Spring Security 6 multiple login mechanisms

Question

Prior to updating from Spring Security 5.3.24 I was able to dynamically configure multiple login solutions on an HttpSecurity such as saml2Login, and two formLogin with differing loginProcessingUrl configurations e.g.

(httpSecurity
                                       .authorizeRequests()
                                   .antMatchers("/index.html","/static/**").permitAll()
                                       .anyRequest().authenticated()
                                       .and()
                                       .exceptionHandling()
                                       .defaultAuthenticationEntryPointFor(
                                          loginUrlauthenticationEntryPoint(),
                                          new AntPathRequestMatcher("/**"))
                                       .and());

followed by

 .saml2Login(saml2 -> saml2
                            .relyingPartyRegistrationRepository(relyingPartyRegistrationRepository)
                            .successHandler(authenticationSuccessHandler));

and

 .formLogin(form -> form
                           .loginPage("/index.html")
                           .loginProcessingUrl("/app/internal/login" + "/**").permitAll()
                           .successHandler(authenticationSuccessHandler)
                           .failureHandler(new AuthenticationFailureHandler() {

And this all worked providing urls for all the login methods. Updating Spring Security 6 (6.1.3) this no longer works. Has this functionality been removed or is there some other way of configuring multiple ways to login with separate url's for handling them all?

Answer 1

I think the problems that you met in is deprecated methods and to be sure here are the problem i recommend you to rewrite the securityFilterChain something like this:

@Bean
  public SecurityFilterChain securityFilterChain(HttpSecurity httpSecurity) throws Exception {
    httpSecurity
        .authorizeHttpRequests(request -> {
          request.requestMatchers("/index.html","/static/**").permitAll()
              .anyRequest().authenticated();
        });

    httpSecurity.exceptionHandling(exceptionH -> {
          exceptionH.defaultAuthenticationEntryPointFor(
              loginUrlauthenticationEntryPoint(),
              new AntPathRequestMatcher("/**"));
        });
    httpSecurity.saml2Login(saml2 -> saml2
        .relyingPartyRegistrationRepository(relyingPartyRegistrationRepository)
        .successHandler(authenticationSuccessHandler));
    httpSecurity.formLogin(form -> form
        .loginPage("/index.html")
        .loginProcessingUrl("/app/internal/login/**").permitAll()
        .successHandler(authenticationSuccessHandler)
        .failureHandler(new AuthenticationFailureHandler()));

    return httpSecurity.build();
  }

If it also doesn't help you should create two instance of securityFilter @Bean a good example how to do it you can find here a most upvoted answer of this question

Also you have to check Migration Guide