SecurityConfiguration.java

@Configuration
public class SecurityConfiguration extends WebSecurityConfigurerAdapter {

	private static final Logger LOGGER = LoggerFactory.getLogger(SecurityConfiguration.class);
	
	@Autowired
	private WebAuthenticationProvider authenticationProvider;	
	
	@Autowired
	private LoginAuthenticationSuccessHandler loginAuthenticationSuccessHandler;
	@Autowired
	private LoginAuthenticationFailureHandler loginAuthenticationFailureHandler;
	
	@Override
	public void configure(WebSecurity web) throws Exception {
		web.ignoring().antMatchers( "/auth**", "/logout", "/login", "/signup", 
				"/css/**", "/js/**", "/img/**", "/healthcheck", "/healthcheck/**");
	}
	
	@Override
	protected void configure(final HttpSecurity http) throws Exception {
		LOGGER.info("CONFIGURE WEB SECURITY");
		http
			.authorizeRequests()
				.antMatchers( "/admin**" )
				.hasAnyRole( "ADMIN" )
				.and()
			.authorizeRequests()
				.antMatchers(HttpMethod.OPTIONS)
				.permitAll()
				.and()
			.authorizeRequests()
				.anyRequest()
				.hasAnyRole("USER")
				.and()
			.formLogin()
				.loginPage( "/login" )
					.permitAll()
				.loginProcessingUrl( "/login.action" )
					.usernameParameter( "username" )
					.passwordParameter( "password" )
					.successHandler( loginAuthenticationSuccessHandler )
					.failureHandler( loginAuthenticationFailureHandler )
				.and()
			.logout()
				.permitAll()
				.logoutRequestMatcher(new AntPathRequestMatcher("/logout"))
				.logoutSuccessUrl( "/login" )
				.and()
			.exceptionHandling()
				.accessDeniedPage( "/erro?code=999" )
				.and()
			.csrf()
				.disable();

	}

	/**
	 * Register application's authentication provider
	 * @param auth
	 * @throws Exception
	 */
	@Autowired
	public void configureGlobal(final AuthenticationManagerBuilder auth) throws Exception {
		auth.authenticationProvider(authenticationProvider);
	}
	
	@Configuration
	@Order(1)
	public static class RestSecurityConfiguration extends WebSecurityConfigurerAdapter  {

		private static final Logger LOGGER2 = LoggerFactory.getLogger(RestSecurityConfiguration.class);
		
		@Override
		protected void configure(final HttpSecurity http) throws Exception {
			LOGGER2.info("CONFIGURE REST SECURITY");
			http
		    	.antMatcher("/api/**")
				.authorizeRequests()
			    	.antMatchers(HttpMethod.OPTIONS)
			    		.permitAll()
			    	.antMatchers("/api/**")
						.authenticated()
					.and()
				.httpBasic()
					.and()
		    	.csrf()
		    		.disable();
		}
	}
	
}