I play with Spring's security configuration and find out that the most common way to configure in-memory authentication is through a method configureGlobal():
@Configuration
@EnableWebMvcSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
@Autowired
public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception{
auth
.inMemoryAuthentication()
.withUser("user").password("userPwd").roles("USER");
}
}
But there is another way that is used less widely, overriding the method configure()from WebSecurityConfigurerAdapter:
@Configuration
@EnableWebMvcSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {
@Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
auth
.inMemoryAuthentication(
.withUser("user").password("userPwd").roles("USER");
}
}
I'm just wondering what is the difference between the two and what is the point of using the method configureGlobal()over configure()one?
source
share