Spring Security architecture — Filter chain, AuthenticationManager, SecurityContext

Tomcat
└── DelegatingFilterProxy (registered as servlet filter)
  └── FilterChainProxy (Spring bean — looks up by URL)
      └── SecurityFilterChain (Spring bean — your config)
          └── 15 filters (CSRF, auth, authorization, ...)

# Show registered filters
GET /actuator/mappings
# DelegatingFilterProxy registered for "/*"

# Show security filter chain
GET /actuator/security
# (need Spring Security Actuator)

@Bean
@Order(1)
public SecurityFilterChain adminChain(HttpSecurity http) {
  http.securityMatcher("/api/admin/**")
      .authorizeHttpRequests(...)
      ...;
  return http.build();
}

@Bean
@Order(2)
public SecurityFilterChain publicChain(HttpSecurity http) {
  http.securityMatcher("/api/public/**")
      .authorizeHttpRequests(auth -> auth.anyRequest().permitAll())
      ...;
  return http.build();
}

// 1. Filter receive request
String username = request.getParameter("username");
String password = request.getParameter("password");

// 2. Build Authentication trước auth
Authentication unauthenticated = new UsernamePasswordAuthenticationToken(username, password);
// unauthenticated.isAuthenticated() = false
// unauthenticated.getCredentials() = "raw_password"
// unauthenticated.getAuthorities() = []

// 3. Pass to AuthenticationManager
Authentication authenticated = authManager.authenticate(unauthenticated);

// 4. Provider validate → return new Authentication
// authenticated.isAuthenticated() = true
// authenticated.getCredentials() = null (CLEARED)
// authenticated.getAuthorities() = [ROLE_USER, ROLE_ADMIN]
// authenticated.getPrincipal() = UserDetails object

// 5. Store in context
SecurityContextHolder.getContext().setAuthentication(authenticated);

@Bean
public AuthenticationManager authManager(...) {
  ProviderManager pm = new ProviderManager(...);
  pm.setEraseCredentialsAfterAuthentication(true);   // default true
  return pm;
}

// User has authority "ROLE_ADMIN"
hasRole("ADMIN")               → TRUE  (auto-prefix → check "ROLE_ADMIN")
hasAuthority("ROLE_ADMIN")     → TRUE  (exact match)
hasAuthority("ADMIN")          → FALSE (looking for "ADMIN", user has "ROLE_ADMIN")

// User has authority "ADMIN" (no prefix)
hasRole("ADMIN")               → FALSE (looking for "ROLE_ADMIN", user has "ADMIN")
hasAuthority("ROLE_ADMIN")     → FALSE
hasAuthority("ADMIN")          → TRUE  (exact match)

Roles: ROLE_USER, ROLE_ADMIN, ROLE_MANAGER

@PreAuthorize("hasRole('ADMIN')")
@PreAuthorize("hasAnyRole('USER', 'MANAGER')")

http.authorizeHttpRequests(auth -> auth
  .requestMatchers("/admin/**").hasRole("ADMIN")
);

Authorities: orders:read, orders:write, orders:delete, projects:read, ...

@PreAuthorize("hasAuthority('orders:write')")
@PreAuthorize("hasAnyAuthority('orders:read', 'projects:read')")

http.authorizeHttpRequests(auth -> auth
  .requestMatchers(HttpMethod.GET, "/orders/**").hasAuthority("orders:read")
  .requestMatchers(HttpMethod.POST, "/orders/**").hasAuthority("orders:write")
);

User → Roles → Permissions

User Alice has roles: [USER, MANAGER]
Role USER has permissions: [orders:read, projects:read]
Role MANAGER has permissions: [orders:write, projects:write, users:read]

Granted authorities expanded: [
ROLE_USER, ROLE_MANAGER,                       // roles
orders:read, orders:write, projects:read, projects:write, users:read    // permissions
]

@PreAuthorize("hasRole('MANAGER')")              // role-based check
@PreAuthorize("hasAuthority('orders:write')")    // permission-based check

Add dependency: spring-boot-starter-security
Run: mvn spring-boot:run

Console output:
"Using generated security password: 8a7b6c5d-..."

Workflow:
1. Browser GET /api/projects → 401
2. Redirect to /login form
3. Username: "user", Password: "8a7b6c5d-..."
4. Login → access granted

@Configuration
@EnableWebSecurity
public class SecurityConfig {

  @Bean
  public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
      http
          .csrf(csrf -> csrf.disable())                    // REST API — disable CSRF
          .sessionManagement(s -> s.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
          .authorizeHttpRequests(auth -> auth
              .requestMatchers("/api/auth/**").permitAll()
              .requestMatchers("/actuator/health").permitAll()
              .requestMatchers("/api/admin/**").hasRole("ADMIN")
              .anyRequest().authenticated()
          )
          .oauth2ResourceServer(oauth2 -> oauth2.jwt(...))    // JWT auth
          .exceptionHandling(eh -> eh
              .authenticationEntryPoint(new BearerTokenAuthenticationEntryPoint())
              .accessDeniedHandler(new BearerTokenAccessDeniedHandler())
          );

      return http.build();
  }

  @Bean
  public PasswordEncoder passwordEncoder() {
      return new BCryptPasswordEncoder(12);    // strength 12
  }

  @Bean
  public UserDetailsService userDetailsService(UserRepository userRepo) {
      return username -> userRepo.findByEmail(username)
          .map(AppUserDetails::new)
          .orElseThrow(() -> new UsernameNotFoundException(username));
  }
}

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

  @Override
  protected void configure(HttpSecurity http) throws Exception {
      http.authorizeRequests()
          .antMatchers("/admin/**").hasRole("ADMIN")
          .antMatchers("/public/**").permitAll()
          .anyRequest().authenticated()
          .and()
          .formLogin()
          .and()
          .csrf().disable();
  }

  @Override
  protected void configure(AuthenticationManagerBuilder auth) throws Exception {
      auth.userDetailsService(userDetailsService)
          .passwordEncoder(passwordEncoder());
  }

  @Bean
  @Override
  public AuthenticationManager authenticationManagerBean() throws Exception {
      return super.authenticationManagerBean();
  }
}

@Configuration
@EnableWebSecurity
public class SecurityConfig {

  @Bean
  public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
      http
          .authorizeHttpRequests(auth -> auth                  // (1) Renamed
              .requestMatchers("/admin/**").hasRole("ADMIN")    // (2) Renamed antMatchers
              .requestMatchers("/public/**").permitAll()
              .anyRequest().authenticated()
          )
          .formLogin(Customizer.withDefaults())                 // (3) Lambda DSL mandatory
          .csrf(csrf -> csrf.disable());

      return http.build();                                       // (4) Build SecurityFilterChain bean
  }

  @Bean
  public AuthenticationManager authManager(
      UserDetailsService uds,
      PasswordEncoder encoder
  ) {
      DaoAuthenticationProvider provider = new DaoAuthenticationProvider();
      provider.setUserDetailsService(uds);
      provider.setPasswordEncoder(encoder);
      return new ProviderManager(provider);
  }
}

# Auto-migration tool
mvn org.openrewrite.maven:rewrite-maven-plugin:run \
  -Drewrite.activeRecipes=org.openrewrite.java.spring.security6.UpgradeSpringSecurity_6_0