Allow access to one URL with username/password and others from IP address
<p>I'm trying to figure out how to do the following with Spring Security:</p>

<p>I need to allow outside access on a certain endpoint, at <code>/webhooks/</code>, but protect it with a HTTP basic username/password. On all other endpoints, access must be restricted, except from certain subnets. </p>

<p>Here's what I have thus far. It's not working, as everything gets denied. </p>

<pre><code>import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.context.annotation.Configuration;
import org.springframework.context.annotation.PropertySource;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;

/**
 * Created on 27 July 2016 @ 1:49 PM
 * Component for project "security"
 */
@Configuration
@EnableWebSecurity
@PropertySource("classpath:/test.properties")
public class SecurityConfig extends WebSecurityConfigurerAdapter {
    @Value("${test.webhooks.username}")
    private String username;
    @Value("${test.webhooks.password}")
    private String password;

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
                .authorizeRequests()

                        .antMatchers("/webhooks/").authenticated()
                .and().authorizeRequests()
                        .antMatchers("/**").hasIpAddress("10.0.0.0/8")
                        .antMatchers("/**").hasIpAddress("172.16.0.0/16")
                        .antMatchers("/**").hasIpAddress("192.168.1.0/24")
                        .antMatchers("/**").hasIpAddress("172.0.0.0/8")
                        .antMatchers("/**").denyAll()
        ;

    }

    @Autowired
    public void configureGlobal(AuthenticationManagerBuilder authenticationManagerBuilder) throws Exception {
        authenticationManagerBuilder
                .inMemoryAuthentication()
                        .withUser(username).password(password).roles("WEBHOOKS_ACCESS")
        ;
    }
}
</code></pre>

<p>Any help would be awesome! I'm not sure if the chained ant matchers are correct in any event. </p>