I have configured my authorization for pages using method from WebSecurityConfigAdapter:
@Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
super.configure(auth);
auth.userDetailsService(userDetailsService()).passwordEncoder(passwordEncoder());
}
@Override
protected void configure(HttpSecurity http) throws Exception {
//super.configure(http);
http.servletApi().rolePrefix("");
http
.logout()
.logoutRequestMatcher(new AntPathRequestMatcher("/logout"));
http.csrf().disable();
http.authorizeRequests().antMatchers("/patient/mobile.mvc").hasRole("USER_PATIENT").and().formLogin();
http.authorizeRequests().antMatchers("/registration/**").hasRole("USER_RECEPTIONIST").and().formLogin();
http.authorizeRequests().antMatchers("/doctor/**").hasRole("USER_DOCTOR").and().formLogin();
}
in my userDetailsService I have the following methods, to give user his credentials:
public UserDetails loadUserByUsername(String userEmail) throws UsernameNotFoundException {
// 1: Check if exist receptionist with given name
Receptionist receptionist = loginService.getReceptionistByEmail(userEmail);
if (receptionist != null) {
return createReceptionistUserDetail(receptionist);
}
...
}
private UserDetails createReceptionistUserDetail(Receptionist receptionist) {
List<GrantedAuthority> grantedAuthorities = new ArrayList<>();
grantedAuthorities.add(new SimpleGrantedAuthority("USER_RECEPTIONIST"));
UserDetails ud = new User(receptionist.getEmail(), receptionist.getPasswordHash(), grantedAuthorities);
return ud;
}
I have no problem with normal authentication and access when no roles are checked, but when I have added a access based on roles, any user can't access his webpages.
What could here be wrong implemented?