Spring Security : Global and Local AuthenticationManager example

Global AuthenticationManager

To create an AuthenticationManager that is available to the entire application you can simply register the AuthenticationManager as a @Bean.

@Configuration

public class SecurityConfiguration {

    @Bean

    public EmbeddedLdapServerContextSourceFactoryBean contextSourceFactoryBean() {

        EmbeddedLdapServerContextSourceFactoryBean contextSourceFactoryBean =

            EmbeddedLdapServerContextSourceFactoryBean.fromEmbeddedLdapServer();

        contextSourceFactoryBean.setPort(0);

        return contextSourceFactoryBean;

    }

    @Bean

    AuthenticationManager ldapAuthenticationManager(

            BaseLdapPathContextSource contextSource) {

        LdapBindAuthenticationManagerFactory factory = 

            new LdapBindAuthenticationManagerFactory(contextSource);

        factory.setUserDnPatterns("uid={0},ou=people");

        factory.setUserDetailsContextMapper(new PersonContextMapper());

        return factory.createAuthenticationManager();

    }

}

Local AuthenticationManager

In Spring Security 5.6 we introduced the method HttpSecurity#authenticationManager that overrides the default AuthenticationManager for a specific SecurityFilterChain.

Below is an example configuration that sets a custom AuthenticationManager as the default:

@Configuration

public class SecurityConfiguration {

    @Bean

    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {

        http

            .authorizeHttpRequests((authz) -> authz

                .anyRequest().authenticated()

            )

            .httpBasic(withDefaults())

            .authenticationManager(new CustomAuthenticationManager());

    }

}