title: access denied user is anonymous - spring boot ws basic authentication
body: <p>I'm working on a demo application using spring boot. so the idea is to create a soap webservice and add a basic http authentication to it. I followed some tutorials on the net but it doesn't help me to solve the issue.</p>
  
  <p>at first i created a simple soap webservice and i tested it using soapui. it works perfectly. when i added the spring security to the classpath i succeeded to open the wsdl provided by my app (using my browser and the login form provided by spring by default). but it failed to consume the webservice using soapui even after adding the authencation headers.</p>
  
  <p>here is my app config.</p>
  
  <pre><code>&lt;dependencies&gt;
    &lt;dependency&gt;
      &lt;groupId&gt;org.springframework.boot&lt;/groupId&gt;
      &lt;artifactId&gt;spring-boot-starter-web-services&lt;/artifactId&gt;
    &lt;/dependency&gt;
    &lt;dependency&gt;
      &lt;groupId&gt;org.springframework.boot&lt;/groupId&gt;
      &lt;artifactId&gt;spring-boot-starter-security&lt;/artifactId&gt;
    &lt;/dependency&gt;
  &lt;/dependencies&gt;
  </code></pre>
  
  <p>application.yml</p>
  
  <pre><code>spring:
    security:
      basic:
        enabled: true
      user:
        name: client
        password: password
  </code></pre>
  
  <p>WebServiceConfig.java</p>
  
  <pre><code>@EnableWs
  @Configuration
  public class WebServiceConfig extends WsConfigurerAdapter {
  
  @Bean
  public ServletRegistrationBean&lt;Servlet&gt; messageDispatcherServlet(ApplicationContext applicationContext) {
      MessageDispatcherServlet servlet = new MessageDispatcherServlet();
      servlet.setApplicationContext(applicationContext);
      return new ServletRegistrationBean&lt;&gt;(servlet, "/ws/library/*");
  }
  
  @Bean(name = "books")
  public Wsdl11Definition defaultWsdl11Definition() {
      SimpleWsdl11Definition wsdl11Definition = new SimpleWsdl11Definition();
      wsdl11Definition.setWsdl(new ClassPathResource("/book.wsdl"));
      return wsdl11Definition;
  }
  }
  </code></pre>
  
  <p>BookEndpoint.java</p>
  
  <pre><code>@Endpoint
  public class BookEndpoint {
  
  @PayloadRoot(
          namespace = "http://www.cleverbuilder.com/BookService/",
          localPart = "GetBook")
  @ResponsePayload
  public GetBookResponse getBook(@RequestPayload GetBook book) {
  
      ObjectFactory factory = new ObjectFactory();
      GetBookResponse response = factory.createGetBookResponse();
      response.setID("A"+book.getID());
      return response;
  }
  }
  </code></pre>
  
  <p>the request generated by soapui is as follows:</p>
  
  <pre><code>POST http://localhost:8080/ws/library/BookService HTTP/1.1
  Accept-Encoding: gzip,deflate
  Content-Type: text/xml;charset=UTF-8
  SOAPAction: "http://www.cleverbuilder.com/BookService/GetBook"
  Authorization: Basic Y2xpZW50OnBhc3N3b3Jk
  Content-Length: 280
  Host: localhost:8080
  Connection: Keep-Alive
  User-Agent: Apache-HttpClient/4.1.1 (java 1.5)
  Cookie: JSESSIONID=77EF4FFB2B5A52EC21A47C230624B6DE
  Cookie2: $Version=1
  
  &lt;soapenv:Envelope     xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"     xmlns:book="http://www.cleverbuilder.com/BookService/"&gt;
  &lt;soapenv:Header/&gt;
  &lt;soapenv:Body&gt;
    &lt;book:GetBook&gt;
       &lt;ID&gt;85&lt;/ID&gt;
    &lt;/book:GetBook&gt;
  &lt;/soapenv:Body&gt;
  &lt;/soapenv:Envelope&gt;
  </code></pre>
  
  <p>and the server response :</p>
  
  <pre><code>HTTP/1.1 401 
  X-Content-Type-Options: nosniff
  X-XSS-Protection: 1; mode=block
  Cache-Control: no-cache, no-store, max-age=0, must-revalidate
  Pragma: no-cache
  Expires: 0
  X-Frame-Options: DENY
  WWW-Authenticate: Basic realm="Realm"
  Content-Length: 0
  Date: Mon, 22 Apr 2019 09:08:43 GMT
  </code></pre>
  
  <p>and the logged error is :</p>
  
  <pre><code>Voter: org.springframework.security.web.access.expression.WebExpressionVoter@77114100, returned: -1
  ExceptionTranslationFilter     : Access is denied (user is anonymous); redirecting to authentication entry point
  
  org.springframework.security.access.AccessDeniedException: Access is denied
  at org.springframework.security.access.vote.AffirmativeBased.decide(AffirmativeBased.java:84) ~[spring-security-core-5.1.5.RELEASE.jar:5.1.5.RELEASE]
  at org.springframework.security.access.intercept.AbstractSecurityInterceptor.beforeInvocation(AbstractSecurityInterceptor.java:233) ~[spring-security-core-5.1.5.RELEASE.jar:5.1.5.RELEASE]
  </code></pre>
  
  <p>can anyone help me please ?</p>