generator-jhipster: Security: can't secure API

Overview of the issue

Currently, in master branch, we can’t secure an API with:

@Secured(AuthoritiesConstants.ADMIN)

I will complete this ticket later, if needed

Motivation for or Use Case

Reproduce the error

create an entity
secure all API, using @Secured(AuthoritiesConstants.ADMIN)
connect with user/user
you can access to the entity

Related issues

Suggest a Fix

JHipster Version(s)

JHipster configuration

Entity configuration(s) `entityName.json` files generated in the `.jhipster` directory

Browsers and Operating System

Checking this box is mandatory (this is just to show you read everything)

About this issue

Original URL
State: closed
Created 6 years ago
Reactions: 2
Comments: 16 (16 by maintainers)

Commits related to this issue

Add security methods checks Related to https://github.com/jhipster/generator-jhipster/issues/7374 Same commit: https://github.com/jhipster/generator-jhipster/commit/aa423add31a3f4c80d557993f58de60180... — committed to pascalgrimaud/jhipster-registry by pascalgrimaud 6 years ago

Most upvoted comments

Of course @cbornet has the best answer: https://github.com/jhipster/generator-jhipster/issues/7806#issuecomment-398165015

jdubois on Aug 29, 2018

I found a fix for this problem. The AuthenticationManager bean is injected into UserJWTController bean. With JHipster 4, this “AuthenticationManager” is configured using the @PostContruct annotation. I think that it’s not a good idea to create directly the AuthenticationManager. I prefer to delegate this instantiation using a AuthenticationManagerBean, the bean is created by Spring Security. See the documentation for more details. https://github.com/spring-projects/spring-boot/wiki/Spring-Boot-2.0-Migration-Guide#authenticationmanager-bean

@Override
@Bean
public AuthenticationManager authenticationManagerBean() throws Exception {
        return super.authenticationManagerBean();
}

juliensadaoui on Mar 30, 2018

I’ve found the cause, this is crashing because of:

    @Bean
    @Override
    public AuthenticationManager authenticationManager() {

In the SecurityConfiguration Bean. This was working with JHipster 4, however.

jdubois on Mar 30, 2018