title: Spring Boot Security - Anonymous User access on default mapping /
body: <p>We have Spring boot based Application and We wanted to give the default / mapping access to Anonymous user.
  we have added the default <code>index.html</code> (basic page).</p>
  
  <h1>In Controller</h1>
  
  <pre><code>@RequestMapping("/")
  public ModelAndView defaultViewManager(HttpServletRequest request) {
      logger.info("Default mapping.");
      ModelAndView modelAndView = new ModelAndView("index");
      return modelAndView;
  } 
  </code></pre>
  
  <h1>SecurityConfig</h1>
  
  <pre><code>@Configuration
  @EnableWebSecurity
  public class SecurityConfig extends WebSecurityConfigurerAdapter {
  
  private static final String SSO_HEADER = "AUTH_USER";
  
  public static final String ADMIN = "ROLE_ADMIN";
  public static final String USER = "ROLE_USER";
  public static final String ANONYMOUS = "ROLE_ANONYMOUS";
  
  @Autowired
  private PreAuthUserDetailsService userDetailsService;
  
  @Autowired
  public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
      auth.authenticationProvider(preAuthenticatedAuthProvider());
  }
  
  @Bean
  public PreAuthenticatedAuthenticationProvider preAuthenticatedAuthProvider() {
      UserDetailsByNameServiceWrapper&lt;PreAuthenticatedAuthenticationToken&gt; wrapper =
              new UserDetailsByNameServiceWrapper&lt;PreAuthenticatedAuthenticationToken&gt;    (userDetailsService);
  
      PreAuthenticatedAuthenticationProvider authProvider = new PreAuthenticatedAuthenticationProvider();
      authProvider.setPreAuthenticatedUserDetailsService(wrapper);
      return authProvider;
  }
  
  @Bean
  public RequestHeaderAuthenticationFilter headerAuthFilter() throws Exception {
      RequestHeaderAuthenticationFilter filter = new RequestHeaderAuthenticationFilter();
      filter.setPrincipalRequestHeader(SSO_HEADER);
      filter.setAuthenticationManager(authenticationManagerBean());
      return filter;
  }
  </code></pre>
  
  <p>The above mentioned code probably not necessary, but for background, we are using a PreAuthenticatedAuthentication Provider</p>
  
  <pre><code>@Override
  protected void configure(HttpSecurity http) throws Exception {
  
      // @formatter:off
      http.addFilter(headerAuthFilter())
          .authorizeRequests()
              .antMatchers("/").permitAll()
              .antMatchers("/admin/**").hasAuthority(ADMIN)
              .antMatchers("/**").hasAuthority(USER)
  
          .and()
              .logout()
                  .deleteCookies("remove")
                  .invalidateHttpSession(true)
                  .logoutUrl("/logout")
                  .logoutSuccessUrl("/login?logout")
          .and()
              .csrf().disable()
              .headers().frameOptions().disable();
      // @formatter:on
  }
  }
  </code></pre>
  
  <p>FYI, I have added the Interceptor too. The Interceptor appears to be triggered, even with the exclude pattern </p>
  
  <pre><code>public void addInterceptors(InterceptorRegistry registry) {     
           registry.addInterceptor(wikiRequestHandlerInterceptor()).
  excludePathPatterns("/").addPathPatterns("/**");   
  
  }
  </code></pre>
  
  <p>In the above <code>SecurityConfig</code> code. I tried to permit using <code>.antMatchers("/").permitAll()</code> and added Authority for rest means all <code>/**</code> and <code>/admin/**</code>. But this is not working. please help to mention correct antMatchers to provide the anonymous access to default /mapping only.</p>
  
  <p>Thanks in Advance.</p>