title: Spring Security In memory authentication not working
body: <p>I am trying to implement an in memory authentication using spring security with a predefined user id and password. i am using basic HTTP authentication and sending the user id and password combination as a Header in the form "userId:password" (for the sake of simplicity , i am ignoring the encoding of above mentioned header).</p>
  
  <p>Below is one of the rest end point for which i am trying to implement spring security.</p>
  
  <pre><code>@RequestMapping(value = "/course", method = RequestMethod.POST, produces = MediaType.APPLICATION_JSON_VALUE)
   public ResponseEntity&lt;ApiResponse&gt; addCourse(@RequestBody Course course) {
     return new ResponseEntity&lt;ApiResponse&gt;(new ApiResponse(HttpStatus.OK.value(), null), HttpStatus.OK);
   }
  </code></pre>
  
  <p>Below is the junit test,using which i am trying to validate the spring security configuration</p>
  
  <pre><code>@Test
    public void testAddCourse() throws Exception {
      String inputJsonRequest = JacksonMapperUtil.convertObjectToJsonString(course);
      mockMvc.perform(MockMvcRequestBuilders.post("/course")
          .contentType(MediaType.APPLICATION_JSON)
          .content(inputJsonRequest)
          .header("jane_doe", "admin_password"))
          .andExpect(MockMvcResultMatchers.status().isOk())
          .andExpect(MockMvcResultMatchers.jsonPath("$.statusCode").value(HttpStatus.OK.value()));
    }
  </code></pre>
  
  <p>Below is the websecurity config file,that i have configured.</p>
  
  <pre><code>@Configuration
  @EnableWebSecurity
  public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
  
    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
      auth.inMemoryAuthentication()
          .withUser("john_doe")
          .password("student_password")
          .authorities("ROLE_STUDENT_USER")
          .and()
          .withUser("jane_doe")
          .password("admin_password")
          .authorities("ROLE_OFFICE_ADMIN");
    }
  
    @Autowired
    public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
      auth.inMemoryAuthentication()
          .withUser("john_doe")
          .password("student_password")
          .authorities("ROLE_STUDENT_USER")
          .and()
          .withUser("jane_doe")
          .password("admin_password")
          .authorities("ROLE_OFFICE_ADMIN");
    }
  
    @Override
    protected void configure(HttpSecurity http) throws Exception {
      http.httpBasic()
          .and()
          .authorizeRequests()
          .antMatchers(HttpMethod.POST, "/course")
          .hasAuthority("ROLE_OFFICE_ADMIN")
          .antMatchers(HttpMethod.POST, "/student")
          .hasAnyAuthority("ROLE_OFFICE_ADMIN", "ROLE_STUDENT_USER")
          .antMatchers(HttpMethod.GET, "/**")
          .permitAll()
          .anyRequest()
          .authenticated()
          .and()
          .exceptionHandling()
          .accessDeniedHandler(accessDeniedHandler())
          .authenticationEntryPoint(authenticationEntryPoint());
    }
  
    @Bean
    RestAccessDeniedHandler accessDeniedHandler() {
      return new RestAccessDeniedHandler();
    }
  
    @Bean
    RestAuthenticationEntryPoint authenticationEntryPoint() {
      return new RestAuthenticationEntryPoint();
    }
  }
  
  </code></pre>
  
  <p>AuthenticationEntryPoint implementation class</p>
  
  <pre><code>@Component
  public class RestAuthenticationEntryPoint implements AuthenticationEntryPoint {
  
    @Override
    public void commence(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, AuthenticationException e)
        throws IOException, ServletException {
      ApiResponse response = new ApiResponse(HttpStatus.UNAUTHORIZED.value(),
          "Authentication Failure-The user name and password combination is incorrect");
      OutputStream out = httpServletResponse.getOutputStream();
      ObjectMapper mapper = new ObjectMapper();
      mapper.writeValue(out, response);
      out.flush();
    }
  </code></pre>
  
  <p>AccessDenied Handler implementation class</p>
  
  <pre><code>
  @Component
  public class RestAccessDeniedHandler implements AccessDeniedHandler {
    @Override
    public void handle(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, AccessDeniedException e)
        throws IOException, ServletException {
      ApiResponse apiResponse = new ApiResponse(HttpStatus.FORBIDDEN.value(),
          "Authorization Failure-This user does not have the sufficient level of access");
      OutputStream out = httpServletResponse.getOutputStream();
      ObjectMapper mapper = new ObjectMapper();
      mapper.writeValue(out, apiResponse);
      out.flush();
    }
  </code></pre>
  
  <p>The maven dependencies used:</p>
  
  <p>Spring boot version - 2.2.1.RELEASE</p>
  
  <pre><code>        &lt;dependency&gt;
              &lt;groupId&gt;org.springframework.boot&lt;/groupId&gt;
              &lt;artifactId&gt;spring-boot-starter-security&lt;/artifactId&gt;
              &lt;version&gt;2.2.1.RELEASE&lt;/version&gt;
          &lt;/dependency&gt;
  </code></pre>
  
  <p>The problem with the above configuration that i have noticed is that, the authentication of incoming request is not done, even if the request comprises of correct/in correct userId:password header value.
  Can some one point out what am i doing wrong?</p>