Spring Security: how to recognize, in a public page, that a user is authenticated

Question

I have a simple Spring Boot web application consisting of 2 pages:

• a Home Page (freely accessible) at the url https://example.com/
• a secured page (requires login for being accessed) at the url https://example.com/secure/page.html

In the Home Page I'm printing the First Name of the visiting user (if he/she is already authenticated) or a sentence saying that the page is visited by an anonymous user.

I'm using Keycloak as far as authentication is concerned.

Here the Spring Security configuration:

@Override
protected void configure(HttpSecurity http) throws Exception {
    http
    .authorizeRequests()
    .antMatchers("/secure/**")
    .authenticated()
    .and()
    .csrf().requireCsrfProtectionMatcher(keycloakCsrfRequestMatcher())
    .and()
    .sessionManagement()
    .sessionAuthenticationStrategy(sessionAuthenticationStrategy())
    .and()
    .addFilterBefore(keycloakPreAuthActionsFilter(), LogoutFilter.class)
    .addFilterBefore(keycloakAuthenticationProcessingFilter(), BasicAuthenticationFilter.class)
    .addFilterBefore(keycloakAuthenticatedActionsFilter(), BasicAuthenticationFilter.class)
    .addFilterAfter(keycloakSecurityContextRequestFilter(), SecurityContextHolderAwareRequestFilter.class)
    .exceptionHandling().authenticationEntryPoint(authenticationEntryPoint())
    .and()
    .logout()
    .addLogoutHandler(keycloakLogoutHandler())
    .logoutUrl("/sso/logout").permitAll()
    .logoutSuccessUrl("/");
}

If the user is already authenticated, the problem is that the Home Page says he is anonymous because the Principal is always null.

But if the user enters the secured page (and Keycloak lets him in because he's already authenticated) when he comes back to the Home, the page contains - correctly - his First Name.

Where is my configuration wrong?

It seems that Spring Security doesn't check the authentication on non secured pages. Is there a way to tell Spring Security to check every page (both secured and non-secured)?

Thanks in advance for your support.

Answer 1

The solution to this problem is to add /** to security context/handling (with permitAll()).

The art is to do it correctly:

• Multiple antMatchers in Spring security (First ant matcher wins!!, https://www.google.com/search?q=spring+security+permitall+not+working)
• http://blog.florian-hopf.de/2017/08/spring-security.html

So in this case:

 http
  .authorizeRequests()
  .antMatchers("/secure/**").authenticated()
  .antMatchers("/**").pernmitAll()
  .and()...

...should fill the (anonymous) Principal also in "permitted area" (i.e. /**(!) ...and leave secure/** restricted!;).

---

To the core/title question (once Principal is filled), i think the answer is already given:

• here (verbally): https://stackoverflow.com/a/26117007/592355
• and here(with code): https://stackoverflow.com/a/57054816/592355

..if you use Spring Security (JSP) Taglibs isAnonymous() is handy, and otherwise (in default) you just need to check for hasRole('ROLE_ANONYMOUS') (Ref)