title: Spring boot whitelist ip range
body: <p>most of the online tutorials focus on anyway secured endpoints, where IP whitelisting comes on top. So most of them describe:</p>
  
  <pre><code>@Configuration
  public class SomeCustom implements AuthenticationProvider {
  
      // initialization of ipWhitelistRange
  
      @Override
      public Authentication authenticate(Authentication auth) {
          WebAuthenticationDetails details = 
                             (WebAuthenticationDetails) authentication.getDetails();
          String userIp = details.getRemoteAddress();
          if(!ipWhitelistRange.contains(userIp)) {
              throw new BadCredentialsException("Invalid IP Address");
          }
  
          return authentication;      
      }
  }
  </code></pre>
  
  <p>then the above should be added to:</p>
  
  <pre><code>@Configuration
  @EnableWebSecurity
  public class SomeSecurity extends WebSecurityConfigurerAdapter {
      ...
      @Autowired
      private SomeCustom authenticationProvider;
  
      @Override
      protected void configure(AuthenticationManagerBuilder auth) throws Exception {
         auth.authenticationProvider(authenticationProvider);
      }
  
      @Override
      protected void configure(HttpSecurity http) throws Exception {
          http.authorizeRequests()
            .anyRequest().authenticated()
            ...
      }
      ...
  }
  </code></pre>
  
  <p>My use case is that I am having a fully open endpoint defined with a placeholder path variable like <code>/v1/something/{path}</code>.
  My current <code>SomeSecurity</code> is basically just <code>.anyRequest().permitAll()</code> and now I want to add the IP range restriction to only one of the <code>{path}</code> substitutions. For example:
  <code>/v1/something/foo</code>, <code>/v1/something/bar</code> etc. should remain fully open, just <code>/v1/something/special</code> should be restricted to some IP range. Whether it is possible to specify the IP range restriction on a path placeholder or not is not that important, I could specify also a fully new endpoint, my issue is more the fact that I cannot manage to trigger the IP range validation.
  When I add the <code>.authenticated()</code> my endpoint starts to respond with <code>Full authentication is required to access this resource</code> and in DEBUG mode the break point in the IP range validation logic is not stopping.</p>
  
  <p>In other words, how can I trigger the IP range validation of my <code>SomeCustom</code> without forcing the client of the API to authenticate with an USER?
  I know I could use the <code>SecurityContext</code> to get the user's IP and do the validation manually in my service logic or so, but this is not the idea I would say.
  Using Spring boot 2.2.x (Spring 5.x)</p>
  
  <p>EDIT: Since I realized that <code>.authenticated()</code> will for sure enforce a user login other than ANONYMOUS and since I don't use any login, thus my user is automatically the anonymous one I tried the following:</p>
  
  <pre><code>@Override
  protected void configure(HttpSecurity http) throws Exception {
      http.authorizeRequests()
        .antMatchers("/special").hasRole("ANONYMOUS")
        .anyRequest().permitAll()
  }
  </code></pre>
  
  <p>or</p>
  
  <pre><code>@Override
  protected void configure(HttpSecurity http) throws Exception {
      http.authorizeRequests()
        .antMatchers("/special").anonymous()
        .anyRequest().permitAll()
  }
  </code></pre>
  
  <p>both above are just going through without to trigger the <code>SomeCustom</code> IP whitelist provider.</p>
  
  <p>Could it be that just a customer auth provider is only triggered when a non-anonymous user is being used?</p>