Multiple Entry Points in Spring Security – 春季安全中的多个入口点

最后修改: 2017年 3月 14日

1. Overview


In this quick tutorial, we’re going to take a look at how to define multiple entry points in a Spring Security application.

在这个快速教程中,我们将看看如何在Spring Security应用程序中定义多个入口点

This mainly entails defining multiple http blocks in an XML configuration file or multiple HttpSecurity instances by creating the SecurityFilterChain bean multiple times.


2. Maven Dependencies


For development, we will need the following dependencies:



The latest versions of spring-boot-starter-security, spring-boot-starter-webspring-boot-starter-thymeleaf, spring-boot-starter-test, spring-security-test can be downloaded from Maven Central.


3. Multiple Entry Points


3.1. Multiple Entry Points With Multiple HTTP Elements


Let’s define the main configuration class that will hold a user source:


public class MultipleEntryPointsSecurityConfig {

    public UserDetailsService userDetailsService() throws Exception {
        InMemoryUserDetailsManager manager = new InMemoryUserDetailsManager();
        return manager;
    public PasswordEncoder encoder() {
        return new BCryptPasswordEncoder();

Now, let’s look at how we can define multiple entry points in our security config.


We’re going to use an example driven by Basic Authentication here, and we’re going to make good use of the fact that Spring Security supports the definition of multiple HTTP elements in our configurations.

我们将在这里使用一个由Basic Authentication驱动的例子,我们将很好地利用Spring Security支持在我们的配置中定义多个HTTP元素这一事实。

When using Java configuration, the way to define multiple security realms is to have multiple @Configuration classes – each with its own security configuration. These classes can be static and placed inside the main config.


The main motivation for having multiple entry points in one application is if there are different types of users that can access different portions of the application.


Let’s define a configuration with three entry points, each with different permissions and authentication modes:


  • one for administrative users using HTTP Basic Authentication
  • one for regular users that use form authentication
  • and one for guest users that do not require authentication

The entry point defined for administrative users secures URLs of the form /admin/** to only allow users with a role of ADMIN and requires HTTP Basic Authentication with an entry point of type BasicAuthenticationEntryPoint that is set using the authenticationEntryPoint() method:


public static class App1ConfigurationAdapter {

    public SecurityFilterChain filterChainApp1(HttpSecurity http) throws Exception {

    public AuthenticationEntryPoint authenticationEntryPoint(){
        BasicAuthenticationEntryPoint entryPoint = 
          new BasicAuthenticationEntryPoint();
        entryPoint.setRealmName("admin realm");
        return entryPoint;

The @Order annotation on each static class indicates the order in which the configurations will be considered to find one that matches the requested URL. The order value for each class must be unique.

每个静态类上的 @Order注解指出了考虑配置的顺序,以找到一个与请求的URL相匹配的配置。每个类的order值必须是唯一的。

The bean of type BasicAuthenticationEntryPoint requires the property realName be set.


3.2. Multiple Entry Points, Same HTTP Element


Next, let’s define the configuration for URLs of the form /user/** that can be accessed by regular users with a USER role using form authentication:


public static class App2ConfigurationAdapter {

    public SecurityFilterChain filterChainApp2(HttpSecurity http) throws Exception {
            // formLogin configuration
              new AntPathRequestMatcher("/user/private/**"))
              new AntPathRequestMatcher("/user/general/**"));

As we can see, another way of defining entry points, besides the authenticationEntryPoint() method, is to use the defaultAuthenticationEntryPointFor() method. This can define multiple entry points that match different conditions based on a RequestMatcher object.


The RequestMatcher interface has implementations based on different types of conditions, such as matching path, media type or regexp. In our example, we have used the AntPathRequestMatch to set two different entry points for URLs of the forms /user/private/** and /user/general/**.


Next, we need to define the entry points beans in the same static configuration class:


public AuthenticationEntryPoint loginUrlauthenticationEntryPoint(){
    return new LoginUrlAuthenticationEntryPoint("/userLogin");
public AuthenticationEntryPoint loginUrlauthenticationEntryPointWithWarning(){
    return new LoginUrlAuthenticationEntryPoint("/userLoginWithWarning");

The main point here is how to set up these multiple entry points – not necessarily the implementation details of each one.


