Ajax 인증시 AuthenticationManager 등록 문의

Spring Authorization 1.0 을 사용하여 FormLogin 이 아닌 Ajax로 로그인을 하려고 합니다.

Spring Security 강의를 참조하여

AbstractAuthenticationProcessingFilter를 상속하여 CustomUserDetailsService, CustomAuthenticationProvider, CustomAuthenticationProcessingFilter, CustomAuthenticationToken 구현체를 만들었습니다.

CustomAuthenticationProcessingFilter는 AbstractAuthenticationProcessingFilter 상속하여 개발하였는데 Filter를 등록 하려면 강의에서 내용처럼 AuthenticationManager를 등록 해줘여 하는데 강의는 WebSecurityConfigurerAdapter 상속하여 설정 하는것으로 설명되어 있는데 Spring Securitty 6.0 에서는 삭제되었습니다.

Spring Security 의 강의를 보면

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.authenticationProvider(ajaxAuthenticationProvider());
    }

configure(AuthenticationManagerBuilder auth)를 구현하고

   @Bean
    public AjaxLoginProcessingFilter ajaxLoginProcessingFilter() throws Exception {
        AjaxLoginProcessingFilter filter = new AjaxLoginProcessingFilter();
        filter.setAuthenticationManager(authenticationManagerBean());
        return filter;
    }

질문)AjaxLoginProcessingFilter Bean 에서 설정하는데 SecurityFilterChain 를 등록하는 방식에서는 어떻게 등록해야 할지 문의 합니다.

제가 구현한 소스 일부

• Authorization Server 설정을 다른 클래스에서 설정하였고 디버깅을 해보니 Authorization Server 용 FilterChain 과 로그인 처리용 FilterChain 이 따로 등록되어 로그인 프로세스는 Spring Security FilterChain Class 에서 진행하였습니다

• @Configuration는 Spring Security 6에서는 @EnableWebSecurity에 포함되지 않아 추가 하였습니다.

@EnableWebSecurity
@RequiredArgsConstructor
@Configuration
public class DefaultSecurityConfig {
    private final PasswordEncoder passwordEncoder;
    private final CustomAuthenticationProvider customAuthenticationProvider;
//
    @Bean
    public CustomAuthenticationProcessingFilter customAuthenticationProcessingFilter() throws Exception {
        CustomAuthenticationProcessingFilter filter = new CustomAuthenticationProcessingFilter();
        return filter;
    }

    // @formatter:off
    @Bean
    SecurityFilterChain defaultSecurityFilterChain(HttpSecurity http) throws Exception {
        http
            .authorizeHttpRequests(authorizeRequests ->authorizeRequests
                .requestMatchers(CorsUtils::isPreFlightRequest).permitAll()
                .requestMatchers("/login/**").permitAll()
                .requestMatchers("/api/registered-client/**").permitAll()
                .anyRequest().authenticated()
            )
            .csrf(csrf -> csrf
                .ignoringRequestMatchers(new AntPathRequestMatcher("/api/registered-client/**"))
            )
            .formLogin().disable();

        http.authenticationProvider(customAuthenticationProvider);
        http.addFilterBefore(customAuthenticationProcessingFilter(), UsernamePasswordAuthenticationFilter.class);
        return http.build();
    }
    // @formatter:on
}

AuthenticationManager를 등록하지 않아 예와가 발생함

Caused by: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'customAuthenticationProcessingFilter' defined in class path resource [com/naon/oidc/security/config/DefaultSecurityConfig.class]: authenticationManager must be specified

그리고 @Bean으로 만들어 등록하면 순환참조가 됩니다. 

@Bean
public AuthenticationManager authenticationManager(AuthenticationConfiguration authenticationConfiguration) throws Exception {
    return authenticationConfiguration.getAuthenticationManager();
}

    @Bean
    public CustomAuthenticationProcessingFilter customAuthenticationProcessingFilter() throws Exception {
        CustomAuthenticationProcessingFilter filter = new CustomAuthenticationProcessingFilter();
//         filter.setAuthenticationManager(authenticationManager(null));
        filter.setAuthenticationManager(new ProviderManager(customAuthenticationProvider));
        return filter;
    }

@EnableWebSecurity
@RequiredArgsConstructor
@Configuration
public class DefaultSecurityConfig {
    private final CustomAuthenticationProvider customAuthenticationProvider;
    private final CustomUserDetailsService customUserDetailsService;

    private final AuthenticationConfiguration authenticationConfiguration;


    @Bean
    public AuthenticationManager authenticationManager(AuthenticationConfiguration authenticationConfiguration) throws Exception {
        return authenticationConfiguration.getAuthenticationManager();
    }
    @Bean
    public CustomAuthenticationProcessingFilter customAuthenticationProcessingFilter() throws Exception{
        CustomAuthenticationProcessingFilter filter = new CustomAuthenticationProcessingFilter();
         filter.setAuthenticationManager(authenticationManager(authenticationConfiguration));
//        filter.setAuthenticationSuccessHandler(customAuthenticationSuccessHandler());
//        filter.setAuthenticationFailureHandler(customAuthenticationFailureHandler());

        return filter;
    }
    .............
}