Styjun

I have been all over stack overflow trying to find out why this issue is happening, but cannot find an answer.

This is my setup:

SecurityConfig

@Autowired
 private IUserService userService;

 @Override
 public void configure(final AuthenticationManagerBuilder auth) throws Exception 
 auth.userDetailsService(userService).passwordEncoder(passwordEncoder());
 

 @Override
 protected void configure(final HttpSecurity http) throws Exception 
 // @formatter:off
 http.
 authorizeRequests().
 antMatchers("/api/**"). // if you want a more explicit mapping here
 //anyRequest().
// authenticated().antMatchers("/api/users/**").
 permitAll().

 and().
 httpBasic().
 and().
 sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS).
 and().csrf().disable(); 
 // @formatter:on
 

 @Bean
 public PasswordEncoder passwordEncoder()
 PasswordEncoder encoder = new BCryptPasswordEncoder();
 return encoder;
 

UserService create method:

@Override
 public User create(User u) 
 User newUser = new User();
 newUser.setUsername(u.getUsername());
 newUser.setEmail(u.getEmail());
 newUser.setPhoneNum(u.getPhoneNum());
 newUser.setPassword(passwordEncoder.encode(u.getPassword()));

 // Add default roles
 Role userRole = roleService.findByName("ROLE_USER");
 newUser.setRoles(Sets.<Role>newHashSet(userRole));
 dao.save(newUser);
 return newUser;
 

Note that User implements UserDetails and IUserService implements UserDetailsService.

Based on other articles here is some more information:

I'm not trying to do OAUTH so please don't recommend that i also encode the client secret

I checked my database, its a VARCHAR(68), so I believe there is enough room to store the encoded password.

The database does indeed store the encoded password (i looked and its not plain text)

Here is some DEBUG logs from a request that gets denied:

DEBUG o.s.s.w.a.w.BasicAuthenticationFilter - Basic Authentication Authorization header found for user 'wowz'
23:17:57.187 [http-nio-8082-exec-8] DEBUG o.s.s.authentication.ProviderManager - Authentication attempt using org.springframework.security.authentication.dao.DaoAuthenticationProvider
23:17:57.471 [http-nio-8082-exec-8] WARN o.s.s.c.bcrypt.BCryptPasswordEncoder - Encoded password does not look like BCrypt
23:17:57.472 [http-nio-8082-exec-8] DEBUG o.s.s.a.d.DaoAuthenticationProvider - Authentication failed: password does not match stored value
23:17:57.472 [http-nio-8082-exec-8] DEBUG o.s.s.w.a.w.BasicAuthenticationFilter - Authentication request for failed: org.springframework.security.authentication.BadCredentialsException: Bad credentials
23:17:57.472 [http-nio-8082-exec-8] DEBUG o.s.s.w.a.DelegatingAuthenticationEntryPoint - Trying to match using RequestHeaderRequestMatcher [expectedHeaderName=X-Requested-With, expectedHeaderValue=XMLHttpRequest]
23:17:57.473 [http-nio-8082-exec-8] DEBUG o.s.s.w.a.DelegatingAuthenticationEntryPoint - No match found. Using default entry point org.springframework.security.web.authentication.www.BasicAuthenticationEntryPoint@42da9490
23:17:57.473 [http-nio-8082-exec-8] DEBUG o.s.s.w.h.writers.HstsHeaderWriter - Not injecting HSTS header since it did not match the requestMatcher org.springframework.security.web.header.writers.HstsHeaderWriter$SecureRequestMatcher@115f4872
23:17:57.473 [http-nio-8082-exec-8] DEBUG o.s.s.w.c.SecurityContextPersistenceFilter - SecurityContextHolder now cleared, as request processing completed

Also note that this is security for a REST API, not a MVC application

The best way to identify this problem "Encoded password does not look like BCrypt" is setup a break porint in class org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder. And then check the root cause for the warnning.

if (!BCRYPT_PATTERN.matcher(encodedPassword).matches()) 
 logger.warn("Encoded password does not look like BCrypt");
 return false;