In this case, the entry points are both of type LoginUrlAuthenticationEntryPoint, and use different login page URL: /userLogin for a simple login page and /userLoginWithWarning for a login page that also displays a warning when attempting to access the /user/ private URLs.


This configuration will also require defining the /userLogin and /userLoginWithWarning MVC mappings and two pages with a standard login form.

这个配置还需要定义/userLogin/userLoginWithWarning MVC映射和两个带有标准登录表单的页面。

For the form authentication, it’s very important to remember that any URL necessary for the configuration, such as the login processing URL also needs to follow the /user/** format or be otherwise configured to be accessible.


Both of the above configurations will redirect to a /403 URL if a user without the appropriate role attempts to access a protected URL.

如果一个没有相应角色的用户试图访问受保护的URL,上述两种配置都会重定向到/403 URL。

Be careful to use unique names for the beans even if they are in different static classes, otherwise one will override the other.


3.3. New HTTP Element, No Entry Point


Finally, let’s define the third configuration for URLs of the form /guest/** that will allow all types of users, including unauthenticated ones:


public static class App3ConfigurationAdapter {

    public SecurityFilterChain filterChainApp3(HttpSecurity http) throws Exception {

3.4. XML Configuration


Let’s take a look at the equivalent XML configuration for the three HttpSecurity instances in the previous section.


As expected, this will contain three separate XML <http> blocks.


For the /admin/** URLs the XML configuration will use the entry-point-ref attribute of http-basic element:


<security:http pattern="/admin/**" use-expressions="true" auto-config="true">
    <security:intercept-url pattern="/**" access="hasRole('ROLE_ADMIN')"/>
    <security:http-basic entry-point-ref="authenticationEntryPoint" />

<bean id="authenticationEntryPoint"
     <property name="realmName" value="admin realm" />

Of note here is that if using XML configuration, the roles have to be of the form ROLE_<ROLE_NAME>.


The configuration for the /user/** URLs will have to be broken up into two http blocks in xml because there is no direct equivalent to the defaultAuthenticationEntryPointFor() method.

/user/** URL的配置将不得不在xml中分成两个http块,因为没有直接对应的defaultAuthenticationEntryPointFor()方法。

The configuration for URLs /user/general/** is:


<security:http pattern="/user/general/**" use-expressions="true" auto-config="true"
    <security:intercept-url pattern="/**" access="hasRole('ROLE_USER')" />
    //form-login configuration      

<bean id="loginUrlAuthenticationEntryPoint"
  <constructor-arg name="loginFormUrl" value="/userLogin" />

For the /user/private/** URLs we can define a similar configuration:

对于/user/private/** URLs,我们可以定义一个类似的配置。

<security:http pattern="/user/private/**" use-expressions="true" auto-config="true"
    <security:intercept-url pattern="/**" access="hasRole('ROLE_USER')"/>
    //form-login configuration

<bean id="loginUrlAuthenticationEntryPointWithWarning"
    <constructor-arg name="loginFormUrl" value="/userLoginWithWarning" />

For the /guest/** URLs we will have the http element:

对于/guest/** URLs,我们将使用http元素。

<security:http pattern="/**" use-expressions="true" auto-config="true">
    <security:intercept-url pattern="/guest/**" access="permitAll()"/>  

Also important here is that at least one XML <http> block must match the /** pattern.

