Warum bekomme ich 403 auf Spring Boot Security Basic Authentication?

Question

Ich habe das Tutorial http://www.concretepage.com/spring-boot/spring-boot-security-rest-jpa-hibernate-mysql-crud-example

Hinweis gefolgt: Working on Spring-boot, Spring Data JPA, Security and basic authentication

Mein Code ist unten

UserDetailsService.java

@Override 
public UserDetails loadUserByUsername(String userName) throws UsernameNotFoundException { 
    System.out.println("UserName: " + userName); 
    User activeUserInfo = userRepository.findByUserName(userName); 

    System.out.println("Role D : " + activeUserInfo.getUserRole().getName()); //This prints 'ADMIN' as expected 
    GrantedAuthority authority = new SimpleGrantedAuthority(activeUserInfo.getUserRole().getName()); 
    System.out.println("User : " + activeUserInfo.getUserName()); //This prints my username 'test123' as expected 
    System.out.println("PWD : " + activeUserInfo.getPassword()); //This prints '$2a$10$PN/MwjCHtCWsI4auW6Q8AOxb4dug4WSO8tfINySqHZ8eYVjFKIAW6' as expected 

    System.out.println("Authority : " + authority); 
    UserDetails userDetails = (UserDetails) new org.springframework.security.core.userdetails.User(activeUserInfo.getUserName(), activeUserInfo.getPassword(), 
      Arrays.asList(authority)); 
    return userDetails; 
} 

Sysout druckt die korrekten Werte aus DB.

SecurityConfiguration.java

@Autowired 
public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception { 
      BCryptPasswordEncoder passwordEncoder = new BCryptPasswordEncoder(); 
      auth.userDetailsService(userDetailsService).passwordEncoder(passwordEncoder); 
} 


@Override 
protected void configure(HttpSecurity http) throws Exception { 

    http.csrf().disable().authorizeRequests().antMatchers("/server/rest/secure/**").hasAnyRole("ADMIN", "Non Admin").and() 
      .httpBasic().realmName(REALM).authenticationEntryPoint(new CustomBasicAuthenticationEntryPoint()); 
} 

CustomBasicAuthenticationEntryPoint .JAVA

public class CustomBasicAuthenticationEntryPoint extends BasicAuthenticationEntryPoint { 

@Override 
public void commence(final HttpServletRequest request, 
     final HttpServletResponse response, 
     final AuthenticationException authException) throws IOException, ServletException { 

    response.setStatus(HttpServletResponse.SC_UNAUTHORIZED); 
    response.addHeader("WWW-Authenticate", "Basic realm=" + getRealmName() + ""); 

    PrintWriter writer = response.getWriter(); 
    writer.println("HTTP Status 401 : " + authException.getMessage()); 
    response.setHeader("WWW-Authenticate", "FormBased"); 
    response.sendError(HttpServletResponse.SC_UNAUTHORIZED, "Unauthorized"); 
} 

@Override 
public void afterPropertiesSet() throws Exception { 
    setRealmName("MY_TEST_REALM"); 
    super.afterPropertiesSet(); 
} 

}

Aber bei der Anmeldung ich erhalte status":403,"error":"Forbidden","message":"Access is denied"

Hinweis: Früher habe ich Base64 zum Verschlüsseln/Entschlüsseln des Kennworts verwendet. Aber jetzt basierend auf diesem Beispiel auf BCrypt aktualisiert. Also für den Test Zweck habe ich BCrypt Passwort online generiert. Mein Pwd "testet" BCrypt pwd ist "$ 2a $ 10 $ PN/MwjCHtCWsI4auW6Q8AOxb4dug4WSO8tfINySqHZ8eYVjFKIAW6". Habe ich einen Fehler gemacht? Was ist falsch an meinem Code?

Answer 1

denke ich, dass Sie schließlich .permit() nicht Bitte versuchen Sie meinen Code in SecurityConfiguration.java:

protected void configure(HttpSecurity http) throws Exception { 
     http.csrf().disable().cors().disable().httpBasic().and().authorizeRequests() 
     .antMatchers(PUBLIC_MATCHERS).permitAll().anyRequest().authenticated(); 
    } 

@Autowired 
public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception { 
    auth.userDetailsService(userSecurityService).passwordEncoder(passwordEncoder()); 
} 

PS: PUBLIC_MATCHERS ist

private static final String[] PUBLIC_MATCHERS = { 
with your folders 
    };