattern "/**") and marked as `permitAll()`. It should have a higher `@Order` than the others so it acts as a fallback.

@Order(67) // LOWEST
@Configuration
public static class NoAuthConfigurationAdapter extends WebSecurityConfigurerAdapter {
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.antMatcher("/**").authorizeRequests().anyRequest().permitAll();
    }
}

Problem

I have spring-security securing some paths in my app and leaving others open for anonymous access. The problem I am running into is related to the open parts where I have left the access as "permitAll". I only want to protect certain paths from access by a non-ADMIN but I do want the admin user to be recognizable when they are in the open parts of the path. Thymeleaf template (partial): ``` <p>Hello Spring Boot User <span th:text="${username}"/>!</p> <div sec:authorize="isAnonymous()">isAnonymous</div> <div sec:authorize="isRememberMe()">isRememberMe</div> <div sec:authorize="isAuthenticated()">isAuthenticated</div> <div sec:authorize="isFullyAuthenticated()">isFullyAuthenticated</div> ``` NOTE: The model defines the username as: ``` String username = (principal != null ? principal.getName() : "ANONYMOUS"); ``` Config (Java based) - there are multiple types of authentication being used ``` @Configuration public static class FormLoginConfigurationAdapter extends WebSecurityConfigurerAdapter { @Override protected void configure(HttpSecurity http) throws Exception { http.antMatcher("/form/**").authorizeRequests().anyRequest().authenticated() .and().formLogin().permitAll().loginPage("/form/login").loginProcessingUrl("/form/login") .and().logout().logoutUrl("/form/logout").invalidateHttpSession(true).logoutSuccessUrl("/"); } } @Order(45) // LOW @Configuration public static class BasicAuthConfigurationAdapter extends WebSecurityConfigurerAdapter { @Override protected void configure(HttpSecurity http) throws Exception { http.antMatcher("/basic/**").authorizeRequests().anyRequest().authenticated() .and().httpBasic(); } } ``` There is no security config for the /open path. Just a controller. There is also a controller for the /form path. Those are both something like this (just the path varies for now): ``` @Controller @RequestMapping("/open") public class OpenController extends BaseController { @RequestMapping({"", "/"}) public String home(HttpServletRequest req, Principal principal, Model model) { commonModelPopulate(req, principal, model); return "home"; // name of the template } } ``` If I go to this path /open (not protected) I see: ``` Hello Spring Boot User ANONYMOUS! ``` But if I go to this path /form (form login protected - after login) I see: ``` Hello Spring Boot User admin! isAuthenticated isFullyAuthenticated ``` So I think there might be multiple issues here. The first is that the thymeleaf sec:authorize attributes are not doing anything and the second is that it seems like I can only access the Principal and other security info if I am under a protected path. Is there a way to protect just one path (and sub paths) but allow the Principal and security data to be accessed everywhere else in my app?

Original source