java - Method Based Authorization at Spring Boot -

i have methods published rest services. want apply basic authorization security on 1 method lest "gpnfeedback". not want apply authorization on sendgpn how can configure securityconfig.java? have used following configration still having authorzation error when callling http://localhost:7071/gpns/rest/sendgpn

controller

@controller @requestmapping("/gpns/rest/") public class gpnsrestcontroller {     @crossorigin    @requestmapping(value = "/sendgpn", method = requestmethod.post, produces = mediatype.application_json_value, consumes = { mediatype.multipart_form_data_value, mediatype.application_json_value })    public @responsebody    gpnsresponse sendgpn(@valid @requestpart(value = "data", required = true) sendgpnmessagemsisdnlistreq sendgpnmessagemsisdnlistreq, @valid @modelattribute(value = "photo") multipartfile photo, @valid @modelattribute(value = "video") multipartfile video,          @valid @modelattribute(value = "videothumbnail") multipartfile videothumbnail) {     }     @requestmapping(method = requestmethod.post, value = "/gpnfeedback", consumes = mediatype.application_json_value, produces = mediatype.application_json_value)    public @responsebody    gpnsresponse gpnfeedback(httpservletrequest http, @valid @requestbody gpnfeedbackreq gpnfeedbackreq) {    }   } 

security

@configuration @enablewebsecurity(debug = true) @enableglobalmethodsecurity(securedenabled = true) public class securityconfig extends websecurityconfigureradapter {     public static final string role_client = "client_user";    @autowired   private databaseauthenticationprovider databaseauthenticationprovider;    @autowired   private gpnbasicauthenticationentrypoint basicauthenticationentrypoint;     @override    public void configure(websecurity web) throws exception {    web.ignoring().antmatchers("/soap/lb/**");    }    @override   protected void configure(httpsecurity http) throws exception {      http.csrf().disable();     http.httpbasic().authenticationentrypoint(this.basicauthenticationentrypoint);     http.sessionmanagement().sessioncreationpolicy(sessioncreationpolicy.stateless);       // @formatter:off     http.authorizerequests()       .antmatchers("/gpns/rest/gpnfeedback/**").hasrole(role_client)                  .anyrequest().authenticated().and().httpbasic();      // @formatter:on   }    @override   protected void configure(authenticationmanagerbuilder builder) throws exception {      //will invoked in given order      builder.authenticationprovider(this.databaseauthenticationprovider);    }  } 

update-1: have changed rules following one. althout can send http://localhost:7071/gpns/rest/sendgpn method without authorization, http://localhost:7071/gpns/rest/gpnfeedback not hanled databaseauthenticationprovider

http.authorizerequests()       .antmatchers("/gpns/rest/gpnfeedback/**").hasrole(role_client)         .antmatchers("/gpns/rest/sendgpn/**").permitall()                 .anyrequest().authenticated().and().httpbasic(); 

i think issue related line in configuration:

.anyrequest().authenticated().and().httpbasic(); 

basically, you're saying here every request (aside ignored on) has authenticated don't care roles has. try using 1 instead:

.anyrequest().permitall().and().httpbasic() 

alternatively, if wish permit sendgpn, use this:

http.authorizerequests()       .antmatchers("/gpns/rest/gpnfeedback/**").hasrole(role_client)         .antmatchers("/gpns/rest/sendgpn/**").permitall()                 .anyrequest().authenticated().and().httpbasic(); 

edit update, guess you've somehow misconfigured provided or have incorrect data in db. instance if role_client has value of "client" spring expect value in db "role_client" - adds "role_" prefix roles.