{"action":"closed","issue":{"url":"https://api.github.com/repos/stormpath/stormpath-sdk-java/issues/322","labels_url":"https://api.github.com/repos/stormpath/stormpath-sdk-java/issues/322/labels{/name}","comments_url":"https://api.github.com/repos/stormpath/stormpath-sdk-java/issues/322/comments","events_url":"https://api.github.com/repos/stormpath/stormpath-sdk-java/issues/322/events","html_url":"https://github.com/stormpath/stormpath-sdk-java/issues/322","id":114105969,"number":322,"title":"\"Finer Grain of Control\" section of tutorial misses need to set property.","user":{"login":"george-hawkins-aa","id":12233059,"avatar_url":"https://avatars.githubusercontent.com/u/12233059?v=3","gravatar_id":"","url":"https://api.github.com/users/george-hawkins-aa","html_url":"https://github.com/george-hawkins-aa","followers_url":"https://api.github.com/users/george-hawkins-aa/followers","following_url":"https://api.github.com/users/george-hawkins-aa/following{/other_user}","gists_url":"https://api.github.com/users/george-hawkins-aa/gists{/gist_id}","starred_url":"https://api.github.com/users/george-hawkins-aa/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/george-hawkins-aa/subscriptions","organizations_url":"https://api.github.com/users/george-hawkins-aa/orgs","repos_url":"https://api.github.com/users/george-hawkins-aa/repos","events_url":"https://api.github.com/users/george-hawkins-aa/events{/privacy}","received_events_url":"https://api.github.com/users/george-hawkins-aa/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":{"url":"https://api.github.com/repos/stormpath/stormpath-sdk-java/milestones/23","html_url":"https://github.com/stormpath/stormpath-sdk-java/milestones/1.0%20RC5.1","labels_url":"https://api.github.com/repos/stormpath/stormpath-sdk-java/milestones/23/labels","id":1311144,"number":23,"title":"1.0 RC5.1","description":"","creator":{"login":"omgitstom","id":3199093,"avatar_url":"https://avatars.githubusercontent.com/u/3199093?v=3","gravatar_id":"","url":"https://api.github.com/users/omgitstom","html_url":"https://github.com/omgitstom","followers_url":"https://api.github.com/users/omgitstom/followers","following_url":"https://api.github.com/users/omgitstom/following{/other_user}","gists_url":"https://api.github.com/users/omgitstom/gists{/gist_id}","starred_url":"https://api.github.com/users/omgitstom/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/omgitstom/subscriptions","organizations_url":"https://api.github.com/users/omgitstom/orgs","repos_url":"https://api.github.com/users/omgitstom/repos","events_url":"https://api.github.com/users/omgitstom/events{/privacy}","received_events_url":"https://api.github.com/users/omgitstom/received_events","type":"User","site_admin":false},"open_issues":2,"closed_issues":8,"state":"open","created_at":"2015-09-17T17:53:18Z","updated_at":"2015-10-31T03:22:30Z","due_on":null,"closed_at":null},"comments":1,"created_at":"2015-10-29T17:41:15Z","updated_at":"2015-10-31T03:22:30Z","closed_at":"2015-10-31T03:22:30Z","body":"The [Finer Grain of Control](http://docs.stormpath.com/java/spring-boot-web/tutorial.html#a-finer-grain-of-control) section of the tutorial doesn't make clear that you must set:\r\n\r\n    stormpath.spring.security.fullyAuthenticated.enabled = false\r\n\r\nThe previous section implies (to me) that this property only needs to be set to false if you don't want to take fined grained control of things.\r\n\r\nHowever if you don't set it to false then the `me` \"rule\" in one's `doConfigure(...)` logic will never be used:\r\n\r\n    .antMatchers(\"/me\").fullyAuthenticated()\r\n    .antMatchers(\"/**\").permitAll();\r\n\r\nThe ordering here (taken from the tutorial) makes you think that  the `/me` rule would be matched against before hitting the `/**` rule. But this isn't the case.\r\n\r\nThings actually get setup like this:\r\n\r\n1. You hit `com.stormpath.spring.config.StormpathWebSecurityConfigurer.configure(HttpSecurity)`. This adds in `antMatchers(\"/**\").fullyAuthenticated()`.\r\n2. Then the end-users `doConfigure(...)` logic (like above) is hit. This adds in `antMatchers(\"/me\").fullyAuthenticated()` and `antMatchers(\"/**\").permitAll()`.\r\n3. Finally we hit `org.springframework.security.config.annotation.web.configurers.AbstractConfigAttributeRequestMatcherRegistry.createRequestMap()`. This iterates thru the _array_ of mappings that we're created and builds up a linked hash map.\r\n\r\nSo (after handling mappping for logon etc.) it hits the original `/**` to fully-authenticated mapping, then it hits the `/me` mapping and then it hits the `/**` to permit-all mapping. As the hash map is keyed off the URL patterns, i.e. `/**`, `/me` etc. the permit-all mapping for `/**` replaces the older fully-authenticated mapping but the old ordering is preserved, i.e. `/**` will still be before `/me` in the linked hash map but will now point to permit-all.\r\n\r\nSo when a request comes in from a browser its URL gets matched against the patterns in this linked hash map in `org.springframework.security.web.access.intercept.DefaultFilterInvocationSecurityMetadataSource.getAttributes(...)` and it will always match against the `/**` pattern (which now point to permit-all) and stop there, never going on and matching against the `/me` mapping or anything else setup by the end user in `doConfigure(...)`."}}