To provide a custom authentication provider in spring boot, do I need both of the following? and what is their difference?
HttpSecurity.authenticationProvider(...)
@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter{
@Autowired
private MyAuthenticationProvider myAuthenticationProvider;
@Autowired
@Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
auth.authenticationProvider(myAuthenticationProvider);
}
// --------------- OR/AND ? ----------------
@Override
protected void configure(HttpSecurity http) throws Exception {
http
.authenticationProvider(myAuthenticationProvider)
// ...
}
}
You only need to use one of the two options. Internally, http.authenticationProvider is just making a call to AuthenticationManagerBuilder.authenticationProvider.