在特定路径中使用用户名/密码身份验证

this answer )但它解决了我的问题。

首先,我创造了这个 AuthenticationProvider :

public class ClusterInternalAuthenticationProvider implements AuthenticationProvider {

    public static final String USER = "...";
    public static final String PASSWORD = "...";

    @Override
    public Authentication authenticate(Authentication authentication) throws AuthenticationException {
        UsernamePasswordAuthenticationToken token = (UsernamePasswordAuthenticationToken)authentication;

        Object principal = token.getPrincipal();
        Object credentials = token.getCredentials();

        if (principal.equals(USER) && credentials.equals(PASSWORD)) {
            return new UsernamePasswordAuthenticationToken(
                principal,
                credentials,
                Collections.singletonList(new SimpleGrantedAuthority("RELEVANT_AUTHORITY"))
            );
        }

        throw new BadCredentialsException("Sorry mate, wrong credentials...");
    }

    @Override
    public boolean supports(Class<?> authentication) {
        return authentication.isAssignableFrom(UsernamePasswordAuthenticationToken.class);
    }
}

这将尝试user/pswd组合,如果为true,则返回具有访问特定路径所需权限的凭据。

接下来,在SecurityConfiguration中,我启用 httpBasic 加上我的 身份验证提供者 :

    @Override
    public void configure(HttpSecurity http) throws Exception {
        http
        ...
        .and()
            .authorizeRequests()
            .antMatchers("my-path/**").hasAuthority("RELEVANT_AUTHORITY")
        .and()
            .httpBasic()
        .and()
            .authenticationProvider(new ClusterInternalAuthenticationProvider());
    }