I have configured a Spring Gateway service with Spring security enabled and oauth2 configured. I can perform the login and logout without any issue, even a custom LogoutSuccessHandler, until I configure exceptionHandling.authenticationEntryPoint
.
This is the configuration that is not working:
@Bean
fun dsl(
http: ServerHttpSecurity,
rcrr: ReactiveClientRegistrationRepository,
): SecurityWebFilterChain =
http.invoke {
authorizeExchange {
authorize("/logout", permitAll)
authorize("/token", permitAll)
authorize(anyExchange, authenticated)
}
oauth2Login {}
oauth2ResourceServer { jwt {} }
// If I remove this configuration below the logout works fine
exceptionHandling {
authenticationEntryPoint = HttpStatusServerEntryPoint(HttpStatus.UNAUTHORIZED)
}
logout {
logoutSuccessHandler = KeycloakServerLogoutSuccessHandler(rcrr, realm, keycloakURI, redirectURI)
}
cors {
configurationSource = corsConfigurationSource()
}
}
When I try to call to /logout
endpoint I get a 404
code, so the authenticationEntryPoint
is not in causing the issue directly. I know that I can create a custom logout rest endpoint and configure everything, but I would like to use the default one
How can I have these two configurations together?
Or what is the reason of this incompatibility?