title: Spring Security Java Config for Siteminder
body: <p>I have an inMemoryAuthentication configuration that works:</p>
  
  <pre><code>@Configuration
  @EnableWebMvcSecurity
  public class WebSecurityConfiguration extends WebSecurityConfigurerAdapter {
      @Override
      protected void configure(
              AuthenticationManagerBuilder authenticationManagerBuilder)
              throws Exception {
  
          authenticationManagerBuilder //
              .inMemoryAuthentication() //
                  .withUser("employee") //
                      .password("employee") //
                      .roles("RoleEmployee")
          ;
  
      }
  
      @Override
      public void configure(WebSecurity webSecurity) throws Exception {
          webSecurity.ignoring().antMatchers("/resources/**");
      }
  
      @Override
      protected void configure(HttpSecurity httpSecurity) throws Exception {
          // @formatter:off
  
          httpSecurity
              .authorizeRequests()
                  .antMatchers("/login","/login.request","/logout").permitAll()
                  .anyRequest().hasRole("RoleEmployee")
          .and()
              .formLogin()
                  .loginPage("/login.request")
                  .loginProcessingUrl("/login")
                  .failureUrl("/login.request?error")
                  .permitAll()
          .and()
              .logout()
                  .logoutUrl("/logout")
                  .permitAll()
                  .logoutSuccessUrl("/login.request")
          ;
  
          // @formatter:on
      }
  }
  </code></pre>
  
  <p>I want to now use Siteminder authentication and changed this to:</p>
  
  <pre><code>@Configuration
  @EnableWebMvcSecurity
  public class WebSecurityConfiguration extends WebSecurityConfigurerAdapter {
      private UserDetailsService userDetailsService;  
      private PreAuthenticatedAuthenticationProvider preAuthenticatedProvider;
  
      public WebSecurityConfiguration() {
          super();
  
          userDetailsService = new CustomUserDetailsService();
          UserDetailsByNameServiceWrapper&lt;PreAuthenticatedAuthenticationToken&gt; wrapper = new UserDetailsByNameServiceWrapper&lt;PreAuthenticatedAuthenticationToken&gt;(
                  userDetailsService);
  
          preAuthenticatedProvider = new PreAuthenticatedAuthenticationProvider();
          preAuthenticatedProvider.setPreAuthenticatedUserDetailsService(wrapper);
      }
  
  
      @Override
      protected void configure(
              AuthenticationManagerBuilder authenticationManagerBuilder)
              throws Exception {
  
  
          // @formatter:off
          authenticationManagerBuilder //
              .authenticationProvider(preAuthenticatedProvider);
          // @formatter:on
      }
  
      @Override
      public void configure(WebSecurity webSecurity) throws Exception {
          webSecurity.ignoring().antMatchers("/resources/**");
      }
  
      @Override
      protected void configure(HttpSecurity httpSecurity) throws Exception {
          // @formatter:off
  
          RequestHeaderAuthenticationFilter siteMinderFilter = new RequestHeaderAuthenticationFilter();
          siteMinderFilter.setAuthenticationManager(authenticationManager());
  
          httpSecurity
              .addFilter(siteMinderFilter)
              .authorizeRequests()
                  .antMatchers("/login","/login.request","/logout").permitAll()
                  .anyRequest().hasRole("RoleEmployee")
          .and()
              .formLogin()
                  .loginPage("/login.request")
                  .loginProcessingUrl("/login")
                  .failureUrl("/login.request?error")
                  .permitAll()
          .and()
              .logout()
                  .logoutUrl("/logout")
                  .permitAll()
                  .logoutSuccessUrl("/login.request")
          ;
  
          // @formatter:on
      }
  }
  </code></pre>
  
  <p>For now CustomUserDetailsService always returns a user with the employee role:</p>
  
  <pre><code>public class CustomUserDetailsService implements
          UserDetailsService {
      @Override
      public UserDetails loadUserByUsername(String username)
              throws UsernameNotFoundException {
          List&lt;GrantedAuthority&gt; authorities = new ArrayList&lt;GrantedAuthority&gt;();
          SimpleGrantedAuthority authority = new SimpleGrantedAuthority("RoleEmployee");
          authorities.add(authority);
  
          UserDetails user = new User(username, "password", authorities);
          return user;    
      }
  }
  </code></pre>
  
  <p>When I test this, the SM_USER header is correctly passed in and I can see in the debugger that CustomUserDetailsSerice is correctly called, but a 403 Forbidden status is returned for any page that I was previously able to access successfully under the old configuration.</p>
  
  <p>Is there something wrong with this configuration?</p>