这里同样重要的是,至少有一个XML <http>块必须符合/**模式。

4. Accessing Protected URLs


4.1. MVC Configuration


Let’s create request mappings that match the URL patterns we have secured:


public class PagesController {

    public String getAdminPage() {
        return "multipleHttpElems/myAdminPage";

    public String getUserPage() {
        return "multipleHttpElems/myUserPage";

    public String getPrivateUserPage() {
        return "multipleHttpElems/myPrivateUserPage"; 

    public String getGuestPage() {
        return "multipleHttpElems/myGuestPage";

    public String getMultipleHttpLinksPage() {
        return "multipleHttpElems/multipleHttpLinks";

The /multipleHttpLinks mapping will return a simple HTML page with links to the protected URLs:


<a th:href="@{/admin/myAdminPage}">Admin page</a>
<a th:href="@{/user/general/myUserPage}">User page</a>
<a th:href="@{/user/private/myPrivateUserPage}">Private user page</a>
<a th:href="@{/guest/myGuestPage}">Guest page</a>

Each of the HTML pages corresponding to the protected URLs will have a simple text and a backlink:


Welcome admin!

<a th:href="@{/multipleHttpLinks}" >Back to links</a>

4.2. Initializing the Application


We will run our example as a Spring Boot application, so let’s define a class with the main method:

我们将以Spring Boot应用程序的形式运行我们的例子,所以让我们定义一个带有main方法的类。

public class MultipleEntryPointsApplication {
    public static void main(String[] args) {, args);

If we want to use the XML configuration, we also need to add the @ImportResource({“classpath*:spring-security-multiple-entry.xml”}) annotation to our main class.


4.3. Testing the Security Configuration


Let’s set up a JUnit test class that we can use to test our protected URLs:


@SpringBootTest(classes = MultipleEntryPointsApplication.class)
public class MultipleEntryPointsTest {
    private WebApplicationContext wac;

    private FilterChainProxy springSecurityFilterChain;

    private MockMvc mockMvc;

    public void setup() {
        this.mockMvc = MockMvcBuilders.webAppContextSetup(this.wac)

Next, let’s test the URLs using the admin user.


When requesting the /admin/adminPage URL without an HTTP Basic Authentication, we should expect to receive an Unauthorized status code, and after adding the authentication the status code should be 200 OK.

当请求/admin/adminPage URL而没有HTTP基本认证时,我们应该期待收到一个未经授权的状态代码,而在添加认证后,状态代码应该是200 OK。

If attempting to access the /user/userPage URL with the admin user, we should receive status 302 Forbidden:

如果试图用管理员用户访问/user/userPage URL,我们应该收到状态302 Forbidden。

public void whenTestAdminCredentials_thenOk() throws Exception {

      .with(httpBasic("admin", "adminPass"))).andExpect(status().isOk());


Let’s create a similar test using the regular user credentials to access the URLs:


public void whenTestUserCredentials_thenOk() throws Exception {



In the second test, we can see that missing the form authentication will result in a status of 302 Found instead of Unauthorized, as Spring Security will redirect to the login form.

在第二个测试中,我们可以看到,缺少表单认证将导致302 Found的状态,而不是Unauthorized,因为Spring Security将重定向到登录表单。

Finally, let’s create a test in which we access the /guest/guestPage URL will all three types of authentication and verify we receive a status of 200 OK:

最后,让我们创建一个测试,其中我们访问/guest/guestPage URL将所有三种类型的认证,并验证我们收到200 OK的状态。

public void givenAnyUser_whenGetGuestPage_thenOk() throws Exception {


      .with(httpBasic("admin", "adminPass")))

5. Conclusion


In this tutorial, we have demonstrated how to configure multiple entry points when using Spring Security.

在本教程中,我们已经演示了在使用Spring Security时如何配置多个入口点。

The complete source code for the examples can be found over on GitHub. To run the application, uncomment the MultipleEntryPointsApplication start-class tag in the pom.xml and run the command mvn spring-boot:run, then accesses the /multipleHttpLinks URL.

示例的完整源代码可以在GitHub上找到over。要运行该应用程序,请取消注释MultipleEntryPointsApplication start-class标签,并运行mvn spring-boot:run命令,然后访问/multipleHttpLinksURL

Note that it is not possible to log out when using HTTP Basic Authentication, so you will have to close and reopen the browser to remove this authentication.


To run the JUnit test, use the defined Maven profile entryPoints with the following command:


mvn clean install -PentryPoints

mvn clean install -PentryPoints